==================================================================
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler net/ipv4/tcp_timer.c:624 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0x998/0x9f0 net/ipv4/tcp_timer.c:594
Read of size 1 at addr ffff88807e66a845 by task syz-executor.5/7073

CPU: 0 PID: 7073 Comm: syz-executor.5 Not tainted 6.0.0-syzkaller-03015-g2bca25eaeba6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:317 [inline]
 print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433
 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
 tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
 tcp_write_timer_handler net/ipv4/tcp_timer.c:624 [inline]
 tcp_write_timer_handler+0x998/0x9f0 net/ipv4/tcp_timer.c:594
 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:637
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:rcu_rdp_cpu_online kernel/rcu/tree.c:235 [inline]
RIP: 0010:rcu_lockdep_current_cpu_online kernel/rcu/tree.c:774 [inline]
RIP: 0010:rcu_lockdep_current_cpu_online+0x7b/0x140 kernel/rcu/tree.c:758
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 a4 00 00 00 48 03 1c ed e0 28 a4 8b 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa <48> c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 8d 7b 18 48 8b 6b 20
RSP: 0018:ffffc9000456f690 EFLAGS: 00000286
RAX: dffffc0000000000 RBX: ffff8880b9a3af00 RCX: ffffffff815da121
RDX: ffff8880b9a3af20 RSI: 0000000000000002 RDI: ffff8880b9a3af20
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ddf7a57
R10: fffffbfff1bbef4a R11: 0000000000000000 R12: 0000000000000001
R13: ffff88804c648528 R14: ffff88804c648528 R15: ffffc9000456f940
 rcu_read_lock_held_common kernel/rcu/update.c:112 [inline]
 rcu_read_lock_held_common kernel/rcu/update.c:102 [inline]
 rcu_read_lock_sched_held+0x25/0x70 kernel/rcu/update.c:123
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x560/0x780 kernel/locking/lockdep.c:5677
 __mutex_unlock_slowpath+0x99/0x5e0 kernel/locking/mutex.c:907
 __unix_dgram_recvmsg+0x430/0xb80 net/unix/af_unix.c:2519
 unix_dgram_recvmsg+0xc0/0xe0 net/unix/af_unix.c:2535
 sock_recvmsg_nosec net/socket.c:995 [inline]
 ____sys_recvmsg+0x536/0x600 net/socket.c:2699
 ___sys_recvmsg+0xf2/0x180 net/socket.c:2743
 do_recvmmsg+0x25e/0x6e0 net/socket.c:2837
 __sys_recvmmsg net/socket.c:2916 [inline]
 __do_sys_recvmmsg net/socket.c:2939 [inline]
 __se_sys_recvmmsg net/socket.c:2932 [inline]
 __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2932
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc53668a5a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc537871168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007fc5367ac050 RCX: 00007fc53668a5a9
RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 00007fc5366e5580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc252c99ef R14: 00007fc537871300 R15: 0000000000022000
 </TASK>

Allocated by task 3699:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:437 [inline]
 ____kasan_kmalloc mm/kasan/common.c:516 [inline]
 ____kasan_kmalloc mm/kasan/common.c:475 [inline]
 __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:525
 kmalloc_reserve net/core/skbuff.c:437 [inline]
 __alloc_skb+0xd9/0x2f0 net/core/skbuff.c:509
 alloc_skb include/linux/skbuff.h:1265 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:742 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:799 [inline]
 nsim_dev_trap_report_work+0x2ad/0xc50 drivers/net/netdevsim/dev.c:844
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Freed by task 3699:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:367 [inline]
 ____kasan_slab_free+0x13d/0x1a0 mm/kasan/common.c:329
 kasan_slab_free include/linux/kasan.h:200 [inline]
 __cache_free mm/slab.c:3418 [inline]
 kfree+0x173/0x390 mm/slab.c:3786
 skb_free_head+0xac/0x110 net/core/skbuff.c:760
 skb_release_data+0x5f1/0x870 net/core/skbuff.c:789
 skb_release_all net/core/skbuff.c:854 [inline]
 __kfree_skb net/core/skbuff.c:868 [inline]
 consume_skb net/core/skbuff.c:1033 [inline]
 consume_skb+0xc2/0x160 net/core/skbuff.c:1027
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:815 [inline]
 nsim_dev_trap_report_work+0x871/0xc50 drivers/net/netdevsim/dev.c:844
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

The buggy address belongs to the object at ffff88807e66a000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 2117 bytes inside of
 4096-byte region [ffff88807e66a000, ffff88807e66b000)

The buggy address belongs to the physical page:
page:ffffea0001f99a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e66a
head:ffffea0001f99a80 order:1 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea00008cb308 ffffea0000e57c08 ffff888011840900
raw: 0000000000000000 ffff88807e66a000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x3c2220(__GFP_HIGH|__GFP_ATOMIC|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE), pid 3702, tgid 3702 (kworker/1:5), ts 518910558547, free_ts 518833285404
 prep_new_page mm/page_alloc.c:2532 [inline]
 get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
 __alloc_pages_node include/linux/gfp.h:243 [inline]
 kmem_getpages mm/slab.c:1363 [inline]
 cache_grow_begin+0x75/0x360 mm/slab.c:2569
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2942
 ____cache_alloc mm/slab.c:3018 [inline]
 ____cache_alloc mm/slab.c:3001 [inline]
 slab_alloc_node mm/slab.c:3220 [inline]
 kmem_cache_alloc_node_trace+0x50a/0x570 mm/slab.c:3601
 __do_kmalloc_node mm/slab.c:3623 [inline]
 __kmalloc_node_track_caller+0x38/0x60 mm/slab.c:3638
 kmalloc_reserve net/core/skbuff.c:437 [inline]
 __alloc_skb+0xd9/0x2f0 net/core/skbuff.c:509
 alloc_skb include/linux/skbuff.h:1265 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:742 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:799 [inline]
 nsim_dev_trap_report_work+0x2ad/0xc50 drivers/net/netdevsim/dev.c:844
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1449 [inline]
 free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
 free_unref_page_prepare mm/page_alloc.c:3380 [inline]
 free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
 slab_destroy mm/slab.c:1615 [inline]
 slabs_destroy+0x89/0xc0 mm/slab.c:1635
 cache_flusharray mm/slab.c:3389 [inline]
 ___cache_free+0x2a8/0x3d0 mm/slab.c:3452
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x4f/0x1b0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x97/0xb0 mm/kasan/common.c:447
 kasan_slab_alloc include/linux/kasan.h:224 [inline]
 slab_post_alloc_hook mm/slab.h:727 [inline]
 slab_alloc_node mm/slab.c:3232 [inline]
 kmem_cache_alloc_node+0x2f1/0x560 mm/slab.c:3583
 __alloc_skb+0x210/0x2f0 net/core/skbuff.c:497
 alloc_skb_fclone include/linux/skbuff.h:1315 [inline]
 tipc_buf_acquire+0x25/0xe0 net/tipc/msg.c:72
 tipc_msg_build+0xf3/0x10a0 net/tipc/msg.c:386
 __tipc_sendstream+0x6d9/0x11a0 net/tipc/socket.c:1619
 tipc_sendstream+0x4c/0x70 net/tipc/socket.c:1550
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2482
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536

Memory state around the buggy address:
 ffff88807e66a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807e66a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807e66a800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff88807e66a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807e66a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	48 89 fa             	mov    %rdi,%rdx
   3:	48 c1 ea 03          	shr    $0x3,%rdx
   7:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   b:	0f 85 a4 00 00 00    	jne    0xb5
  11:	48 03 1c ed e0 28 a4 	add    -0x745bd720(,%rbp,8),%rbx
  18:	8b
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 8d 7b 20          	lea    0x20(%rbx),%rdi
  27:	48 89 fa             	mov    %rdi,%rdx
* 2a:	48 c1 ea 03          	shr    $0x3,%rdx <-- trapping instruction
  2e:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  32:	0f 85 87 00 00 00    	jne    0xbf
  38:	48 8d 7b 18          	lea    0x18(%rbx),%rdi
  3c:	48 8b 6b 20          	mov    0x20(%rbx),%rbp