==================================================================
BUG: KASAN: slab-out-of-bounds in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: slab-out-of-bounds in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: slab-out-of-bounds in detach_if_pending+0x188/0x360 kernel/time/timer.c:841
Write of size 8 at addr ffff8881d48331c8 by task syz-executor.2/3114

CPU: 0 PID: 3114 Comm: syz-executor.2 Not tainted 5.4.268-syzkaller-00003-g2d5d8240a7cb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 __hlist_del include/linux/list.h:791 [inline]
 detach_timer kernel/time/timer.c:824 [inline]
 detach_if_pending+0x188/0x360 kernel/time/timer.c:841
 try_to_del_timer_sync kernel/time/timer.c:1238 [inline]
 del_timer_sync+0x13c/0x230 kernel/time/timer.c:1379
 tun_flow_uninit+0x2c/0x280 drivers/net/tun.c:1451
 tun_free_netdev+0x77/0x190 drivers/net/tun.c:2401
 netdev_run_todo+0xb7f/0xdf0 net/core/dev.c:9458
 tun_detach drivers/net/tun.c:765 [inline]
 tun_chr_close+0xc1/0x130 drivers/net/tun.c:3557
 __fput+0x262/0x680 fs/file_table.c:281
 task_work_run+0x140/0x170 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8881d4833180
 which belongs to the cache sgpool-32 of size 1024
The buggy address is located 72 bytes inside of
 1024-byte region [ffff8881d4833180, ffff8881d4833580)
The buggy address belongs to the page:
page:ffffea0007520c00 refcount:1 mapcount:0 mapping:ffff8881f0a7cc80 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f0a7cc80
raw: 0000000000000000 00000000800e000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0x109/0x250 mm/slub.c:2842
 mempool_alloc+0x11f/0x530 mm/mempool.c:393
 __sg_alloc_table+0xc4/0x3b0 lib/scatterlist.c:302
 sg_alloc_table_chained+0xe2/0x1b0 lib/sg_pool.c:132
 scsi_init_sgtable drivers/scsi/scsi_lib.c:999 [inline]
 scsi_init_io+0x102/0x340 drivers/scsi/scsi_lib.c:1034
 sd_setup_read_write_cmnd drivers/scsi/sd.c:1176 [inline]
 sd_init_command+0x852/0x2000 drivers/scsi/sd.c:1292
 scsi_setup_fs_cmnd drivers/scsi/scsi_lib.c:1216 [inline]
 scsi_setup_cmnd drivers/scsi/scsi_lib.c:1235 [inline]
 scsi_mq_prep_fn drivers/scsi/scsi_lib.c:1618 [inline]
 scsi_queue_rq+0x13a8/0x2860 drivers/scsi/scsi_lib.c:1681
 blk_mq_dispatch_rq_list+0x8ee/0x16f0 block/blk-mq.c:1304
 blk_mq_do_dispatch_sched+0x389/0x480 block/blk-mq-sched.c:132
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4953 [inline]
 __free_pages+0x91/0x140 mm/page_alloc.c:4959
 device_release+0x6b/0x190 drivers/base/core.c:1776
 kobject_cleanup lib/kobject.c:716 [inline]
 kobject_release lib/kobject.c:747 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e6/0x2f0 lib/kobject.c:764
 netdev_run_todo+0xc44/0xdf0 net/core/dev.c:9469
 tun_detach drivers/net/tun.c:765 [inline]
 tun_chr_close+0xc1/0x130 drivers/net/tun.c:3557
 __fput+0x262/0x680 fs/file_table.c:281
 task_work_run+0x140/0x170 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881d4833080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881d4833100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881d4833180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                              ^
 ffff8881d4833200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d4833280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================