==================================================================
BUG: KASAN: use-after-free in memset include/linux/string.h:410 [inline]
BUG: KASAN: use-after-free in __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
Write of size 32 at addr ffff88819ef1b3c0 by task net.agent/9374

CPU: 0 PID: 9374 Comm: net.agent Not tainted 5.5.0-rc2-next-20191220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
 memset+0x24/0x40 mm/kasan/common.c:108
 memset include/linux/string.h:410 [inline]
 __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
 alloc_skb include/linux/skbuff.h:1049 [inline]
 igmpv3_newpack+0x1b9/0x1110 net/ipv4/igmp.c:361
 add_grhead.isra.0+0x235/0x300 net/ipv4/igmp.c:442
 add_grec+0x842/0x1230 net/ipv4/igmp.c:575
 igmpv3_send_cr net/ipv4/igmp.c:712 [inline]
 igmp_ifc_timer_expire+0x4af/0xab0 net/ipv4/igmp.c:809
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
 __do_softirq+0x262/0x98c kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x19b/0x1e0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0010:kernel_poison_pages+0x8/0x2b0 mm/page_poison.c:119
Code: cc cc 55 48 89 e5 e8 f7 c7 c2 ff 0f b6 05 c0 e8 ce 08 5d c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 fd 41 54 41 89 f4 53 89 d3 48 83 ec 10 e8 c2 c7 c2 ff
RSP: 0018:ffffc90001d87480 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffffed1012a3d800 RBX: 0000000000000301 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffea0002547b00
RBP: ffffc90001d87490 R08: 1ffffd40004a8f66 R09: ffffed1012a3d800
R10: fffff940004a8f66 R11: ffffea0002547b37 R12: ffffea0002547b00
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000400dc0
 post_alloc_hook mm/page_alloc.c:2161 [inline]
 prep_new_page+0x11d/0x200 mm/page_alloc.c:2168
 get_page_from_freelist+0x1741/0x42e0 mm/page_alloc.c:3695
 __alloc_pages_nodemask+0x2d0/0x910 mm/page_alloc.c:4742
 alloc_pages_current+0x107/0x210 mm/mempolicy.c:2211
 alloc_pages include/linux/gfp.h:532 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1b/0x1a0 arch/x86/mm/pgtable.c:26
 __pte_alloc+0x20/0x310 mm/memory.c:426
 copy_pte_range mm/memory.c:816 [inline]
 copy_pmd_range mm/memory.c:892 [inline]
 copy_pud_range mm/memory.c:926 [inline]
 copy_p4d_range mm/memory.c:948 [inline]
 copy_page_range+0x1629/0x20e0 mm/memory.c:1010
 dup_mmap kernel/fork.c:604 [inline]
 dup_mm+0xa67/0x1430 kernel/fork.c:1360
 copy_mm kernel/fork.c:1416 [inline]
 copy_process+0x2ad6/0x7220 kernel/fork.c:2072
 _do_fork+0x146/0x1090 kernel/fork.c:2421
 __do_sys_clone kernel/fork.c:2576 [inline]
 __se_sys_clone kernel/fork.c:2557 [inline]
 __x64_sys_clone+0x19a/0x260 kernel/fork.c:2557
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7faaf07ddf46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81 c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007ffc4d094490 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc4d094490 RCX: 00007faaf07ddf46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc4d0944d0 R08: 0000000000000000 R09: 000000000000249e
R10: 00007faaf0cd49d0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea00067bc6c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
raw: 057ffe0000000000 ffffea00067bc6c8 ffffea00067bc6c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88819ef1b280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88819ef1b300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88819ef1b380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                           ^
 ffff88819ef1b400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88819ef1b480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================