==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline]
BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468
Read of size 8 at addr ffff888031b9b680 by task syz-executor.1/5195

CPU: 1 PID: 5195 Comm: syz-executor.1 Not tainted 6.8.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 list_empty include/linux/list.h:373 [inline]
 waitqueue_active include/linux/wait.h:127 [inline]
 sock_def_write_space_wfree net/core/sock.c:3384 [inline]
 sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468
 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080
 skb_release_all net/core/skbuff.c:1092 [inline]
 napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404
 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970
 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline]
 e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801
 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576
 napi_poll net/core/dev.c:6645 [inline]
 net_rx_action+0x956/0xe90 net/core/dev.c:6778
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:247
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0010:check_kcov_mode kernel/kcov.c:175 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x2e/0x60 kernel/kcov.c:207
Code: 65 48 8b 14 25 40 c2 03 00 65 8b 05 24 b7 7c 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74 35 8b 82 fc 15 00 00 85 c0 74 2b <8b> 82 d8 15 00 00 83 f8 02 75 20 48 8b 8a e0 15 00 00 8b 92 dc 15
RSP: 0018:ffffc9000383f490 EFLAGS: 00000246
RAX: 0000000080000001 RBX: ffffffff8f53618c RCX: ffffffff813a3ac4
RDX: ffff8880290ac800 RSI: ffffffff813a3ad7 RDI: 0000000000000006
RBP: ffffffff8f53618c R08: 0000000000000006 R09: ffffffff81f30847
R10: ffffffff81f30849 R11: 0000000000000001 R12: ffffffff81f30847
R13: ffffffff81f30849 R14: dffffc0000000000 R15: ffffffff8f536190
 __orc_find+0xd7/0x130 arch/x86/kernel/unwind_orc.c:99
 orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
 unwind_next_frame+0x329/0x2390 arch/x86/kernel/unwind_orc.c:494
 arch_stack_walk+0xfa/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:129
 __reset_page_owner+0x51/0x2e0 mm/page_owner.c:150
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x51f/0xb10 mm/page_alloc.c:2346
 free_unref_page_list+0xe6/0xb40 mm/page_alloc.c:2532
 release_pages+0x32a/0x14f0 mm/swap.c:1042
 __folio_batch_release+0x77/0xe0 mm/swap.c:1062
 folio_batch_release include/linux/pagevec.h:83 [inline]
 truncate_inode_pages_range+0x33e/0xf00 mm/truncate.c:362
 ext4_evict_inode+0x2c7/0x1a40 fs/ext4/inode.c:193
 evict+0x2ed/0x6b0 fs/inode.c:665
 iput_final fs/inode.c:1739 [inline]
 iput.part.0+0x560/0x7b0 fs/inode.c:1765
 iput+0x5c/0x80 fs/inode.c:1755
 do_unlinkat+0x60f/0x740 fs/namei.c:4405
 __do_sys_unlink fs/namei.c:4446 [inline]
 __se_sys_unlink fs/namei.c:4444 [inline]
 __x64_sys_unlink+0xc8/0x110 fs/namei.c:4444
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f69ca47c557
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe1573fa18 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f69ca47c557
RDX: 00007ffe1573fa40 RSI: 00007ffe1573fad0 RDI: 00007ffe1573fad0
RBP: 00007ffe1573fad0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe15740b90
R13: 00007f69ca4c83b9 R14: 000000000001b61f R15: 0000000000000007
 </TASK>

Allocated by task 5715:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:314 [inline]
 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 slab_alloc_node mm/slub.c:3860 [inline]
 kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879
 alloc_inode_sb include/linux/fs.h:3019 [inline]
 sock_alloc_inode+0x25/0x1c0 net/socket.c:308
 alloc_inode+0x5d/0x220 fs/inode.c:260
 new_inode_pseudo+0x16/0x80 fs/inode.c:1005
 sock_alloc+0x40/0x270 net/socket.c:634
 __sock_create+0xbc/0x800 net/socket.c:1535
 sock_create net/socket.c:1622 [inline]
 __sys_socket_create net/socket.c:1659 [inline]
 __sys_socket+0x14c/0x260 net/socket.c:1706
 __do_sys_socket net/socket.c:1720 [inline]
 __se_sys_socket net/socket.c:1718 [inline]
 __x64_sys_socket+0x72/0xb0 net/socket.c:1718
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Freed by task 5187:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
 poison_slab_object mm/kasan/common.c:241 [inline]
 __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kmem_cache_free+0x129/0x350 mm/slub.c:4363
 i_callback+0x43/0x70 fs/inode.c:249
 rcu_do_batch kernel/rcu/tree.c:2158 [inline]
 rcu_core+0x819/0x1680 kernel/rcu/tree.c:2433
 __do_softirq+0x21a/0x8de kernel/softirq.c:553

Last potentially related work creation:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:586
 __call_rcu_common.constprop.0+0x9a/0x7b0 kernel/rcu/tree.c:2683
 destroy_inode+0x129/0x1b0 fs/inode.c:315
 iput_final fs/inode.c:1739 [inline]
 iput.part.0+0x560/0x7b0 fs/inode.c:1765
 iput+0x5c/0x80 fs/inode.c:1755
 dentry_unlink_inode+0x292/0x430 fs/dcache.c:400
 __dentry_kill+0x1ca/0x5f0 fs/dcache.c:603
 dput.part.0+0x4ac/0x9a0 fs/dcache.c:845
 dput+0x1f/0x30 fs/dcache.c:835
 __fput+0x3b9/0xb70 fs/file_table.c:384
 task_work_run+0x14d/0x240 kernel/task_work.c:180
 get_signal+0x106f/0x2790 kernel/signal.c:2669
 arch_do_signal_or_restart+0x90/0x7f0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:105 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
 syscall_exit_to_user_mode+0x156/0x2b0 kernel/entry/common.c:212
 do_syscall_64+0xe0/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The buggy address belongs to the object at ffff888031b9b600
 which belongs to the cache sock_inode_cache of size 1408
The buggy address is located 128 bytes inside of
 freed 1408-byte region [ffff888031b9b600, ffff888031b9bb80)

The buggy address belongs to the physical page:
page:ffffea0000c6e600 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888031b9a400 pfn:0x31b98
head:ffffea0000c6e600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88801bd31cb1
ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888013b06b40 ffffea0000bddc00 0000000000000003
raw: ffff888031b9a400 000000008015000e 00000001ffffffff ffff88801bd31cb1
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5184, tgid 5184 (syz-executor.3), ts 67981292738, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 kmem_cache_alloc_lru+0x379/0x6f0 mm/slub.c:3879
 alloc_inode_sb include/linux/fs.h:3019 [inline]
 sock_alloc_inode+0x25/0x1c0 net/socket.c:308
 alloc_inode+0x5d/0x220 fs/inode.c:260
 new_inode_pseudo+0x16/0x80 fs/inode.c:1005
 sock_alloc+0x40/0x270 net/socket.c:634
 __sock_create+0xbc/0x800 net/socket.c:1535
 sock_create net/socket.c:1622 [inline]
 __sys_socket_create net/socket.c:1659 [inline]
 __sys_socket+0x14c/0x260 net/socket.c:1706
 __do_sys_socket net/socket.c:1720 [inline]
 __se_sys_socket net/socket.c:1718 [inline]
 __x64_sys_socket+0x72/0xb0 net/socket.c:1718
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888031b9b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888031b9b600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888031b9b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888031b9b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888031b9b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	65 48 8b 14 25 40 c2 	mov    %gs:0x3c240,%rdx
   7:	03 00
   9:	65 8b 05 24 b7 7c 7e 	mov    %gs:0x7e7cb724(%rip),%eax        # 0x7e7cb734
  10:	a9 00 01 ff 00       	test   $0xff0100,%eax
  15:	48 8b 34 24          	mov    (%rsp),%rsi
  19:	74 0f                	je     0x2a
  1b:	f6 c4 01             	test   $0x1,%ah
  1e:	74 35                	je     0x55
  20:	8b 82 fc 15 00 00    	mov    0x15fc(%rdx),%eax
  26:	85 c0                	test   %eax,%eax
  28:	74 2b                	je     0x55
* 2a:	8b 82 d8 15 00 00    	mov    0x15d8(%rdx),%eax <-- trapping instruction
  30:	83 f8 02             	cmp    $0x2,%eax
  33:	75 20                	jne    0x55
  35:	48 8b 8a e0 15 00 00 	mov    0x15e0(%rdx),%rcx
  3c:	8b                   	.byte 0x8b
  3d:	92                   	xchg   %eax,%edx
  3e:	dc                   	.byte 0xdc
  3f:	15                   	.byte 0x15