==================================================================
BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42
Read of size 8 at addr ffff8881f5dd7b40 by task kworker/u4:1/9

CPU: 1 PID: 9 Comm: kworker/u4:1 Tainted: G        W         5.4.276-syzkaller-00021-g58de09405d1e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42
 profile_tick+0xb9/0x100 kernel/profile.c:416
 tick_sched_handle kernel/time/tick-sched.c:206 [inline]
 tick_sched_timer+0x237/0x3c0 kernel/time/tick-sched.c:1342
 __run_hrtimer kernel/time/hrtimer.c:1581 [inline]
 __hrtimer_run_queues+0x3e9/0xb90 kernel/time/hrtimer.c:1643
 hrtimer_interrupt+0x38a/0x890 kernel/time/hrtimer.c:1705
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1122 [inline]
 smp_apic_timer_interrupt+0x110/0x460 arch/x86/kernel/apic/apic.c:1147
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:76 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:181 [inline]
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
RIP: 0010:_raw_spin_lock+0x6e/0x1b0 kernel/locking/spinlock.c:151
Code: 58 85 48 c7 44 24 10 c0 14 51 84 48 89 e3 48 c1 eb 03 48 b8 f1 f1 f1 f1 04 f3 f3 f3 4a 89 04 23 bf 01 00 00 00 e8 72 c9 f3 fc <4d> 89 fe 49 c1 ee 03 43 0f b6 04 26 84 c0 0f 85 bb 00 00 00 c7 44
RSP: 0018:ffff8881f5dd7b40 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000201 RBX: 1ffff1103ebbaf68 RCX: ffffffff86e99903
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8881f5dd7bd8 R08: ffffffff82316961 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffffff85e0d718 R14: 000000000001b72b R15: ffff8881f5dd7b60
 spin_lock include/linux/spinlock.h:338 [inline]
 nf_conntrack_lock net/netfilter/nf_conntrack_core.c:87 [inline]
 get_next_corpse net/netfilter/nf_conntrack_core.c:2058 [inline]
 nf_ct_iterate_cleanup+0x94/0x310 net/netfilter/nf_conntrack_core.c:2092
 nf_conntrack_cleanup_net_list+0x6c/0x200 net/netfilter/nf_conntrack_core.c:2279
 ops_exit_list net/core/net_namespace.c:187 [inline]
 cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:612
 process_one_work+0x765/0xd20 kernel/workqueue.c:2290
 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354

The buggy address belongs to the page:
page:ffffea0007d775c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 ffffea0007d775c8 ffffea0007d775c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0()
 create_dummy_stack mm/page_owner.c:61 [inline]
 register_early_stack+0x86/0xe0 mm/page_owner.c:77
 init_page_owner+0x2f/0x730 mm/page_owner.c:87
 kernel_init_freeable+0x2b4/0x466 init/main.c:1456
 kernel_init+0xd/0x380 init/main.c:1375
page_owner free stack trace missing

addr ffff8881f5dd7b40 is located in stack of task kworker/u4:1/9 at offset 0 in frame:
 _raw_spin_lock+0x0/0x1b0

this frame has 1 object:
 [32, 36) 'val.i.i.i'

Memory state around the buggy address:
 ffff8881f5dd7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881f5dd7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881f5dd7b00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3
                                           ^
 ffff8881f5dd7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881f5dd7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	58                   	pop    %rax
   1:	85 48 c7             	test   %ecx,-0x39(%rax)
   4:	44 24 10             	rex.R and $0x10,%al
   7:	c0 14 51 84          	rclb   $0x84,(%rcx,%rdx,2)
   b:	48 89 e3             	mov    %rsp,%rbx
   e:	48 c1 eb 03          	shr    $0x3,%rbx
  12:	48 b8 f1 f1 f1 f1 04 	movabs $0xf3f3f304f1f1f1f1,%rax
  19:	f3 f3 f3
  1c:	4a 89 04 23          	mov    %rax,(%rbx,%r12,1)
  20:	bf 01 00 00 00       	mov    $0x1,%edi
  25:	e8 72 c9 f3 fc       	call   0xfcf3c99c
* 2a:	4d 89 fe             	mov    %r15,%r14 <-- trapping instruction
  2d:	49 c1 ee 03          	shr    $0x3,%r14
  31:	43 0f b6 04 26       	movzbl (%r14,%r12,1),%eax
  36:	84 c0                	test   %al,%al
  38:	0f 85 bb 00 00 00    	jne    0xf9
  3e:	c7                   	.byte 0xc7
  3f:	44                   	rex.R