==================================================================
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler net/ipv4/tcp_timer.c:624 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0x99c/0x9f0 net/ipv4/tcp_timer.c:594
Read of size 1 at addr ffff888050bc2385 by task syz-executor.2/3728

CPU: 2 PID: 3728 Comm: syz-executor.2 Not tainted 6.1.0-rc7-syzkaller-00101-g01f856ae6d0c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15e/0x45d mm/kasan/report.c:395
 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
 tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
 tcp_write_timer_handler net/ipv4/tcp_timer.c:624 [inline]
 tcp_write_timer_handler+0x99c/0x9f0 net/ipv4/tcp_timer.c:594
 tcp_write_timer+0xa6/0x2b0 net/ipv4/tcp_timer.c:637
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb7/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:rcu_read_unlock_sched_notrace include/linux/rcupdate.h:860 [inline]
RIP: 0010:trace_lock_release include/trace/events/lock.h:69 [inline]
RIP: 0010:lock_release+0x5da/0x810 kernel/locking/lockdep.c:5679
Code: 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 ed 01 00 00 48 8b 05 e6 b4 d9 0c e8 61 1a 06 00 85 c0 74 17 65 ff 0d d6 73 9f 7e <0f> 85 07 fb ff ff e8 05 77 9d ff e9 fd fa ff ff e8 71 29 8a 08 85
RSP: 0018:ffffc90003a77440 EFLAGS: 00000286

RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffff9200074ee8a R08: 0000000000000000 R09: ffffffff8e51a3d7
R10: fffffbfff1ca347a R11: 0000000000000001 R12: ffffffff8c58fbc0
R13: dffffc0000000000 R14: 0000000000000002 R15: ffffc90003a775c8
 rcu_lock_release include/linux/rcupdate.h:309 [inline]
 rcu_read_unlock include/linux/rcupdate.h:771 [inline]
 get_mem_cgroup_from_objcg+0xb9/0x260 include/linux/memcontrol.h:520
 obj_cgroup_charge_pages mm/memcontrol.c:3093 [inline]
 __memcg_kmem_charge_page+0x15d/0x3b0 mm/memcontrol.c:3121
 __alloc_pages+0x1f3/0x5b0 mm/page_alloc.c:5575
 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1a/0x230 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x6d/0x260 mm/memory.c:468
 copy_pte_range mm/memory.c:1036 [inline]
 copy_pmd_range mm/memory.c:1171 [inline]
 copy_pud_range mm/memory.c:1208 [inline]
 copy_p4d_range mm/memory.c:1232 [inline]
 copy_page_range+0x16e6/0x3900 mm/memory.c:1330
 dup_mmap+0xc10/0x10b0 kernel/fork.c:691
 dup_mm+0x91/0x370 kernel/fork.c:1526
 copy_mm kernel/fork.c:1575 [inline]
 copy_process+0x3bc6/0x7190 kernel/fork.c:2253
 kernel_clone+0xeb/0x980 kernel/fork.c:2671
 __do_compat_sys_ia32_clone+0x9e/0xd0 arch/x86/kernel/sys_ia32.c:254
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f38549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ff8ffa00 EFLAGS: 00000206
 ORIG_RAX: 0000000000000078
RAX: ffffffffffffffda RBX: 0000000001200011 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000056a633e8
RBP: 00000000f734d000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Allocated by task 10462:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x449/0x920 kernel/fork.c:3188
 __do_sys_unshare kernel/fork.c:3259 [inline]
 __se_sys_unshare kernel/fork.c:3257 [inline]
 __ia32_sys_unshare+0x30/0x40 kernel/fork.c:3257
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Last potentially related work creation:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
 insert_work+0x48/0x350 kernel/workqueue.c:1358
 __queue_work+0x693/0x13b0 kernel/workqueue.c:1517
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1514 [inline]
 __run_timers.part.0+0x4a3/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0x156/0x1d0 kernel/time/timer.c:1805
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571

Second to last potentially related work creation:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
 insert_work+0x48/0x350 kernel/workqueue.c:1358
 __queue_work+0x693/0x13b0 kernel/workqueue.c:1517
 queue_work_on+0xf2/0x110 kernel/workqueue.c:1545
 queue_work include/linux/workqueue.h:503 [inline]
 schedule_work include/linux/workqueue.h:564 [inline]
 xfrm_hash_grow_check net/xfrm/xfrm_state.c:1025 [inline]
 xfrm_hash_grow_check net/xfrm/xfrm_state.c:1020 [inline]
 xfrm_state_find+0x4af5/0x4f10 net/xfrm/xfrm_state.c:1185
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2392 [inline]
 xfrm_tmpl_resolve+0x2f3/0xd40 net/xfrm/xfrm_policy.c:2437
 xfrm_resolve_and_create_bundle+0x123/0x2580 net/xfrm/xfrm_policy.c:2730
 xfrm_lookup_with_ifid+0x22d/0x20f0 net/xfrm/xfrm_policy.c:3064
 xfrm_lookup net/xfrm/xfrm_policy.c:3193 [inline]
 xfrm_lookup_route+0x3a/0x1e0 net/xfrm/xfrm_policy.c:3204
 ip_route_output_flow+0x118/0x150 net/ipv4/route.c:2880
 udp_sendmsg+0x1967/0x2750 net/ipv4/udp.c:1224
 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:827
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xd3/0x120 net/socket.c:734
 ____sys_sendmsg+0x334/0x8c0 net/socket.c:2482
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
 __sys_sendmmsg+0x291/0x460 net/socket.c:2615
 __compat_sys_sendmmsg net/compat.c:358 [inline]
 __do_compat_sys_sendmmsg net/compat.c:365 [inline]
 __se_compat_sys_sendmmsg net/compat.c:362 [inline]
 __ia32_compat_sys_sendmmsg+0x9f/0x100 net/compat.c:362
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

The buggy address belongs to the object at ffff888050bc1c40
 which belongs to the cache net_namespace of size 6976
The buggy address is located 1861 bytes inside of
 6976-byte region [ffff888050bc1c40, ffff888050bc3780)

The buggy address belongs to the physical page:
page:ffffea000142f000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50bc0
head:ffffea000142f000 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88806e83bcc1
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 ffffea0001bdb000 dead000000000002 ffff888040081040
raw: 0000000000000000 0000000080040004 00000001ffffffff ffff88806e83bcc1
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3732, tgid 3732 (syz-executor.0), ts 231201226906, free_ts 226567086357
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4291
 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5558
 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
 alloc_slab_page mm/slub.c:1794 [inline]
 allocate_slab+0x213/0x300 mm/slub.c:1939
 new_slab mm/slub.c:1992 [inline]
 ___slab_alloc+0xa91/0x1400 mm/slub.c:3180
 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279
 slab_alloc_node mm/slub.c:3364 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x31a/0x3d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x449/0x920 kernel/fork.c:3188
 __do_sys_unshare kernel/fork.c:3259 [inline]
 __se_sys_unshare kernel/fork.c:3257 [inline]
 __ia32_sys_unshare+0x30/0x40 kernel/fork.c:3257
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1509
 free_unref_page_prepare mm/page_alloc.c:3387 [inline]
 free_unref_page+0x1d/0x4d0 mm/page_alloc.c:3483
 __folio_put_large mm/swap.c:118 [inline]
 __folio_put+0x109/0x140 mm/swap.c:126
 folio_put include/linux/mm.h:1159 [inline]
 put_page include/linux/mm.h:1211 [inline]
 __skb_frag_unref include/linux/skbuff.h:3385 [inline]
 skb_release_data+0x51e/0x870 net/core/skbuff.c:783
 skb_release_all net/core/skbuff.c:854 [inline]
 __kfree_skb net/core/skbuff.c:868 [inline]
 napi_consume_skb net/core/skbuff.c:1107 [inline]
 napi_consume_skb+0x1a5/0x280 net/core/skbuff.c:1089
 skb_defer_free_flush net/core/dev.c:6646 [inline]
 net_rx_action+0x346/0xde0 net/core/dev.c:6667
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571

Memory state around the buggy address:
 ffff888050bc2280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888050bc2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888050bc2380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                   ^
 ffff888050bc2400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888050bc2480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	df 48 c1             	fisttps -0x3f(%rax)
   3:	e8 03 80 3c 10       	callq  0x103c800b
   8:	00 0f                	add    %cl,(%rdi)
   a:	85 ed                	test   %ebp,%ebp
   c:	01 00                	add    %eax,(%rax)
   e:	00 48 8b             	add    %cl,-0x75(%rax)
  11:	05 e6 b4 d9 0c       	add    $0xcd9b4e6,%eax
  16:	e8 61 1a 06 00       	callq  0x61a7c
  1b:	85 c0                	test   %eax,%eax
  1d:	74 17                	je     0x36
  1f:	65 ff 0d d6 73 9f 7e 	decl   %gs:0x7e9f73d6(%rip)        # 0x7e9f73fc
* 26:	0f 85 07 fb ff ff    	jne    0xfffffb33 <-- trapping instruction
  2c:	e8 05 77 9d ff       	callq  0xff9d7736
  31:	e9 fd fa ff ff       	jmpq   0xfffffb33
  36:	e8 71 29 8a 08       	callq  0x88a29ac
  3b:	85                   	.byte 0x85