=====================================================
BUG: KMSAN: use-after-free in __list_add_valid+0x292/0x430 lib/list_debug.c:26
CPU: 0 PID: 1653 Comm: syz-executor.0 Not tainted 5.4.0-rc5+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:245
 __list_add_valid+0x292/0x430 lib/list_debug.c:26
 __list_add include/linux/list.h:60 [inline]
 list_add_tail include/linux/list.h:93 [inline]
 cma_listen_on_all drivers/infiniband/core/cma.c:2509 [inline]
 rdma_listen+0x623/0x10b0 drivers/infiniband/core/cma.c:3563
 ucma_listen+0x36e/0x5e0 drivers/infiniband/core/ucma.c:1092
 ucma_write+0x5c5/0x640 drivers/infiniband/core/ucma.c:1684
 __vfs_write+0x1a9/0xcb0 fs/read_write.c:494
 vfs_write+0x481/0x920 fs/read_write.c:558
 ksys_write+0x265/0x430 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x45a219
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff23ce86c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff23ce876d4
R13: 00000000004ca93f R14: 00000000004e2ce8 R15: 00000000ffffffff

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline]
 kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:134
 kmsan_slab_free+0x8d/0xf0 mm/kmsan/kmsan_hooks.c:108
 slab_free_freelist_hook mm/slub.c:1473 [inline]
 slab_free mm/slub.c:3046 [inline]
 kfree+0x4c1/0x2e70 mm/slub.c:3999
 skb_free_head net/core/skbuff.c:591 [inline]
 skb_release_data+0x7de/0x9d0 net/core/skbuff.c:611
 skb_release_all net/core/skbuff.c:665 [inline]
 __kfree_skb+0x8a/0x210 net/core/skbuff.c:679
 sk_wmem_free_skb include/net/sock.h:1483 [inline]
 tcp_rtx_queue_unlink_and_free+0x3b9/0x9f0 include/net/tcp.h:1802
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3163 [inline]
 tcp_ack+0x38d8/0x97b0 net/ipv4/tcp_input.c:3690
 tcp_rcv_established+0x10a0/0x31f0 net/ipv4/tcp_input.c:5698
 tcp_v4_do_rcv+0x684/0xd70 net/ipv4/tcp_ipv4.c:1564
 tcp_v4_rcv+0x647b/0x6a70 net/ipv4/tcp_ipv4.c:1945
 ip_protocol_deliver_rcu+0x4c7/0xbd0 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ip_local_deliver+0x62a/0x7c0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:442 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:413 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ip_rcv+0x6c5/0x740 net/ipv4/ip_input.c:523
 __netif_receive_skb_one_core net/core/dev.c:5010 [inline]
 __netif_receive_skb net/core/dev.c:5124 [inline]
 netif_receive_skb_internal+0x8f4/0xc20 net/core/dev.c:5214
 napi_skb_finish net/core/dev.c:5677 [inline]
 napi_gro_receive+0x67f/0xbb0 net/core/dev.c:5710
 receive_buf+0x653b/0x8810 drivers/net/virtio_net.c:1061
 virtnet_receive drivers/net/virtio_net.c:1323 [inline]
 virtnet_poll+0x666/0x1a10 drivers/net/virtio_net.c:1428
 napi_poll net/core/dev.c:6392 [inline]
 net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6460
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 do_IRQ+0x123/0x360 arch/x86/kernel/irq.c:263
 ret_from_intr+0x0/0x33
 native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline]
 arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline]
 kmsan_alloc_page+0x30e/0x360 mm/kmsan/kmsan_shadow.c:392
 __alloc_pages_nodemask+0x149d/0x60c0 mm/page_alloc.c:4796
 alloc_pages_current+0x68d/0x9a0 mm/mempolicy.c:2188
 alloc_pages include/linux/gfp.h:511 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x59/0x1a0 arch/x86/mm/pgtable.c:26
 __pte_alloc+0x6d/0x460 mm/memory.c:409
 copy_pte_range mm/memory.c:799 [inline]
 copy_pmd_range mm/memory.c:875 [inline]
 copy_pud_range mm/memory.c:909 [inline]
 copy_p4d_range mm/memory.c:931 [inline]
 copy_page_range+0x3296/0x43a0 mm/memory.c:993
 dup_mmap+0x1510/0x1d60 kernel/fork.c:602
 dup_mm+0x1f2/0x710 kernel/fork.c:1363
 copy_mm kernel/fork.c:1419 [inline]
 copy_process+0x390c/0x89f0 kernel/fork.c:2014
 _do_fork+0x25c/0xeb0 kernel/fork.c:2368
 __do_sys_clone kernel/fork.c:2523 [inline]
 __se_sys_clone+0x32a/0x370 kernel/fork.c:2504
 __x64_sys_clone+0x62/0x80 kernel/fork.c:2504
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
=====================================================