================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:787 [inline] BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:541 [inline] BUG: KASAN: use-after-free in __internal_add_timer+0x291/0x490 kernel/time/timer.c:554 Write of size 8 at addr ffff8881989ab1c8 by task kworker/1:1/67 CPU: 1 PID: 67 Comm: kworker/1:1 Not tainted 5.4.86-syzkaller-00678-ge627b02af655 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: wg-crypt-wg0 wg_packet_tx_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1dd/0x24e lib/dump_stack.c:118 print_address_description+0x96/0x640 mm/kasan/report.c:374 __kasan_report+0x177/0x1f0 mm/kasan/report.c:506 kasan_report+0x30/0x60 mm/kasan/common.c:634 hlist_add_head include/linux/list.h:787 [inline] enqueue_timer kernel/time/timer.c:541 [inline] __internal_add_timer+0x291/0x490 kernel/time/timer.c:554 internal_add_timer kernel/time/timer.c:604 [inline] __mod_timer+0xcb7/0x1ce0 kernel/time/timer.c:1065 mod_peer_timer drivers/net/wireguard/timers.c:37 [inline] wg_timers_any_authenticated_packet_traversal+0x129/0x190 drivers/net/wireguard/timers.c:215 wg_packet_create_data_done drivers/net/wireguard/send.c:248 [inline] wg_packet_tx_worker+0x283/0x8f0 drivers/net/wireguard/send.c:280 process_one_work+0x777/0xf90 kernel/workqueue.c:2280 worker_thread+0xa8f/0x1430 kernel/workqueue.c:2426 kthread+0x31c/0x340 kernel/kthread.c:268 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the page: page:ffffea0006626ac0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x8000000000000000() raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881989ab080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881989ab100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881989ab180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881989ab200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881989ab280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================