==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: use-after-free in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: use-after-free in expire_timers kernel/time/timer.c:1482 [inline]
BUG: KASAN: use-after-free in __run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
Write of size 8 at addr ffff8881e18631c8 by task syz-executor.0/2317

CPU: 0 PID: 2317 Comm: syz-executor.0 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 __hlist_del include/linux/list.h:791 [inline]
 detach_timer kernel/time/timer.c:824 [inline]
 expire_timers kernel/time/timer.c:1482 [inline]
 __run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:csd_lock_wait kernel/smp.c:109 [inline]
RIP: 0010:smp_call_function_single+0x235/0x4a0 kernel/smp.c:311
Code: 0f 85 df 01 00 00 44 8b 74 24 58 44 89 f6 83 e6 01 31 ff e8 3d b0 0a 00 41 83 e6 01 75 0a e8 42 ad 0a 00 e9 f4 00 00 00 f3 90 <42> 0f b6 04 2b 84 c0 75 15 f7 44 24 58 01 00 00 00 0f 84 d6 00 00
RSP: 0018:ffff8881e94feee0 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff13
RAX: ffffffff81598f01 RBX: 1ffff1103d29fde7 RCX: 0000000000040000
RDX: ffffc90001347000 RSI: 0000000000013c9a RDI: 0000000000013c9b
RBP: ffff8881e94fefd0 R08: ffffffff81598ed3 R09: ffffed103edeb189
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103d29fde0
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
 smp_call_function_many+0x6fe/0x9b0 kernel/smp.c:451
 smp_call_function kernel/smp.c:509 [inline]
 on_each_cpu+0xa5/0x1a0 kernel/smp.c:616
 flush_tlb_kernel_range+0x14b/0x1b0 arch/x86/mm/tlb.c:845
 __purge_vmap_area_lazy+0xea/0x1610 mm/vmalloc.c:1278
 _vm_unmap_aliases+0x2dd/0x370 mm/vmalloc.c:1707
 change_page_attr_set_clr+0x304/0x1090 arch/x86/mm/pageattr.c:1713
 change_page_attr_clear arch/x86/mm/pageattr.c:1770 [inline]
 set_memory_ro+0xa1/0xe0 arch/x86/mm/pageattr.c:1903
 bpf_jit_binary_lock_ro include/linux/filter.h:863 [inline]
 bpf_int_jit_compile+0x877b/0x8c40 arch/x86/net/bpf_jit_comp.c:1195
 bpf_prog_select_runtime+0x654/0x900 kernel/bpf/core.c:1782
 bpf_prog_load kernel/bpf/syscall.c:1728 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8193/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f3ef5866ea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3ef4be10c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3ef599df80 RCX: 00007f3ef5866ea9
RDX: 0000000000000090 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f3ef58d5ff4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f3ef599df80 R15: 00007ffff6829e28

Allocated by task 2254:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x100/0x2b0 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1080 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 netlink_ack+0x2cc/0xa70 net/netlink/af_netlink.c:2415
 netlink_rcv_skb+0x252/0x420 net/netlink/af_netlink.c:2487
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x936/0xb20 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0xa18/0xcf0 net/netlink/af_netlink.c:1915
 sock_sendmsg_nosec net/socket.c:638 [inline]
 __sock_sendmsg net/socket.c:650 [inline]
 __sys_sendto+0x4f3/0x6c0 net/socket.c:1961
 __do_sys_sendto net/socket.c:1973 [inline]
 __se_sys_sendto net/socket.c:1969 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:1969
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Freed by task 2254:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0x123/0x370 mm/slub.c:4071
 skb_release_all net/core/skbuff.c:675 [inline]
 __kfree_skb net/core/skbuff.c:689 [inline]
 consume_skb+0xa5/0x2a0 net/core/skbuff.c:849
 skb_free_datagram+0x24/0xe0 net/core/datagram.c:329
 netlink_recvmsg+0x5ef/0x11a0 net/netlink/af_netlink.c:1993
 sock_recvmsg_nosec net/socket.c:891 [inline]
 sock_recvmsg net/socket.c:909 [inline]
 __sys_recvfrom+0x3d7/0x590 net/socket.c:2018
 __do_sys_recvfrom net/socket.c:2036 [inline]
 __se_sys_recvfrom net/socket.c:2032 [inline]
 __x64_sys_recvfrom+0xda/0xf0 net/socket.c:2032
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

The buggy address belongs to the object at ffff8881e1863000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 456 bytes inside of
 512-byte region [ffff8881e1863000, ffff8881e1863200)
The buggy address belongs to the page:
page:ffffea0007861800 refcount:1 mapcount:0 mapping:ffff8881f5c02500 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x16d/0x2b0 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1080 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 rtmsg_ifa+0x1e7/0x3a0 net/ipv4/devinet.c:1914
 __inet_insert_ifa+0x8f3/0xb50 net/ipv4/devinet.c:552
 inet_rtm_newaddr+0x8f1/0x16a0 net/ipv4/devinet.c:957
 rtnetlink_rcv_msg+0x983/0xc70 net/core/rtnetlink.c:5290
 netlink_rcv_skb+0x1d5/0x420 net/netlink/af_netlink.c:2481
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x936/0xb20 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0xa18/0xcf0 net/netlink/af_netlink.c:1915
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare mm/page_alloc.c:1233 [inline]
 free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
 free_unref_page mm/page_alloc.c:3134 [inline]
 free_the_page mm/page_alloc.c:4953 [inline]
 __free_pages+0xaf/0x140 mm/page_alloc.c:4961
 __vunmap+0x75b/0x890 mm/vmalloc.c:2260
 kcov_put kernel/kcov.c:396 [inline]
 kcov_close+0x27/0x50 kernel/kcov.c:495
 __fput+0x262/0x680 fs/file_table.c:281
 task_work_run+0x140/0x170 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xcaf/0x2bc0 kernel/exit.c:859
 do_group_exit+0x138/0x300 kernel/exit.c:982
 __do_sys_exit_group kernel/exit.c:993 [inline]
 __se_sys_exit_group kernel/exit.c:991 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:991
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881e1863080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e1863100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881e1863180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff8881e1863200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881e1863280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1e6209067 P4D 1e6209067 PUD 1d1c30067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2317 Comm: syz-executor.0 Tainted: G    B             5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154d7aa RBX: 0000000000000104 RCX: ffff8881e9080000
RDX: 0000000000000104 RSI: 0000000000000000 RDI: ffff8881e18631c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa3d8
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e18631c0
FS:  00007f3ef4be16c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001e9705000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:csd_lock_wait kernel/smp.c:109 [inline]
RIP: 0010:smp_call_function_single+0x235/0x4a0 kernel/smp.c:311
Code: 0f 85 df 01 00 00 44 8b 74 24 58 44 89 f6 83 e6 01 31 ff e8 3d b0 0a 00 41 83 e6 01 75 0a e8 42 ad 0a 00 e9 f4 00 00 00 f3 90 <42> 0f b6 04 2b 84 c0 75 15 f7 44 24 58 01 00 00 00 0f 84 d6 00 00
RSP: 0018:ffff8881e94feee0 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff13
RAX: ffffffff81598f01 RBX: 1ffff1103d29fde7 RCX: 0000000000040000
RDX: ffffc90001347000 RSI: 0000000000013c9a RDI: 0000000000013c9b
RBP: ffff8881e94fefd0 R08: ffffffff81598ed3 R09: ffffed103edeb189
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103d29fde0
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
 smp_call_function_many+0x6fe/0x9b0 kernel/smp.c:451
 smp_call_function kernel/smp.c:509 [inline]
 on_each_cpu+0xa5/0x1a0 kernel/smp.c:616
 flush_tlb_kernel_range+0x14b/0x1b0 arch/x86/mm/tlb.c:845
 __purge_vmap_area_lazy+0xea/0x1610 mm/vmalloc.c:1278
 _vm_unmap_aliases+0x2dd/0x370 mm/vmalloc.c:1707
 change_page_attr_set_clr+0x304/0x1090 arch/x86/mm/pageattr.c:1713
 change_page_attr_clear arch/x86/mm/pageattr.c:1770 [inline]
 set_memory_ro+0xa1/0xe0 arch/x86/mm/pageattr.c:1903
 bpf_jit_binary_lock_ro include/linux/filter.h:863 [inline]
 bpf_int_jit_compile+0x877b/0x8c40 arch/x86/net/bpf_jit_comp.c:1195
 bpf_prog_select_runtime+0x654/0x900 kernel/bpf/core.c:1782
 bpf_prog_load kernel/bpf/syscall.c:1728 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8193/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f3ef5866ea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3ef4be10c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3ef599df80 RCX: 00007f3ef5866ea9
RDX: 0000000000000090 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f3ef58d5ff4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f3ef599df80 R15: 00007ffff6829e28
Modules linked in:
CR2: 0000000000000000
---[ end trace fbca83bff0b90b4c ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154d7aa RBX: 0000000000000104 RCX: ffff8881e9080000
RDX: 0000000000000104 RSI: 0000000000000000 RDI: ffff8881e18631c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa3d8
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e18631c0
FS:  00007f3ef4be16c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001e9705000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	0f 85 df 01 00 00    	jne    0x1e5
   6:	44 8b 74 24 58       	mov    0x58(%rsp),%r14d
   b:	44 89 f6             	mov    %r14d,%esi
   e:	83 e6 01             	and    $0x1,%esi
  11:	31 ff                	xor    %edi,%edi
  13:	e8 3d b0 0a 00       	call   0xab055
  18:	41 83 e6 01          	and    $0x1,%r14d
  1c:	75 0a                	jne    0x28
  1e:	e8 42 ad 0a 00       	call   0xaad65
  23:	e9 f4 00 00 00       	jmp    0x11c
  28:	f3 90                	pause
* 2a:	42 0f b6 04 2b       	movzbl (%rbx,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	75 15                	jne    0x48
  33:	f7 44 24 58 01 00 00 	testl  $0x1,0x58(%rsp)
  3a:	00
  3b:	0f                   	.byte 0xf
  3c:	84 d6                	test   %dl,%dh