==================================================================
BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
Read of size 4 at addr ffff888061810008 by task kworker/u8:2/34

CPU: 0 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc5-syzkaller-01452-ga9e7715ce8b3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 rht_key_hashfn include/linux/rhashtable.h:159 [inline]
 __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
 rhashtable_lookup include/linux/rhashtable.h:646 [inline]
 rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
 ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]
 ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312
 __netif_receive_skb_one_core net/core/dev.c:5611 [inline]
 __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5725
 process_backlog+0x391/0x7d0 net/core/dev.c:6054
 __napi_poll+0xcb/0x490 net/core/dev.c:6708
 napi_poll net/core/dev.c:6777 [inline]
 net_rx_action+0x7bb/0x10a0 net/core/dev.c:6893
 __do_softirq+0x2c6/0x980 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__mutex_lock+0x74/0xd70 kernel/locking/mutex.c:751
Code: bc 24 a0 00 00 00 48 c7 84 24 80 00 00 00 b3 8a b5 41 48 c7 84 24 88 00 00 00 00 c0 b0 8d 48 c7 84 24 90 00 00 00 80 3e 8b 8b <48> 8d 84 24 80 00 00 00 48 c1 e8 03 42 c7 04 20 f1 f1 f1 f1 42 c7
RSP: 0018:ffffc90000aa78c0 EFLAGS: 00000286
RAX: fbdd033d92279d00 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffffc90000aa7960
RBP: ffffc90000aa7a08 R08: ffffffff8998fa61 R09: ffffffff89992ab3
R10: 0000000000000006 R11: ffff888017ae5a00 R12: dffffc0000000000
R13: ffffffff8f615240 R14: 0000000000000000 R15: ffffffff8ccf9640
 __nf_unregister_net_hook+0x91/0x800 net/netfilter/core.c:498
 nf_unregister_net_hooks+0xd0/0x140 net/netfilter/core.c:613
 ops_exit_list net/core/net_namespace.c:170 [inline]
 cleanup_net+0x802/0xcc0 net/core/net_namespace.c:637
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61810
flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000000 ffffea0001814608 ffff8880b9444670 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5102, tgid -962725721 (syz-executor.3), ts 5102, free_ts 79991268406
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
 __alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 __kmalloc_large_node+0x91/0x1f0 mm/slub.c:3911
 __do_kmalloc_node mm/slub.c:3954 [inline]
 __kmalloc_node+0x33e/0x4e0 mm/slub.c:3973
 kmalloc_node include/linux/slab.h:648 [inline]
 kvmalloc_node+0x72/0x190 mm/util.c:634
 kvmalloc include/linux/slab.h:766 [inline]
 kvzalloc include/linux/slab.h:774 [inline]
 bucket_table_alloc lib/rhashtable.c:184 [inline]
 rhashtable_init+0x558/0xa90 lib/rhashtable.c:1065
 ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613
 ops_init+0x352/0x610 net/core/net_namespace.c:136
 setup_net+0x515/0xca0 net/core/net_namespace.c:340
 copy_net_ns+0x4e4/0x7b0 net/core/net_namespace.c:505
 create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228
 ksys_unshare+0x619/0xc10 kernel/fork.c:3323
 __do_sys_unshare kernel/fork.c:3394 [inline]
 __se_sys_unshare kernel/fork.c:3392 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3392
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
page last free pid 34 tgid 34 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
 __folio_put_large+0x13f/0x190 mm/swap.c:132
 __folio_put+0x299/0x390 mm/swap.c:140
 folio_put include/linux/mm.h:1506 [inline]
 free_large_kmalloc+0x105/0x1c0 mm/slub.c:4361
 kfree+0x1ca/0x3a0 mm/slub.c:4384
 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1163
 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
 ops_exit_list net/core/net_namespace.c:170 [inline]
 cleanup_net+0x802/0xcc0 net/core/net_namespace.c:637
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffff88806180ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88806180ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888061810000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff888061810080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888061810100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
----------------
Code disassembly (best guess):
   0:	bc 24 a0 00 00       	mov    $0xa024,%esp
   5:	00 48 c7             	add    %cl,-0x39(%rax)
   8:	84 24 80             	test   %ah,(%rax,%rax,4)
   b:	00 00                	add    %al,(%rax)
   d:	00 b3 8a b5 41 48    	add    %dh,0x4841b58a(%rbx)
  13:	c7 84 24 88 00 00 00 	movl   $0x8db0c000,0x88(%rsp)
  1a:	00 c0 b0 8d
  1e:	48 c7 84 24 90 00 00 	movq   $0xffffffff8b8b3e80,0x90(%rsp)
  25:	00 80 3e 8b 8b
* 2a:	48 8d 84 24 80 00 00 	lea    0x80(%rsp),%rax <-- trapping instruction
  31:	00
  32:	48 c1 e8 03          	shr    $0x3,%rax
  36:	42 c7 04 20 f1 f1 f1 	movl   $0xf1f1f1f1,(%rax,%r12,1)
  3d:	f1
  3e:	42                   	rex.X
  3f:	c7                   	.byte 0xc7