=====================================================
BUG: KMSAN: use-after-free in __list_add_valid+0x280/0x420 lib/list_debug.c:26
CPU: 0 PID: 22434 Comm: syz-executor.2 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 __list_add_valid+0x280/0x420 lib/list_debug.c:26
 __list_add include/linux/list.h:67 [inline]
 list_add_tail include/linux/list.h:100 [inline]
 cma_listen_on_all drivers/infiniband/core/cma.c:2512 [inline]
 rdma_listen+0x623/0x10b0 drivers/infiniband/core/cma.c:3622
 ucma_listen+0x36c/0x5e0 drivers/infiniband/core/ucma.c:1092
 ucma_write+0x5c5/0x630 drivers/infiniband/core/ucma.c:1684
 __vfs_write+0x1a9/0xca0 fs/read_write.c:494
 vfs_write+0x44a/0x8f0 fs/read_write.c:558
 ksys_write+0x267/0x450 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c479
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f5571d84c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5571d856d4 RCX: 000000000045c479
RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000cbe R14: 00000000004cea34 R15: 000000000076bf2c

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_free+0x6e/0xb0 mm/kmsan/kmsan_hooks.c:107
 slab_free_freelist_hook mm/slub.c:1477 [inline]
 slab_free mm/slub.c:3040 [inline]
 kfree+0x565/0x30a0 mm/slub.c:3993
 free_pipe_info+0x40f/0x440 fs/pipe.c:841
 put_pipe_info fs/pipe.c:711 [inline]
 pipe_release+0x46c/0x590 fs/pipe.c:733
 __fput+0x4c7/0xb90 fs/file_table.c:280
 ____fput+0x37/0x40 fs/file_table.c:313
 task_work_run+0x214/0x2b0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:164 [inline]
 prepare_exit_to_usermode+0x3c8/0x520 arch/x86/entry/common.c:195
 syscall_return_slowpath+0x95/0x5f0 arch/x86/entry/common.c:278
 do_syscall_64+0xde/0x160 arch/x86/entry/common.c:306
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================