device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
==================================================================
BUG: KASAN: use-after-free in __write_once_size include/linux/compiler.h:295 [inline]
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:789 [inline]
BUG: KASAN: use-after-free in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: use-after-free in detach_if_pending+0x160/0x360 kernel/time/timer.c:841
Write of size 8 at addr ffff8881e4c471c0 by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Tainted: G        W         5.4.274-syzkaller-00016-gdd432c37afcd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: netns cleanup_net
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 __write_once_size include/linux/compiler.h:295 [inline]
 __hlist_del include/linux/list.h:789 [inline]
 detach_timer kernel/time/timer.c:824 [inline]
 detach_if_pending+0x160/0x360 kernel/time/timer.c:841
 del_timer+0xcf/0x140 kernel/time/timer.c:1232
 addrconf_del_rs_timer net/ipv6/addrconf.c:305 [inline]
 addrconf_ifdown+0x640/0x1a90 net/ipv6/addrconf.c:3832
 addrconf_notify+0x375/0xe50 net/ipv6/addrconf.c:3696
 notifier_call_chain kernel/notifier.c:98 [inline]
 __raw_notifier_call_chain kernel/notifier.c:399 [inline]
 raw_notifier_call_chain+0x95/0x110 kernel/notifier.c:406
 call_netdevice_notifiers_info net/core/dev.c:1670 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:1682 [inline]
 call_netdevice_notifiers net/core/dev.c:1696 [inline]
 dev_close_many+0x354/0x4f0 net/core/dev.c:1439
 rollback_registered_many+0x493/0x1330 net/core/dev.c:8608
 unregister_netdevice_many net/core/dev.c:9786 [inline]
 default_device_exit_batch+0x3e0/0x680 net/core/dev.c:10257
 ops_exit_list net/core/net_namespace.c:184 [inline]
 cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
 process_one_work+0x765/0xd20 kernel/workqueue.c:2290
 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8881e4c46d00
 which belongs to the cache UNIX of size 1152
The buggy address is located 64 bytes to the right of
 1152-byte region [ffff8881e4c46d00, ffff8881e4c47180)
The buggy address belongs to the page:
page:ffffea0007931100 refcount:1 mapcount:0 mapping:ffff8881f57e0c80 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f57e0c80
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0x109/0x250 mm/slub.c:2842
 sk_prot_alloc+0x63/0x3e0 net/core/sock.c:1616
 sk_alloc+0x35/0x2f0 net/core/sock.c:1680
 unix_create1+0x8e/0x5a0 net/unix/af_unix.c:802
 unix_create+0x12c/0x1b0 net/unix/af_unix.c:863
 __sock_create+0x3cb/0x7a0 net/socket.c:1427
 sock_create net/socket.c:1478 [inline]
 __sys_socketpair+0x308/0x6e0 net/socket.c:1582
 __do_sys_socketpair net/socket.c:1631 [inline]
 __se_sys_socketpair net/socket.c:1628 [inline]
 __x64_sys_socketpair+0x97/0xb0 net/socket.c:1628
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4955 [inline]
 __free_pages+0x91/0x140 mm/page_alloc.c:4961
 device_release+0x6b/0x190 drivers/base/core.c:1776
 kobject_cleanup lib/kobject.c:716 [inline]
 kobject_release lib/kobject.c:747 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e6/0x2f0 lib/kobject.c:764
 tun_set_iff+0x870/0xdc0 drivers/net/tun.c:2919
 __tun_chr_ioctl+0x8a9/0x1d00 drivers/net/tun.c:3182
 do_vfs_ioctl+0x742/0x1720 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881e4c47080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881e4c47100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881e4c47180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff8881e4c47200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881e4c47280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================