==================================================================
BUG: KASAN: use-after-free in tick_sched_handle+0x16c/0x180 kernel/time/tick-sched.c:164
Read of size 8 at addr ffff8881979665b0 by task syz-executor4/11503

CPU: 1 PID: 11503 Comm: syz-executor4 Not tainted 4.20.0-rc6+ #347
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
BUG: unable to handle kernel paging request at 000000aa00400072
Call Trace:
PGD 0 P4D 0 
 <IRQ>
Oops: 0000 [#1] PREEMPT SMP KASAN
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
CPU: 0 PID: 11491 Comm: syz-executor5 Not tainted 4.20.0-rc6+ #347
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:find_stack lib/stackdepot.c:189 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 60 3a 2e 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff 49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08 75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff88819ada6d28 EFLAGS: 00010006
 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256
RAX: 00000000762df7b1 RBX: 000000001143666c RCX: ffff88819ada6d88
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412
RDX: 00000000a86ef6ba RSI: 0000000000400000 RDI: 0000000000000011
RBP: ffff88819ada6d60 R08: 0000000000000080 R09: 00000000deb8d963
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
R10: 000000002b2f17b8 R11: ffff8881dae2dafb R12: 000000aa0040006a
 tick_sched_handle+0x16c/0x180 kernel/time/tick-sched.c:164
R13: ffff88819ada6d70 R14: 000000000003666c R15: 0000000000000000
 tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
FS:  00007f7824de5700(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x41c/0x10d0 kernel/time/hrtimer.c:1460
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000aa00400072 CR3: 00000001cc9f2000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 save_stack+0xa9/0xd0 mm/kasan/kasan.c:454
 hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1034 [inline]
 smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1059
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>

The buggy address belongs to the page:
page:ffffea00065e5980 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528

 __cache_free mm/slab.c:3498 [inline]
 kmem_cache_free+0x83/0x290 mm/slab.c:3760
Memory state around the buggy address:
 ptlock_free+0x38/0x42 mm/memory.c:4564
 ffff888197966480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 pte_lock_deinit include/linux/mm.h:1907 [inline]
 pgtable_page_dtor include/linux/mm.h:1940 [inline]
 ___pte_free_tlb+0x45/0x190 arch/x86/mm/pgtable.c:64
 ffff888197966500: 00 00 00 00 00 00 ff ff ff ff ff ff ff 00 00 00
 __pte_free_tlb arch/x86/include/asm/pgalloc.h:73 [inline]
 free_pte_range mm/memory.c:198 [inline]
 free_pmd_range mm/memory.c:216 [inline]
 free_pud_range mm/memory.c:250 [inline]
 free_p4d_range mm/memory.c:284 [inline]
 free_pgd_range+0xd3c/0x10a0 mm/memory.c:364
>ffff888197966580: 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff
 free_pgtables+0x2c3/0x380 mm/memory.c:396
                                     ^
 exit_mmap+0x2cd/0x590 mm/mmap.c:3146
 ffff888197966600: ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00
 ffff888197966680: 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 f8
==================================================================