==================================================================
BUG: KASAN: use-after-free in tcp_retransmit_timer+0x6cc/0x18f0 net/ipv4/tcp_timer.c:481
Read of size 8 at addr ffff88807c2fc640 by task syz-executor.5/8031

CPU: 1 PID: 8031 Comm: syz-executor.5 Not tainted 5.3.0-rc3+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113
 print_address_description+0x75/0x5b0 mm/kasan/report.c:351
 __kasan_report+0x14b/0x1c0 mm/kasan/report.c:482
 kasan_report+0x26/0x50 mm/kasan/common.c:612
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 tcp_retransmit_timer+0x6cc/0x18f0 net/ipv4/tcp_timer.c:481
 tcp_write_timer_handler+0x1e7/0x970 net/ipv4/tcp_timer.c:592
 tcp_write_timer+0x12f/0x1c0 net/ipv4/tcp_timer.c:612
 call_timer_fn+0x95/0x170 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers+0x79e/0x970 kernel/time/timer.c:1685
 run_timer_softirq+0x4a/0x90 kernel/time/timer.c:1698
 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:778
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x227/0x230 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:537 [inline]
 smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1095
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 </IRQ>
RIP: 0033:0x40e7ef
Code: 0f 1f 00 48 83 e8 08 48 8b 10 48 39 ca 77 f4 48 39 e8 76 18 48 89 57 f8 4c 89 00 48 8b 50 f8 49 8b 0c 24 4c 8b 07 48 83 c7 08 <eb> bf 4c 89 ea 48 89 ef e8 34 ff ff ff 48 89 e8 4c 29 e0 48 3d 87
RSP: 002b:00007ffc5400f870 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff13
RAX: 00007fb1273194b8 RBX: 00007fb127319430 RCX: ffffffff835378ec
RDX: ffffffff835378ec RSI: 00007fb1273194d8 RDI: 00007fb127319450
RBP: 00007fb127319440 R08: ffffffff835378ec R09: 0000000050664b29
R10: 00007ffc5400fb90 R11: 0000000000000246 R12: 00007fb127319420
R13: 0000000000000013 R14: 00007fb127319440 R15: 0000000000019c66

Allocated by task 31682:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc+0x11c/0x1b0 mm/kasan/common.c:487
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:495
 slab_post_alloc_hook mm/slab.h:520 [inline]
 slab_alloc mm/slab.c:3319 [inline]
 kmem_cache_alloc+0x1f5/0x2e0 mm/slab.c:3483
 kmem_cache_zalloc include/linux/slab.h:738 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0x100/0x460 net/core/net_namespace.c:462
 create_new_namespaces+0x4ec/0x700 kernel/nsproxy.c:103
 unshare_nsproxy_namespaces+0x12a/0x190 kernel/nsproxy.c:202
 ksys_unshare+0x478/0xa00 kernel/fork.c:2831
 __do_sys_unshare kernel/fork.c:2899 [inline]
 __se_sys_unshare kernel/fork.c:2897 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:2897
 do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 1719:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x12a/0x1e0 mm/kasan/common.c:449
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:457
 __cache_free mm/slab.c:3425 [inline]
 kmem_cache_free+0x81/0xf0 mm/slab.c:3693
 net_free net/core/net_namespace.c:438 [inline]
 net_drop_ns net/core/net_namespace.c:445 [inline]
 cleanup_net+0xa38/0xaa0 net/core/net_namespace.c:613
 process_one_work+0x7ef/0x10e0 kernel/workqueue.c:2269
 worker_thread+0xc01/0x1630 kernel/workqueue.c:2415
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff88807c2fc400
 which belongs to the cache net_namespace of size 6784
The buggy address is located 576 bytes inside of
 6784-byte region [ffff88807c2fc400, ffff88807c2fde80)
The buggy address belongs to the page:
page:ffffea0001f0bf00 refcount:1 mapcount:0 mapping:ffff88821b6ad1c0 index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffff8880a9973d48 ffffea0001a3b208 ffff88821b6ad1c0
raw: 0000000000000000 ffff88807c2fc400 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88807c2fc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807c2fc580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807c2fc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff88807c2fc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807c2fc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================