==================================================================
BUG: KASAN: slab-out-of-bounds in hlist_add_head include/linux/list.h:814 [inline]
BUG: KASAN: slab-out-of-bounds in enqueue_timer+0xb7/0x300 kernel/time/timer.c:541
Write of size 8 at addr ffff8881e44bb1c8 by task syz.8.943/4323

CPU: 0 PID: 4323 Comm: syz.8.943 Not tainted 5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 hlist_add_head include/linux/list.h:814 [inline]
 enqueue_timer+0xb7/0x300 kernel/time/timer.c:541
 __internal_add_timer kernel/time/timer.c:554 [inline]
 internal_add_timer+0x240/0x430 kernel/time/timer.c:604
 __mod_timer+0x6f1/0x13e0 kernel/time/timer.c:1065
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:unwind_next_frame+0xfe8/0x1ea0 arch/x86/kernel/unwind_orc.c:532
Code: 40 01 00 00 48 8b 44 24 30 42 80 3c 38 00 48 8b 5c 24 20 74 08 48 89 df e8 95 69 64 00 4c 89 2b 48 8b 44 24 60 42 80 3c 38 00 <4c> 8b 34 24 48 8b 5c 24 68 74 08 48 89 df e8 75 69 64 00 48 8b 44
RSP: 0018:ffff8881d4d4e840 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103a9a9d6f RBX: ffff8881d4d4eb88 RCX: 1ffff1103a9a9d68
RDX: ffffffff867fbe36 RSI: ffff8881d4d4e980 RDI: ffff8881d4d4ecb8
RBP: ffff8881d4d4eb30 R08: 0000000000000003 R09: ffff8881d4d4eb90
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffffff0cff7c6
R13: ffffffff81941321 R14: ffff8881d4d4ecb8 R15: dffffc0000000000
 arch_stack_walk+0x111/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842
 kmem_cache_alloc_node include/linux/slab.h:427 [inline]
 alloc_vmap_area+0x162/0x1ac0 mm/vmalloc.c:1070
 __get_vm_area_node+0x1c7/0x310 mm/vmalloc.c:2066
 __vmalloc_node_range+0xee/0x710 mm/vmalloc.c:2494
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc_node_flags mm/vmalloc.c:2568 [inline]
 vmalloc+0x70/0x80 mm/vmalloc.c:2593
 bpf_prog_calc_tag+0xd7/0x8f0 kernel/bpf/core.c:280
 replace_map_fd_with_map_ptr kernel/bpf/verifier.c:8218 [inline]
 bpf_check+0x91a/0xb3e0 kernel/bpf/verifier.c:9608
 bpf_prog_load kernel/bpf/syscall.c:1724 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8139/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7fd1d9c03169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd1d826d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fd1d9e1bfa0 RCX: 00007fd1d9c03169
RDX: 0000000000000090 RSI: 0000400000000840 RDI: 0000000000000005
RBP: 00007fd1d9c842a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd1d9e1bfa0 R15: 00007fffe3474388

Allocated by task 1556:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842
 kmem_cache_zalloc include/linux/slab.h:680 [inline]
 __alloc_file+0x26/0x310 fs/file_table.c:101
 alloc_empty_file+0x92/0x180 fs/file_table.c:151
 path_openat+0x103/0x34b0 fs/namei.c:3672
 do_filp_open+0x20b/0x450 fs/namei.c:3713
 do_sys_open+0x39c/0x810 fs/open.c:1123
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Freed by task 17:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch+0x492/0xa00 kernel/rcu/tree.c:2167
 rcu_core+0x4c8/0xcb0 kernel/rcu/tree.c:2387
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292

The buggy address belongs to the object at ffff8881e44bb080
 which belongs to the cache filp of size 280
The buggy address is located 48 bytes to the right of
 280-byte region [ffff8881e44bb080, ffff8881e44bb198)
The buggy address belongs to the page:
page:ffffea0007912e80 refcount:1 mapcount:0 mapping:ffff8881f5cfd400 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5cfd400
raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0x109/0x250 mm/slub.c:2842
 kmem_cache_zalloc include/linux/slab.h:680 [inline]
 __alloc_file+0x26/0x310 fs/file_table.c:101
 alloc_empty_file+0x92/0x180 fs/file_table.c:151
 path_openat+0x103/0x34b0 fs/namei.c:3672
 do_filp_open+0x20b/0x450 fs/namei.c:3713
 do_sys_open+0x39c/0x810 fs/open.c:1123
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4955 [inline]
 __free_pages+0x91/0x140 mm/page_alloc.c:4961
 device_release+0x6b/0x190 drivers/base/core.c:1776
 kobject_cleanup lib/kobject.c:716 [inline]
 kobject_release lib/kobject.c:747 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e6/0x2f0 lib/kobject.c:764
 tun_set_iff+0x870/0xdc0 drivers/net/tun.c:2924
 __tun_chr_ioctl+0x8a9/0x1d00 drivers/net/tun.c:3187
 do_vfs_ioctl+0x742/0x1720 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881e44bb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e44bb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881e44bb180: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
                                              ^
 ffff8881e44bb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e44bb280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1d3733067 P4D 1d3733067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4323 Comm: syz.8.943 Tainted: G    B             5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881d9fe5e80
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e44bb1c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffe640
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e44bb1c0
FS:  00007fd1d826d6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001da4cc000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:unwind_next_frame+0xfe8/0x1ea0 arch/x86/kernel/unwind_orc.c:532
Code: 40 01 00 00 48 8b 44 24 30 42 80 3c 38 00 48 8b 5c 24 20 74 08 48 89 df e8 95 69 64 00 4c 89 2b 48 8b 44 24 60 42 80 3c 38 00 <4c> 8b 34 24 48 8b 5c 24 68 74 08 48 89 df e8 75 69 64 00 48 8b 44
RSP: 0018:ffff8881d4d4e840 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103a9a9d6f RBX: ffff8881d4d4eb88 RCX: 1ffff1103a9a9d68
RDX: ffffffff867fbe36 RSI: ffff8881d4d4e980 RDI: ffff8881d4d4ecb8
RBP: ffff8881d4d4eb30 R08: 0000000000000003 R09: ffff8881d4d4eb90
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffffff0cff7c6
R13: ffffffff81941321 R14: ffff8881d4d4ecb8 R15: dffffc0000000000
 arch_stack_walk+0x111/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842
 kmem_cache_alloc_node include/linux/slab.h:427 [inline]
 alloc_vmap_area+0x162/0x1ac0 mm/vmalloc.c:1070
 __get_vm_area_node+0x1c7/0x310 mm/vmalloc.c:2066
 __vmalloc_node_range+0xee/0x710 mm/vmalloc.c:2494
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc_node_flags mm/vmalloc.c:2568 [inline]
 vmalloc+0x70/0x80 mm/vmalloc.c:2593
 bpf_prog_calc_tag+0xd7/0x8f0 kernel/bpf/core.c:280
 replace_map_fd_with_map_ptr kernel/bpf/verifier.c:8218 [inline]
 bpf_check+0x91a/0xb3e0 kernel/bpf/verifier.c:9608
 bpf_prog_load kernel/bpf/syscall.c:1724 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8139/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7fd1d9c03169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd1d826d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fd1d9e1bfa0 RCX: 00007fd1d9c03169
RDX: 0000000000000090 RSI: 0000400000000840 RDI: 0000000000000005
RBP: 00007fd1d9c842a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd1d9e1bfa0 R15: 00007fffe3474388
Modules linked in:
CR2: 0000000000000000
---[ end trace 40ddd1df5fb216e9 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881d9fe5e80
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e44bb1c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffe640
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e44bb1c0
FS:  00007fd1d826d6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001da4cc000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	40 01 00             	rex add %eax,(%rax)
   3:	00 48 8b             	add    %cl,-0x75(%rax)
   6:	44 24 30             	rex.R and $0x30,%al
   9:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
   e:	48 8b 5c 24 20       	mov    0x20(%rsp),%rbx
  13:	74 08                	je     0x1d
  15:	48 89 df             	mov    %rbx,%rdi
  18:	e8 95 69 64 00       	call   0x6469b2
  1d:	4c 89 2b             	mov    %r13,(%rbx)
  20:	48 8b 44 24 60       	mov    0x60(%rsp),%rax
  25:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
* 2a:	4c 8b 34 24          	mov    (%rsp),%r14 <-- trapping instruction
  2e:	48 8b 5c 24 68       	mov    0x68(%rsp),%rbx
  33:	74 08                	je     0x3d
  35:	48 89 df             	mov    %rbx,%rdi
  38:	e8 75 69 64 00       	call   0x6469b2
  3d:	48                   	rex.W
  3e:	8b                   	.byte 0x8b
  3f:	44                   	rex.R