==================================================================
BUG: KASAN: use-after-free in instrument_copy_from_user_before include/linux/instrumented.h:129 [inline]
BUG: KASAN: use-after-free in copyin lib/iov_iter.c:194 [inline]
BUG: KASAN: use-after-free in _copy_from_iter+0x28c/0xe7c lib/iov_iter.c:649
Write of size 1356 at addr ffff000128001318 by task sshd/5962

CPU: 0 PID: 5962 Comm: sshd Not tainted 6.4.0-rc5-syzkaller-gd8b213732169 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:351 [inline]
 print_report+0x174/0x514 mm/kasan/report.c:462
 kasan_report+0xd4/0x130 mm/kasan/report.c:572
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
 instrument_copy_from_user_before include/linux/instrumented.h:129 [inline]
 copyin lib/iov_iter.c:194 [inline]
 _copy_from_iter+0x28c/0xe7c lib/iov_iter.c:649
 copy_from_iter include/linux/uio.h:214 [inline]
 copy_from_iter_full include/linux/uio.h:221 [inline]
 skb_do_copy_data_nocache include/net/sock.h:2249 [inline]
 skb_copy_to_page_nocache include/net/sock.h:2275 [inline]
 tcp_sendmsg_locked+0x1468/0x34e8 net/ipv4/tcp.c:1380
 tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1487
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:827
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg net/socket.c:747 [inline]
 sock_write_iter+0x2d8/0x448 net/socket.c:1140
 call_write_iter include/linux/fs.h:1868 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x618/0x918 fs/read_write.c:584
 ksys_write+0x15c/0x26c fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191
 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591

The buggy address belongs to the physical page:
page:000000001df02f38 refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x168001
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000000000 0000000000000000 ffffffff04a00301 0000000000000000
raw: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000128001200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000128001280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff000128001300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff000128001380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000128001400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
page:00000000046e3001 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x168000
memcg:ffff0000d6337702
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xfffffdff(table)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 ffff0000c41a3660 00000001fffffdff ffff0000d6337702
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:996!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5962 Comm: sshd Tainted: G    B              6.4.0-rc5-syzkaller-gd8b213732169 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : put_page_testzero include/linux/mm.h:996 [inline]
pc : folio_put_testzero include/linux/mm.h:1002 [inline]
pc : folio_put include/linux/mm.h:1429 [inline]
pc : put_page include/linux/mm.h:1499 [inline]
pc : napi_frag_unref+0x1b8/0x1f4 include/linux/skbuff.h:3427
lr : put_page_testzero include/linux/mm.h:996 [inline]
lr : folio_put_testzero include/linux/mm.h:1002 [inline]
lr : folio_put include/linux/mm.h:1429 [inline]
lr : put_page include/linux/mm.h:1499 [inline]
lr : napi_frag_unref+0x1b8/0x1f4 include/linux/skbuff.h:3427
sp : ffff800096467180
x29: ffff800096467180 x28: 0000000000000007 x27: ffff0000cfabf900
x26: ffff0000caf58d70 x25: 0000000000000000 x24: ffff0000caf58d42
x23: 1fffe000195eb1a8 x22: dfff800000000000 x21: 0000000000000000
x20: fffffc0004a00034 x19: fffffc0004a00000 x18: 1fffe000368447c6
x17: ffff80008debd000 x16: ffff80008a43bfbc x15: 0000000000000002
x14: 0000000000000000 x13: 0000000040000000 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000db475340 x7 : 1fffe000368447c7 x6 : ffff80008028cadc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000805974f4
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e
Call trace:
 put_page_testzero include/linux/mm.h:996 [inline]
 folio_put_testzero include/linux/mm.h:1002 [inline]
 folio_put include/linux/mm.h:1429 [inline]
 put_page include/linux/mm.h:1499 [inline]
 napi_frag_unref+0x1b8/0x1f4 include/linux/skbuff.h:3427
 skb_release_data+0x37c/0x5c8 net/core/skbuff.c:942
 skb_release_all net/core/skbuff.c:1014 [inline]
 __kfree_skb+0x5c/0x7c net/core/skbuff.c:1028
 tcp_wmem_free_skb include/net/tcp.h:302 [inline]
 tcp_rtx_queue_unlink_and_free+0x2e8/0x4a8 include/net/tcp.h:1944
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3334 [inline]
 tcp_ack+0x1be4/0x5688 net/ipv4/tcp_input.c:3884
 tcp_rcv_established+0xb20/0x1fc4 net/ipv4/tcp_input.c:6008
 tcp_v4_do_rcv+0x3b0/0xe00 net/ipv4/tcp_ipv4.c:1722
 sk_backlog_rcv include/net/sock.h:1115 [inline]
 __release_sock+0x1a8/0x408 net/core/sock.c:2917
 release_sock+0x68/0x1b0 net/core/sock.c:3484
 tcp_sendmsg+0x4c/0x64 net/ipv4/tcp.c:1488
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:827
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg net/socket.c:747 [inline]
 sock_write_iter+0x2d8/0x448 net/socket.c:1140
 call_write_iter include/linux/fs.h:1868 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x618/0x918 fs/read_write.c:584
 ksys_write+0x15c/0x26c fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191
 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: 90020441 911c0021 aa1303e0 960785dc (d4210000) 
---[ end trace 0000000000000000 ]---