==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: use-after-free in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: use-after-free in expire_timers kernel/time/timer.c:1482 [inline]
BUG: KASAN: use-after-free in __run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
Write of size 8 at addr ffff8881e2c5b1c8 by task syz.9.831/3680

CPU: 1 PID: 3680 Comm: syz.9.831 Tainted: G        W         5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 __hlist_del include/linux/list.h:791 [inline]
 detach_timer kernel/time/timer.c:824 [inline]
 expire_timers kernel/time/timer.c:1482 [inline]
 __run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:4558
Code: 4c 89 e7 e8 70 d2 3d fd f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 74 8d ee fc fb bf 01 00 00 00 <e8> b9 e6 ff ff fa bf 01 00 00 00 e8 de 8e ee fc 65 48 8b 1d 86 2a
RSP: 0018:ffff8881e547ef00 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103c9a3cff RBX: 1ffff1103ca8fde4 RCX: ffffffff84573f00
RDX: ffffc90000593000 RSI: 000000000003e456 RDI: 0000000000000001
RBP: ffff8881e547ef88 R08: ffffffff8231cdb9 R09: ffffed103edeb135
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e547ef20
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff1103ca8fde0
 retint_kernel+0x1b/0x1b
RIP: 0010:memcpy_erms+0x8/0x10 arch/x86/lib/memcpy_64.S:55
Code: 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4 <c3> 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe 7c 35
RSP: 0018:ffff8881e547f040 EFLAGS: 00000256 ORIG_RAX: ffffffffffffff13
RAX: ffff8881e4e510f0 RBX: ffff8881e4e510d0 RCX: 0000000000000000
RDX: 0000000000000010 RSI: ffffffff84e16630 RDI: ffff8881e4e51100
RBP: 00000000000000d0 R08: dffffc0000000000 R09: ffffed103c9ca220
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881e4e51000 R14: ffff8881ea570000 R15: 7fffffffffffffff
 __mark_reg_unknown kernel/bpf/verifier.c:1000 [inline]
 mark_reg_unknown+0x8e/0x4d0 kernel/bpf/verifier.c:1017
 check_alu_op kernel/bpf/verifier.c:5294 [inline]
 do_check+0x6063/0x9820 kernel/bpf/verifier.c:7896
 bpf_check+0x2183/0xb3e0 kernel/bpf/verifier.c:9637
 bpf_prog_load kernel/bpf/syscall.c:1724 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8139/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f527e08d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f527c6f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f527e2a5fa0 RCX: 00007f527e08d169
RDX: 0000000000000094 RSI: 0000400000000840 RDI: 0000000000000005
RBP: 00007f527e10e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f527e2a5fa0 R15: 00007ffd4a7f1848

Allocated by task 3616:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x100/0x2b0 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 pskb_expand_head+0x10c/0x10b0 net/core/skbuff.c:1653
 __bpf_try_make_writable net/core/filter.c:1635 [inline]
 bpf_try_make_writable net/core/filter.c:1641 [inline]
 bpf_try_make_head_writable net/core/filter.c:1649 [inline]
 ____bpf_clone_redirect net/core/filter.c:2145 [inline]
 bpf_clone_redirect+0x110/0x350 net/core/filter.c:2123
 0xffffffffa00a8add
 bpf_call_func include/linux/filter.h:627 [inline]
 bpf_test_run+0x2ae/0x6c0 net/bpf/test_run.c:44
 bpf_prog_test_run_skb+0x73c/0xf00 net/bpf/test_run.c:311
 bpf_prog_test_run kernel/bpf/syscall.c:2124 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2909 [inline]
 __se_sys_bpf+0x2e37/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Freed by task 3616:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0x123/0x370 mm/slub.c:4071
 skb_release_all net/core/skbuff.c:675 [inline]
 __kfree_skb net/core/skbuff.c:689 [inline]
 kfree_skb+0xb8/0x3c0 net/core/skbuff.c:708
 ip_tunnel_xmit+0x18bd/0x2690 net/ipv4/ip_tunnel.c:840
 __gre_xmit net/ipv4/ip_gre.c:465 [inline]
 ipgre_xmit+0x79f/0xb30 net/ipv4/ip_gre.c:660
 __netdev_start_xmit include/linux/netdevice.h:4538 [inline]
 netdev_start_xmit include/linux/netdevice.h:4552 [inline]
 xmit_one net/core/dev.c:3221 [inline]
 dev_hard_start_xmit+0x1b7/0x6b0 net/core/dev.c:3237
 __dev_queue_xmit+0x138c/0x2790 net/core/dev.c:3821
 __bpf_tx_skb net/core/filter.c:2063 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2097 [inline]
 __bpf_redirect+0x78f/0xe20 net/core/filter.c:2120
 ____bpf_clone_redirect net/core/filter.c:2151 [inline]
 bpf_clone_redirect+0x249/0x350 net/core/filter.c:2123
 0xffffffffa00a8add
 bpf_call_func include/linux/filter.h:627 [inline]
 bpf_test_run+0x2ae/0x6c0 net/bpf/test_run.c:44
 bpf_prog_test_run_skb+0x73c/0xf00 net/bpf/test_run.c:311
 bpf_prog_test_run kernel/bpf/syscall.c:2124 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2909 [inline]
 __se_sys_bpf+0x2e37/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

The buggy address belongs to the object at ffff8881e2c5b000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 456 bytes inside of
 512-byte region [ffff8881e2c5b000, ffff8881e2c5b200)
The buggy address belongs to the page:
page:ffffea00078b1600 refcount:1 mapcount:0 mapping:ffff8881f5c02500 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x16d/0x2b0 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 pskb_expand_head+0x10c/0x10b0 net/core/skbuff.c:1653
 __bpf_try_make_writable net/core/filter.c:1635 [inline]
 bpf_try_make_writable net/core/filter.c:1641 [inline]
 bpf_try_make_head_writable net/core/filter.c:1649 [inline]
 ____bpf_clone_redirect net/core/filter.c:2145 [inline]
 bpf_clone_redirect+0x110/0x350 net/core/filter.c:2123
 0xffffffffa00a8add
 bpf_call_func include/linux/filter.h:627 [inline]
 bpf_test_run+0x2ae/0x6c0 net/bpf/test_run.c:44
 bpf_prog_test_run_skb+0x73c/0xf00 net/bpf/test_run.c:311
 bpf_prog_test_run kernel/bpf/syscall.c:2124 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2909 [inline]
 __se_sys_bpf+0x2e37/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare mm/page_alloc.c:1233 [inline]
 free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
 free_unref_page_list+0x10a/0x590 mm/page_alloc.c:3154
 release_pages+0xad8/0xb20 mm/swap.c:842
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:189 [inline]
 tlb_flush_mmu mm/mmu_gather.c:196 [inline]
 tlb_finish_mmu+0x177/0x320 mm/mmu_gather.c:277
 exit_mmap+0x2dc/0x520 mm/mmap.c:3193
 __mmput+0x8e/0x2c0 kernel/fork.c:1101
 exit_mm kernel/exit.c:538 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:848
 do_group_exit+0x138/0x300 kernel/exit.c:984
 get_signal+0xdb1/0x1440 kernel/signal.c:2738
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881e2c5b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e2c5b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881e2c5b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff8881e2c5b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881e2c5b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1eac21067 P4D 1eac21067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3680 Comm: syz.9.831 Tainted: G    B   W         5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010202
RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881e4d1de80
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e2c5b1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffbc10
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e2c5b1c0
FS:  00007f527c6f76c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001e0d3e000 CR4: 00000000003406a0
DR0: 0000400000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:4558
Code: 4c 89 e7 e8 70 d2 3d fd f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 74 8d ee fc fb bf 01 00 00 00 <e8> b9 e6 ff ff fa bf 01 00 00 00 e8 de 8e ee fc 65 48 8b 1d 86 2a
RSP: 0018:ffff8881e547ef00 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103c9a3cff RBX: 1ffff1103ca8fde4 RCX: ffffffff84573f00
RDX: ffffc90000593000 RSI: 000000000003e456 RDI: 0000000000000001
RBP: ffff8881e547ef88 R08: ffffffff8231cdb9 R09: ffffed103edeb135
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e547ef20
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff1103ca8fde0
 retint_kernel+0x1b/0x1b
RIP: 0010:memcpy_erms+0x8/0x10 arch/x86/lib/memcpy_64.S:55
Code: 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4 <c3> 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe 7c 35
RSP: 0018:ffff8881e547f040 EFLAGS: 00000256 ORIG_RAX: ffffffffffffff13
RAX: ffff8881e4e510f0 RBX: ffff8881e4e510d0 RCX: 0000000000000000
RDX: 0000000000000010 RSI: ffffffff84e16630 RDI: ffff8881e4e51100
RBP: 00000000000000d0 R08: dffffc0000000000 R09: ffffed103c9ca220
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881e4e51000 R14: ffff8881ea570000 R15: 7fffffffffffffff
 __mark_reg_unknown kernel/bpf/verifier.c:1000 [inline]
 mark_reg_unknown+0x8e/0x4d0 kernel/bpf/verifier.c:1017
 check_alu_op kernel/bpf/verifier.c:5294 [inline]
 do_check+0x6063/0x9820 kernel/bpf/verifier.c:7896
 bpf_check+0x2183/0xb3e0 kernel/bpf/verifier.c:9637
 bpf_prog_load kernel/bpf/syscall.c:1724 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8139/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f527e08d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f527c6f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f527e2a5fa0 RCX: 00007f527e08d169
RDX: 0000000000000094 RSI: 0000400000000840 RDI: 0000000000000005
RBP: 00007f527e10e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f527e2a5fa0 R15: 00007ffd4a7f1848
Modules linked in:
CR2: 0000000000000000
---[ end trace a99334fdd26515df ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010202
RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881e4d1de80
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e2c5b1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffbc10
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e2c5b1c0
FS:  00007f527c6f76c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001e0d3e000 CR4: 00000000003406a0
DR0: 0000400000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	4c 89 e7             	mov    %r12,%rdi
   3:	e8 70 d2 3d fd       	call   0xfd3dd278
   8:	f6 44 24 21 02       	testb  $0x2,0x21(%rsp)
   d:	74 0b                	je     0x1a
   f:	0f 0b                	ud2
  11:	48 f7 03 08 00 00 00 	testq  $0x8,(%rbx)
  18:	74 4d                	je     0x67
  1a:	bf 01 00 00 00       	mov    $0x1,%edi
  1f:	e8 74 8d ee fc       	call   0xfcee8d98
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 b9 e6 ff ff       	call   0xffffe6e8 <-- trapping instruction
  2f:	fa                   	cli
  30:	bf 01 00 00 00       	mov    $0x1,%edi
  35:	e8 de 8e ee fc       	call   0xfcee8f18
  3a:	65                   	gs
  3b:	48                   	rex.W
  3c:	8b                   	.byte 0x8b
  3d:	1d                   	.byte 0x1d
  3e:	86 2a                	xchg   %ch,(%rdx)