==================================================================
BUG: KASAN: use-after-free in smc_fback_error_report+0x96/0xa0 net/smc/af_smc.c:772
Read of size 8 at addr ffff88806d0bf428 by task syz-executor.2/32282

CPU: 0 PID: 32282 Comm: syz-executor.2 Tainted: G        W         5.17.0-syzkaller-10753-gbddac7c1e02b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 smc_fback_error_report+0x96/0xa0 net/smc/af_smc.c:772
 sk_error_report+0x35/0x310 net/core/sock.c:340
 tcp_write_err net/ipv4/tcp_timer.c:71 [inline]
 tcp_write_timeout net/ipv4/tcp_timer.c:276 [inline]
 tcp_retransmit_timer+0x16c5/0x3360 net/ipv4/tcp_timer.c:512
 tcp_write_timer_handler+0x5e6/0xbc0 net/ipv4/tcp_timer.c:622
 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:finish_task_switch.isra.0+0x323/0xb80 kernel/sched/core.c:4953
Code: c3 69 0d 08 85 c0 75 02 0f 0b 48 85 db 0f 85 25 01 00 00 4c 89 f7 e8 fc f7 ff ff e8 f7 8c 2d 00 fb 65 48 8b 1c 25 00 70 02 00 <48> 8d bb 80 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc9000364f530 EFLAGS: 00000246
RAX: 0000000000000007 RBX: ffff888072fd4140 RCX: 1ffffffff1b69929
RDX: 0000000000000000 RSI: ffffffff817e8281 RDI: ffffffff8150f539
RBP: ffffc9000364f578 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff817e8268 R11: 0000000000000001 R12: ffff8880b9c3ad58
R13: ffff8880765e0240 R14: ffff8880b9c3a000 R15: ffff8880b9c3aa38
 context_switch kernel/sched/core.c:5076 [inline]
 __schedule+0xaa2/0x4940 kernel/sched/core.c:6382
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6547
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x57/0x70 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:404 [inline]
 __wake_up_common_lock+0xde/0x130 kernel/sched/wait.c:139
 __unix_dgram_recvmsg+0x2cd/0xb80 net/unix/af_unix.c:2418
 unix_dgram_recvmsg+0xca/0xf0 net/unix/af_unix.c:2489
 sock_recvmsg_nosec net/socket.c:948 [inline]
 ____sys_recvmsg+0x527/0x600 net/socket.c:2630
 ___sys_recvmsg+0x127/0x200 net/socket.c:2674
 do_recvmmsg+0x24d/0x6d0 net/socket.c:2768
 __sys_recvmmsg net/socket.c:2847 [inline]
 __do_sys_recvmmsg net/socket.c:2870 [inline]
 __se_sys_recvmmsg net/socket.c:2863 [inline]
 __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2863
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f23e5089049
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f23e61b3168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f23e519c030 RCX: 00007f23e5089049
RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 00007f23e50e308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff1ce10a2f R14: 00007f23e61b3300 R15: 0000000000022000
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001b42fc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6d0bf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100cc0(GFP_USER), pid 26325, tgid 26324 (syz-executor.4), ts 792094197941, free_ts 792208777910
 prep_new_page mm/page_alloc.c:2438 [inline]
 get_page_from_freelist+0xba2/0x3df0 mm/page_alloc.c:4179
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5405
 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2262
 __get_free_pages+0x8/0x40 mm/page_alloc.c:5454
 kasan_populate_vmalloc_pte mm/kasan/shadow.c:271 [inline]
 kasan_populate_vmalloc_pte+0x25/0x160 mm/kasan/shadow.c:262
 apply_to_pte_range mm/memory.c:2547 [inline]
 apply_to_pmd_range mm/memory.c:2591 [inline]
 apply_to_pud_range mm/memory.c:2627 [inline]
 apply_to_p4d_range mm/memory.c:2663 [inline]
 __apply_to_page_range+0x686/0x1030 mm/memory.c:2697
 alloc_vmap_area+0xb0f/0x1f00 mm/vmalloc.c:1594
 __get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2466
 __vmalloc_node_range+0x264/0x13c0 mm/vmalloc.c:3132
 __bpf_map_area_alloc+0xd5/0x150 kernel/bpf/syscall.c:330
 bloom_map_alloc+0x322/0x620 kernel/bpf/bloom_filter.c:144
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create kernel/bpf/syscall.c:864 [inline]
 __sys_bpf+0xc04/0x5c60 kernel/bpf/syscall.c:4645
 __do_sys_bpf kernel/bpf/syscall.c:4767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4765 [inline]
 __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4765
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1353 [inline]
 free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1403
 free_unref_page_prepare mm/page_alloc.c:3325 [inline]
 free_unref_page+0x19/0x690 mm/page_alloc.c:3420
 kasan_depopulate_vmalloc_pte+0x5c/0x70 mm/kasan/shadow.c:359
 apply_to_pte_range mm/memory.c:2547 [inline]
 apply_to_pmd_range mm/memory.c:2591 [inline]
 apply_to_pud_range mm/memory.c:2627 [inline]
 apply_to_p4d_range mm/memory.c:2663 [inline]
 __apply_to_page_range+0x686/0x1030 mm/memory.c:2697
 kasan_release_vmalloc+0xa7/0xc0 mm/kasan/shadow.c:469
 __purge_vmap_area_lazy+0x8f9/0x1c50 mm/vmalloc.c:1733
 drain_vmap_area_work+0x52/0xe0 mm/vmalloc.c:1762
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff88806d0bf300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806d0bf380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88806d0bf400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                  ^
 ffff88806d0bf480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806d0bf500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
----------------
Code disassembly (best guess):
   0:	c3                   	retq
   1:	69 0d 08 85 c0 75 02 	imul   $0x480b0f02,0x75c08508(%rip),%ecx        # 0x75c08513
   8:	0f 0b 48
   b:	85 db                	test   %ebx,%ebx
   d:	0f 85 25 01 00 00    	jne    0x138
  13:	4c 89 f7             	mov    %r14,%rdi
  16:	e8 fc f7 ff ff       	callq  0xfffff817
  1b:	e8 f7 8c 2d 00       	callq  0x2d8d17
  20:	fb                   	sti
  21:	65 48 8b 1c 25 00 70 	mov    %gs:0x27000,%rbx
  28:	02 00
* 2a:	48 8d bb 80 15 00 00 	lea    0x1580(%rbx),%rdi <-- trapping instruction
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48 89 fa             	mov    %rdi,%rdx
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1