Extracting prog: 12m34.620139281s
Minimizing prog: 14m37.386637485s
Simplifying prog options: 0s
Extracting C: 1m6.174359376s
Simplifying C: 5m53.828506278s


extracting reproducer from 12 programs
testing a last program of every proc
single: executing 2 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-recvmmsg-write$eventfd
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
recvmmsg(r0, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}}], 0x0, 0x0, 0x0)
write$eventfd(r1, 0x0, 0x0)

program did not crash
program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mmap-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000a, 0x13, r0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000003000000000000001e0e0000b7080000000000007b8af8ff00000000b7080000080000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000ff0100000000000000000085000000a500000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94)

program did not crash
single: failed to extract reproducer
bisect: bisecting 12 programs with base timeout 45s
testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3]
detailed listing:
executing program 0:
r0 = socket$nl_audit(0x10, 0x3, 0x9)
sendmsg$AUDIT_SET(r0, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f0000001a00)={0x3c}, 0x3c}}, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000001f40), r0)
executing program 1:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/tty/drivers\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$KDGKBDIACR(r0, 0x5451, 0x0)
executing program 1:
r0 = socket$kcm(0x29, 0x5, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000080)={<r1=>0xffffffffffffffff})
sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, 0x0)
executing program 0:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
sync_file_range(0xffffffffffffffff, 0x0, 0x0, 0x0)
fcntl$setstatus(r0, 0x4, 0x0)
executing program 1:
r0 = openat$mixer(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r1, 0xc25c4110, &(0x7f0000000280))
executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={<r0=>0xffffffffffffffff})
r1 = dup(r0)
getpeername$llc(r1, 0x0, &(0x7f0000000240))
executing program 1:
r0 = openat$audio1(0xffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = dup(r0)
ioctl$SOUND_MIXER_INFO(r1, 0x805c4d65, &(0x7f0000000080))
executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0xc2943, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$VHOST_VDPA_SET_CONFIG(r1, 0x4008af74, 0x0)
executing program 1:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r1, 0x0, r0)
write$USERIO_CMD_REGISTER(r2, 0x0, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000a, 0x13, r0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000003000000000000001e0e0000b7080000000000007b8af8ff00000000b7080000080000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000ff0100000000000000000085000000a500000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
recvmmsg(r0, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}}], 0x0, 0x0, 0x0)
write$eventfd(r1, 0x0, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 2 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-recvmmsg-write$eventfd
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
recvmmsg(r0, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}}], 0x0, 0x0, 0x0)
write$eventfd(r1, 0x0, 0x0)

program did not crash
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mmap-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000a, 0x13, r0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000003000000000000001e0e0000b7080000000000007b8af8ff00000000b7080000080000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000ff0100000000000000000085000000a500000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94)

program crashed: KASAN: slab-use-after-free Write in defer_free
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mmap
detailed listing:
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000a, 0x13, r0, 0x0)

program crashed: KASAN: slab-use-after-free Write in defer_free
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)

program crashed: KASAN: slab-use-after-free Write in defer_free
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x48)

program did not crash
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB], 0x48)

program did not crash
extracting C reproducer
testing compiled C program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
simplifying C reproducer
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing compiled C program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
program crashed: KASAN: slab-use-after-free Write in defer_free
testing program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)

program crashed: KASAN: slab-use-after-free Write in defer_free
validation run: crashed=true
testing program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)

program crashed: KASAN: slab-use-after-free Write in defer_free
validation run: crashed=true
testing program (duration=5m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48)

program crashed: KASAN: slab-use-after-free Write in defer_free
validation run: crashed=true
reproducing took 40m6.709925109s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in defer_free+0x3c/0xbc mm/slub.c:6537
Write at addr fcf0000004003ee0 by task kworker/u8:10/2152
Pointer tag: [fc], memory tag: [fe]

CPU: 1 UID: 0 PID: 2152 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Workqueue: events_unbound bpf_map_free_deferred
Call trace:
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x78/0x90 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x108/0x61c mm/kasan/report.c:482
 kasan_report+0x88/0xac mm/kasan/report.c:595
 report_tag_fault arch/arm64/mm/fault.c:330 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:342 [inline]
 __do_kernel_fault+0x170/0x1c8 arch/arm64/mm/fault.c:384
 do_bad_area+0x68/0x78 arch/arm64/mm/fault.c:484
 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:857
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:933
 el1_abort+0x44/0x68 arch/arm64/kernel/entry-common.c:303
 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:437
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 defer_free+0x3c/0xbc mm/slub.c:6537 (P)
 do_slab_free mm/slub.c:6619 [inline]
 kfree_nolock+0x1a0/0x1d4 mm/slub.c:6930
 range_tree_destroy+0x74/0x90 kernel/bpf/range_tree.c:253
 arena_map_free+0x64/0x90 kernel/bpf/arena.c:196
 bpf_map_free kernel/bpf/syscall.c:894 [inline]
 bpf_map_free_deferred+0x70/0x180 kernel/bpf/syscall.c:921
 process_one_work+0x178/0x2cc kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x24c/0x354 kernel/workqueue.c:3421
 kthread+0x130/0x1fc kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

Allocated by task 3575:
 kasan_save_stack+0x3c/0x64 mm/kasan/common.c:56
 save_stack_info+0x40/0x158 mm/kasan/tags.c:106
 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 poison_kmalloc_redzone mm/kasan/common.c:373 [inline]
 __kasan_kmalloc+0xb4/0xb8 mm/kasan/common.c:417
 kasan_kmalloc include/linux/kasan.h:262 [inline]
 kmalloc_nolock_noprof+0x1dc/0x4fc mm/slub.c:5751
 range_tree_set+0x644/0x778 kernel/bpf/range_tree.c:237
 arena_map_alloc+0x11c/0x17c kernel/bpf/arena.c:141
 map_create+0x19c/0xa98 kernel/bpf/syscall.c:1514
 __sys_bpf+0x348/0x1a88 kernel/bpf/syscall.c:6146
 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
 __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6272
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x128 arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596

Freed by task 2152:
 kasan_save_stack+0x3c/0x64 mm/kasan/common.c:56
 save_stack_info+0x40/0x158 mm/kasan/tags.c:106
 __kasan_save_free_info+0x18/0x24 mm/kasan/tags.c:147
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x80/0x84 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 kfree_nolock+0xcc/0x1d4 mm/slub.c:6929
 range_tree_destroy+0x74/0x90 kernel/bpf/range_tree.c:253
 arena_map_free+0x64/0x90 kernel/bpf/arena.c:196
 bpf_map_free kernel/bpf/syscall.c:894 [inline]
 bpf_map_free_deferred+0x70/0x180 kernel/bpf/syscall.c:921
 process_one_work+0x178/0x2cc kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x24c/0x354 kernel/workqueue.c:3421
 kthread+0x130/0x1fc kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

The buggy address belongs to the object at fff0000004003ec0
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 32 bytes inside of
 64-byte region [fff0000004003ec0, fff0000004003f00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x44003
flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
page_type: f5(slab)
raw: 01ffc00000000000 f3f0000003001600 ffffc1ffc00f8480 dead000000000002
raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff0000004003c00: f2 f2 f2 fe fb fb fb fe f9 f9 f9 fe f2 f2 f2 fe
 fff0000004003d00: f1 f1 f1 f1 fd fd fd fe fc fc fc fe f8 f8 f8 fe
>fff0000004003e00: f3 f3 f3 f3 fb fb fb fe fd fd fd fe fe fe fe fe
                                                             ^
 fff0000004003f00: fa fa fa fe fd fd fd fe f7 f7 f7 fe f7 f7 f7 fe
 fff0000004004000: f4 f4 f4 f4 f4 f4 f4 f4 f4 f5 f5 f5 f5 f5 f5 f5
==================================================================
netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in defer_free+0x3c/0xbc mm/slub.c:6537
Write at addr fcf0000004003ee0 by task kworker/u8:10/2152
Pointer tag: [fc], memory tag: [fe]

CPU: 1 UID: 0 PID: 2152 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Workqueue: events_unbound bpf_map_free_deferred
Call trace:
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x78/0x90 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x108/0x61c mm/kasan/report.c:482
 kasan_report+0x88/0xac mm/kasan/report.c:595
 report_tag_fault arch/arm64/mm/fault.c:330 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:342 [inline]
 __do_kernel_fault+0x170/0x1c8 arch/arm64/mm/fault.c:384
 do_bad_area+0x68/0x78 arch/arm64/mm/fault.c:484
 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:857
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:933
 el1_abort+0x44/0x68 arch/arm64/kernel/entry-common.c:303
 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:437
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 defer_free+0x3c/0xbc mm/slub.c:6537 (P)
 do_slab_free mm/slub.c:6619 [inline]
 kfree_nolock+0x1a0/0x1d4 mm/slub.c:6930
 range_tree_destroy+0x74/0x90 kernel/bpf/range_tree.c:253
 arena_map_free+0x64/0x90 kernel/bpf/arena.c:196
 bpf_map_free kernel/bpf/syscall.c:894 [inline]
 bpf_map_free_deferred+0x70/0x180 kernel/bpf/syscall.c:921
 process_one_work+0x178/0x2cc kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x24c/0x354 kernel/workqueue.c:3421
 kthread+0x130/0x1fc kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

Allocated by task 3575:
 kasan_save_stack+0x3c/0x64 mm/kasan/common.c:56
 save_stack_info+0x40/0x158 mm/kasan/tags.c:106
 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 poison_kmalloc_redzone mm/kasan/common.c:373 [inline]
 __kasan_kmalloc+0xb4/0xb8 mm/kasan/common.c:417
 kasan_kmalloc include/linux/kasan.h:262 [inline]
 kmalloc_nolock_noprof+0x1dc/0x4fc mm/slub.c:5751
 range_tree_set+0x644/0x778 kernel/bpf/range_tree.c:237
 arena_map_alloc+0x11c/0x17c kernel/bpf/arena.c:141
 map_create+0x19c/0xa98 kernel/bpf/syscall.c:1514
 __sys_bpf+0x348/0x1a88 kernel/bpf/syscall.c:6146
 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
 __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6272
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x128 arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596

Freed by task 2152:
 kasan_save_stack+0x3c/0x64 mm/kasan/common.c:56
 save_stack_info+0x40/0x158 mm/kasan/tags.c:106
 __kasan_save_free_info+0x18/0x24 mm/kasan/tags.c:147
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x80/0x84 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 kfree_nolock+0xcc/0x1d4 mm/slub.c:6929
 range_tree_destroy+0x74/0x90 kernel/bpf/range_tree.c:253
 arena_map_free+0x64/0x90 kernel/bpf/arena.c:196
 bpf_map_free kernel/bpf/syscall.c:894 [inline]
 bpf_map_free_deferred+0x70/0x180 kernel/bpf/syscall.c:921
 process_one_work+0x178/0x2cc kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x24c/0x354 kernel/workqueue.c:3421
 kthread+0x130/0x1fc kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

The buggy address belongs to the object at fff0000004003ec0
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 32 bytes inside of
 64-byte region [fff0000004003ec0, fff0000004003f00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x44003
flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
page_type: f5(slab)
raw: 01ffc00000000000 f3f0000003001600 ffffc1ffc00f8480 dead000000000002
raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff0000004003c00: f2 f2 f2 fe fb fb fb fe f9 f9 f9 fe f2 f2 f2 fe
 fff0000004003d00: f1 f1 f1 f1 fd fd fd fe fc fc fc fe f8 f8 f8 fe
>fff0000004003e00: f3 f3 f3 f3 fb fb fb fe fd fd fd fe fe fe fe fe
                                                             ^
 fff0000004003f00: fa fa fa fe fd fd fd fe f7 f7 f7 fe f7 f7 f7 fe
 fff0000004004000: f4 f4 f4 f4 f4 f4 f4 f4 f4 f5 f5 f5 f5 f5 f5 f5
==================================================================
netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0