[  428.926952][   T11] device hsr_slave_0 left promiscuous mode
[  428.933354][   T11] device hsr_slave_1 left promiscuous mode
[  428.939707][   T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  428.947612][   T11] batman_adv: batadv0: Removing interface: batadv_slave_0
[  428.956432][   T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  428.964268][   T11] batman_adv: batadv0: Removing interface: batadv_slave_1
[  428.973935][   T11] device bridge_slave_1 left promiscuous mode
[  428.980531][   T11] bridge0: port 2(bridge_slave_1) entered disabled state
[  428.989659][   T11] device bridge_slave_0 left promiscuous mode
[  428.995962][   T11] bridge0: port 1(bridge_slave_0) entered disabled state
[  429.007088][   T11] device veth1_macvtap left promiscuous mode
[  429.013175][   T11] device veth0_macvtap left promiscuous mode
[  429.019268][   T11] device veth1_vlan left promiscuous mode
[  429.025684][   T11] device veth0_vlan left promiscuous mode
[  429.149840][   T11] team0 (unregistering): Port device team_slave_1 removed
[  429.164700][   T11] team0 (unregistering): Port device team_slave_0 removed
[  429.177360][   T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  429.193361][   T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  429.247219][   T11] bond0 (unregistering): Released all slaves
[  430.382669][    C0] ==================================================================
[  430.391375][    C0] BUG: KASAN: use-after-free in tcp_write_timer_handler+0x998/0x9f0
[  430.399527][    C0] Read of size 1 at addr ffff88801ea42225 by task swapper/0/0
[  430.407425][    C0] 
[  430.409751][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-syzkaller-00838-gec53d77ae3d5 #0
[  430.419557][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[  430.429605][    C0] Call Trace:
[  430.432875][    C0]  <IRQ>
[  430.435708][    C0]  dump_stack_lvl+0xcd/0x134
[  430.440420][    C0]  print_address_description.constprop.0.cold+0xeb/0x495
[  430.447474][    C0]  ? tcp_write_timer_handler+0x998/0x9f0
[  430.453460][    C0]  kasan_report.cold+0xf4/0x1c6
[  430.458310][    C0]  ? tcp_write_timer_handler+0x998/0x9f0
[  430.463943][    C0]  tcp_write_timer_handler+0x998/0x9f0
[  430.469424][    C0]  tcp_write_timer+0xa2/0x2b0
[  430.474215][    C0]  ? tcp_write_timer_handler+0x9f0/0x9f0
[  430.479925][    C0]  call_timer_fn+0x1a5/0x6b0
[  430.484657][    C0]  ? timer_fixup_activate+0x350/0x350
[  430.490386][    C0]  ? lock_downgrade+0x6e0/0x6e0
[  430.495261][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[  430.500507][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[  430.505694][    C0]  ? tcp_write_timer_handler+0x9f0/0x9f0
[  430.511342][    C0]  __run_timers.part.0+0x679/0xa80
[  430.516898][    C0]  ? call_timer_fn+0x6b0/0x6b0
[  430.522182][    C0]  ? __wake_up_locked_sync_key+0x20/0x20
[  430.527819][    C0]  ? kvm_sched_clock_read+0x14/0x40
[  430.533063][    C0]  ? sched_clock_cpu+0x69/0x2b0
[  430.537937][    C0]  run_timer_softirq+0xb3/0x1d0
[  430.542791][    C0]  __do_softirq+0x29b/0x9c2
[  430.547410][    C0]  __irq_exit_rcu+0x123/0x180
[  430.552261][    C0]  irq_exit_rcu+0x5/0x20
[  430.556561][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[  430.562360][    C0]  </IRQ>
[  430.565311][    C0]  <TASK>
[  430.568228][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[  430.574299][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[  430.580213][    C0] Code: 89 de e8 1a 84 0e f8 84 db 75 98 e8 11 88 0e f8 e8 1c d5 14 f8 66 90 e8 05 88 0e f8 0f 00 2d ee 43 c8 00 e8 f9 87 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 44 84 0e f8 48 85 db
[  430.601206][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[  430.607880][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  430.615857][    C0] RDX: ffffffff8babc940 RSI: ffffffff896b4797 RDI: 0000000000000000
[  430.623823][    C0] RBP: ffff888145407864 R08: 0000000000000001 R09: 0000000000000001
[  430.631798][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[  430.640118][    C0] R13: ffff888145407800 R14: ffff888145407864 R15: ffff88801ad8a804
[  430.648279][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[  430.653580][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[  430.659154][    C0]  acpi_idle_enter+0x369/0x510
[  430.664038][    C0]  cpuidle_enter_state+0x1b1/0xc80
[  430.669189][    C0]  cpuidle_enter+0x4a/0xa0
[  430.673705][    C0]  do_idle+0x3e8/0x590
[  430.677762][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[  430.682861][    C0]  cpu_startup_entry+0x14/0x20
[  430.687697][    C0]  rest_init+0x169/0x270
[  430.692023][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[  430.698312][    C0]  arch_call_rest_init+0xf/0x14
[  430.703159][    C0]  start_kernel+0x46e/0x48f
[  430.707657][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[  430.713827][    C0]  </TASK>
[  430.716844][    C0] 
[  430.719438][    C0] Allocated by task 4068:
[  430.723751][    C0]  kasan_save_stack+0x1e/0x40
[  430.728482][    C0]  __kasan_slab_alloc+0x90/0xc0
[  430.733338][    C0]  kmem_cache_alloc+0x204/0x3b0
[  430.738194][    C0]  copy_net_ns+0x125/0x760
[  430.742837][    C0]  create_new_namespaces+0x3f6/0xb20
[  430.748178][    C0]  unshare_nsproxy_namespaces+0xc1/0x1f0
[  430.754151][    C0]  ksys_unshare+0x445/0x920
[  430.758891][    C0]  __x64_sys_unshare+0x2d/0x40
[  430.763757][    C0]  do_syscall_64+0x35/0x80
[  430.768200][    C0]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[  430.774108][    C0] 
[  430.776415][    C0] Freed by task 11:
[  430.780210][    C0]  kasan_save_stack+0x1e/0x40
[  430.784962][    C0]  kasan_set_track+0x21/0x30
[  430.789555][    C0]  kasan_set_free_info+0x20/0x30
[  430.794585][    C0]  ____kasan_slab_free+0x166/0x1a0
[  430.799721][    C0]  slab_free_freelist_hook+0x8b/0x1c0
[  430.805092][    C0]  kmem_cache_free+0xdd/0x5a0
[  430.809782][    C0]  cleanup_net+0x8ba/0xb00
[  430.814300][    C0]  process_one_work+0x996/0x1610
[  430.819295][    C0]  worker_thread+0x665/0x1080
[  430.824057][    C0]  kthread+0x2e9/0x3a0
[  430.828229][    C0]  ret_from_fork+0x1f/0x30
[  430.832737][    C0] 
[  430.835146][    C0] Last potentially related work creation:
[  430.840846][    C0]  kasan_save_stack+0x1e/0x40
[  430.845687][    C0]  __kasan_record_aux_stack+0xbe/0xd0
[  430.851058][    C0]  insert_work+0x48/0x350
[  430.855399][    C0]  __queue_work+0x62f/0x1150
[  430.860231][    C0]  call_timer_fn+0x1a5/0x6b0
[  430.864805][    C0]  __run_timers.part.0+0x4a3/0xa80
[  430.869914][    C0]  run_timer_softirq+0x152/0x1d0
[  430.874848][    C0]  __do_softirq+0x29b/0x9c2
[  430.879428][    C0] 
[  430.881737][    C0] Second to last potentially related work creation:
[  430.888311][    C0]  kasan_save_stack+0x1e/0x40
[  430.893056][    C0]  __kasan_record_aux_stack+0xbe/0xd0
[  430.898419][    C0]  insert_work+0x48/0x350
[  430.902765][    C0]  __queue_work+0x62f/0x1150
[  430.907352][    C0]  call_timer_fn+0x1a5/0x6b0
[  430.912052][    C0]  __run_timers.part.0+0x4a3/0xa80
[  430.917193][    C0]  run_timer_softirq+0x152/0x1d0
[  430.922133][    C0]  __do_softirq+0x29b/0x9c2
[  430.927406][    C0] 
[  430.930169][    C0] The buggy address belongs to the object at ffff88801ea41b80
[  430.930169][    C0]  which belongs to the cache net_namespace of size 6784
[  430.944644][    C0] The buggy address is located 1701 bytes inside of
[  430.944644][    C0]  6784-byte region [ffff88801ea41b80, ffff88801ea43600)
[  430.958163][    C0] 
[  430.960480][    C0] The buggy address belongs to the physical page:
[  430.966872][    C0] page:ffffea00007a9000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801ea40000 pfn:0x1ea40
[  430.978308][    C0] head:ffffea00007a9000 order:3 compound_mapcount:0 compound_pincount:0
[  430.986619][    C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  430.994904][    C0] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881400073c0
[  431.003663][    C0] raw: ffff88801ea40000 0000000080040003 00000001ffffffff 0000000000000000
[  431.012363][    C0] page dumped because: kasan: bad access detected
[  431.019209][    C0] page_owner tracks the page as allocated
[  431.024919][    C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3610, tgid 3610 (syz-executor.0), ts 44377579559, free_ts 43072972662
[  431.046489][    C0]  get_page_from_freelist+0x1290/0x3b70
[  431.052189][    C0]  __alloc_pages+0x1c7/0x510
[  431.056852][    C0]  alloc_pages+0x1aa/0x310
[  431.061303][    C0]  allocate_slab+0x26c/0x3c0
[  431.065900][    C0]  ___slab_alloc+0x9c4/0xe20
[  431.070559][    C0]  __slab_alloc.constprop.0+0x4d/0xa0
[  431.075914][    C0]  kmem_cache_alloc+0x360/0x3b0
[  431.080763][    C0]  copy_net_ns+0x125/0x760
[  431.085253][    C0]  create_new_namespaces+0x3f6/0xb20
[  431.090530][    C0]  unshare_nsproxy_namespaces+0xc1/0x1f0
[  431.096168][    C0]  ksys_unshare+0x445/0x920
[  431.100661][    C0]  __x64_sys_unshare+0x2d/0x40
[  431.105410][    C0]  do_syscall_64+0x35/0x80
[  431.109815][    C0]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[  431.115782][    C0] page last free stack trace:
[  431.120457][    C0]  free_pcp_prepare+0x549/0xd20
[  431.125312][    C0]  free_unref_page+0x19/0x6a0
[  431.130020][    C0]  __unfreeze_partials+0x17c/0x1a0
[  431.135130][    C0]  qlist_free_all+0x6a/0x170
[  431.139706][    C0]  kasan_quarantine_reduce+0x180/0x200
[  431.145156][    C0]  __kasan_slab_alloc+0xa2/0xc0
[  431.150120][    C0]  __kmalloc+0x200/0x350
[  431.154395][    C0]  tomoyo_encode2.part.0+0xe9/0x3a0
[  431.160133][    C0]  tomoyo_encode+0x28/0x50
[  431.164750][    C0]  tomoyo_mount_acl+0xe5/0x840
[  431.169536][    C0]  tomoyo_mount_permission+0x151/0x3f0
[  431.174998][    C0]  security_sb_mount+0x66/0xc0
[  431.179797][    C0]  path_mount+0x12f/0x1fa0
[  431.184226][    C0]  __x64_sys_mount+0x27f/0x300
[  431.189017][    C0]  do_syscall_64+0x35/0x80
[  431.193509][    C0]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[  431.199437][    C0] 
[  431.201763][    C0] Memory state around the buggy address:
[  431.207471][    C0]  ffff88801ea42100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  431.215689][    C0]  ffff88801ea42180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  431.223728][    C0] >ffff88801ea42200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  431.231769][    C0]                                ^
[  431.237754][    C0]  ffff88801ea42280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  431.245883][    C0]  ffff88801ea42300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  431.253922][    C0] ==================================================================
[  431.262105][    C0] Kernel panic - not syncing: panic_on_warn set ...
[  431.268702][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-syzkaller-00838-gec53d77ae3d5 #0
[  431.278523][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[  431.288591][    C0] Call Trace:
[  431.291881][    C0]  <IRQ>
[  431.294743][    C0]  dump_stack_lvl+0xcd/0x134
[  431.299400][    C0]  panic+0x2d7/0x636
[  431.303445][    C0]  ? panic_print_sys_info.part.0+0x10b/0x10b
[  431.309457][    C0]  ? tcp_write_timer_handler+0x998/0x9f0
[  431.315138][    C0]  ? tcp_write_timer_handler+0x998/0x9f0
[  431.320771][    C0]  end_report.part.0+0x3f/0x7c
[  431.325707][    C0]  kasan_report.cold+0x93/0x1c6
[  431.330546][    C0]  ? tcp_write_timer_handler+0x998/0x9f0
[  431.336167][    C0]  tcp_write_timer_handler+0x998/0x9f0
[  431.341620][    C0]  tcp_write_timer+0xa2/0x2b0
[  431.346377][    C0]  ? tcp_write_timer_handler+0x9f0/0x9f0
[  431.352084][    C0]  call_timer_fn+0x1a5/0x6b0
[  431.356667][    C0]  ? timer_fixup_activate+0x350/0x350
[  431.362024][    C0]  ? lock_downgrade+0x6e0/0x6e0
[  431.366945][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[  431.372136][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[  431.377340][    C0]  ? tcp_write_timer_handler+0x9f0/0x9f0
[  431.383051][    C0]  __run_timers.part.0+0x679/0xa80
[  431.388165][    C0]  ? call_timer_fn+0x6b0/0x6b0
[  431.392914][    C0]  ? __wake_up_locked_sync_key+0x20/0x20
[  431.398558][    C0]  ? kvm_sched_clock_read+0x14/0x40
[  431.403769][    C0]  ? sched_clock_cpu+0x69/0x2b0
[  431.408652][    C0]  run_timer_softirq+0xb3/0x1d0
[  431.413517][    C0]  __do_softirq+0x29b/0x9c2
[  431.418042][    C0]  __irq_exit_rcu+0x123/0x180
[  431.422749][    C0]  irq_exit_rcu+0x5/0x20
[  431.427009][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[  431.433545][    C0]  </IRQ>
[  431.436477][    C0]  <TASK>
[  431.439438][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[  431.445520][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[  431.451412][    C0] Code: 89 de e8 1a 84 0e f8 84 db 75 98 e8 11 88 0e f8 e8 1c d5 14 f8 66 90 e8 05 88 0e f8 0f 00 2d ee 43 c8 00 e8 f9 87 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 44 84 0e f8 48 85 db
[  431.471302][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[  431.477359][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  431.485441][    C0] RDX: ffffffff8babc940 RSI: ffffffff896b4797 RDI: 0000000000000000
[  431.493790][    C0] RBP: ffff888145407864 R08: 0000000000000001 R09: 0000000000000001
[  431.501938][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[  431.509942][    C0] R13: ffff888145407800 R14: ffff888145407864 R15: ffff88801ad8a804
[  431.518079][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[  431.523922][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[  431.529248][    C0]  acpi_idle_enter+0x369/0x510
[  431.534095][    C0]  cpuidle_enter_state+0x1b1/0xc80
[  431.539284][    C0]  cpuidle_enter+0x4a/0xa0
[  431.543772][    C0]  do_idle+0x3e8/0x590
[  431.547830][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[  431.552847][    C0]  cpu_startup_entry+0x14/0x20
[  431.557613][    C0]  rest_init+0x169/0x270
[  431.561877][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[  431.568294][    C0]  arch_call_rest_init+0xf/0x14
[  431.573147][    C0]  start_kernel+0x46e/0x48f
[  431.577675][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[  431.583584][    C0]  </TASK>
[  431.586769][    C0] Kernel Offset: disabled
[  431.591106][    C0] Rebooting in 86400 seconds..