==================================================================
BUG: KASAN: use-after-free in hlist_move_list include/linux/list.h:986 [inline]
BUG: KASAN: use-after-free in collect_expired_timers kernel/time/timer.c:1517 [inline]
BUG: KASAN: use-after-free in __run_timers+0x28c/0x6c4 kernel/time/timer.c:1753
Write of size 8 at addr ffff0000d7f61a40 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x78/0x30c mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xec/0x15c mm/kasan/report.c:451
 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314
 hlist_move_list include/linux/list.h:986 [inline]
 collect_expired_timers kernel/time/timer.c:1517 [inline]
 __run_timers+0x28c/0x6c4 kernel/time/timer.c:1753
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:457 [inline]
 __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
 irq_exit+0x14/0x88 kernel/softirq.c:683
 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903
 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0xcc/0x418 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x1c8/0x480 kernel/sched/idle.c:306
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
 rest_init+0x360/0x390 init/main.c:741
 arch_call_rest_init+0x14/0x20 init/main.c:893
 start_kernel+0x49c/0x54c init/main.c:1140
 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468

The buggy address belongs to the page:
page:000000004d45af7c refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117f61
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 ffffffff00000201 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d7f61900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d7f61980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d7f61a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                           ^
 ffff0000d7f61a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d7f61b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Unable to handle kernel paging request at virtual address dfff800000000038
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000038] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __queue_work+0x1c0/0x1054 kernel/workqueue.c:1452
lr : __queue_work+0x118/0x1054 kernel/workqueue.c:1448
sp : ffff800008007a10
x29: ffff800008007a50 x28: 1ffff00002834711 x27: 0000000000000000
x26: 0000000000000008 x25: dfff800000000000 x24: 00000000000001c0
x23: 0000000000000038 x22: 0000000000000000 x21: 0000000000000008
x20: 0000000000000000 x19: ffff0000d7f617c0 x18: 0000000000000104
x17: 0000000000000000 x16: ffff8000111cbe1c x15: 00000000ffffffff
x14: 0000000000ff0100 x13: 0000000000000000 x12: 0000000000ff0100
x11: 0000000000000101 x10: 0000000000000000 x9 : ffff8000081e7240
x8 : ffff8000141a3880 x7 : 0000000000000000 x6 : ffff80000837f9f0
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000081e7034
x2 : ffff0000d7f617c0 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __queue_work+0x1c0/0x1054 kernel/workqueue.c:1452
 queue_work_on+0xc4/0x17c kernel/workqueue.c:1559
 queue_work include/linux/workqueue.h:512 [inline]
 ieee80211_queue_work+0xb4/0x138 net/mac80211/util.c:924
 ieee80211_ibss_timer+0x44/0x54 net/mac80211/ibss.c:1729
 call_timer_fn+0x19c/0x858 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x46c/0x6c4 kernel/time/timer.c:1767
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:457 [inline]
 __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
 irq_exit+0x14/0x88 kernel/softirq.c:683
 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903
 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0xcc/0x418 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x1c8/0x480 kernel/sched/idle.c:306
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
 rest_init+0x360/0x390 init/main.c:741
 arch_call_rest_init+0x14/0x20 init/main.c:893
 start_kernel+0x49c/0x54c init/main.c:1140
 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468
Code: 350055d7 940a4850 91070378 d343ff17 (38f96ae8) 
---[ end trace f1f62d62750b5277 ]---
----------------
Code disassembly (best guess):
   0:	350055d7 	cbnz	w23, 0xab8
   4:	940a4850 	bl	0x292144
   8:	91070378 	add	x24, x27, #0x1c0
   c:	d343ff17 	lsr	x23, x24, #3
* 10:	38f96ae8 	ldrsb	w8, [x23, x25] <-- trapping instruction