==================================================================
BUG: KASAN: slab-out-of-bounds in hlist_move_list include/linux/list.h:986 [inline]
BUG: KASAN: slab-out-of-bounds in collect_expired_timers kernel/time/timer.c:1517 [inline]
BUG: KASAN: slab-out-of-bounds in __run_timers+0x28c/0x6c4 kernel/time/timer.c:1753
Write of size 8 at addr ffff0000c9409a40 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x78/0x30c mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xec/0x15c mm/kasan/report.c:451
 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314
 hlist_move_list include/linux/list.h:986 [inline]
 collect_expired_timers kernel/time/timer.c:1517 [inline]
 __run_timers+0x28c/0x6c4 kernel/time/timer.c:1753
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:457 [inline]
 __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
 irq_exit+0x14/0x88 kernel/softirq.c:683
 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903
 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0xcc/0x418 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x1c8/0x480 kernel/sched/idle.c:306
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
 rest_init+0x360/0x390 init/main.c:755
 arch_call_rest_init+0x14/0x20 init/main.c:907
 start_kernel+0x49c/0x54c init/main.c:1154
 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468

Allocated by task 12256:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522
 kasan_kmalloc include/linux/kasan.h:264 [inline]
 __kmalloc_node_track_caller+0x234/0x3bc mm/slub.c:4968
 kmalloc_reserve+0xe4/0x26c net/core/skbuff.c:356
 __alloc_skb+0x23c/0x67c net/core/skbuff.c:427
 alloc_skb include/linux/skbuff.h:1162 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
 netlink_sendmsg+0x548/0x9cc net/netlink/af_netlink.c:1893
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x61c/0x920 net/socket.c:2436
 ___sys_sendmsg+0x1d0/0x240 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1a8/0x254 net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Freed by task 12256:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kfree+0x170/0x40c mm/slub.c:4564
 skb_free_head net/core/skbuff.c:655 [inline]
 skb_release_data+0x3c0/0x5ac net/core/skbuff.c:677
 skb_release_all net/core/skbuff.c:742 [inline]
 __kfree_skb net/core/skbuff.c:756 [inline]
 consume_skb+0x138/0x33c net/core/skbuff.c:914
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x62c/0x8b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9cc net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x61c/0x920 net/socket.c:2436
 ___sys_sendmsg+0x1d0/0x240 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1a8/0x254 net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Last potentially related work creation:
 kasan_save_stack+0x38/0x68 mm/kasan/common.c:38
 kasan_record_aux_stack+0xcc/0x114 mm/kasan/generic.c:348
 kvfree_call_rcu+0xb8/0x66c kernel/rcu/tree.c:3600
 drop_sysctl_table+0x274/0x39c fs/proc/proc_sysctl.c:1685
 drop_sysctl_table+0x294/0x39c fs/proc/proc_sysctl.c:1688
 unregister_sysctl_table+0x94/0x134 fs/proc/proc_sysctl.c:1723
 unregister_net_sysctl_table+0x20/0x30 net/sysctl_net.c:175
 neigh_sysctl_unregister+0x78/0x9c net/core/neighbour.c:3737
 devinet_sysctl_unregister net/ipv4/devinet.c:2655 [inline]
 inetdev_destroy net/ipv4/devinet.c:326 [inline]
 inetdev_event+0x5c0/0x127c net/ipv4/devinet.c:1611
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:391
 call_netdevice_notifiers_info net/core/dev.c:2049 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2061 [inline]
 call_netdevice_notifiers net/core/dev.c:2075 [inline]
 unregister_netdevice_many+0xe10/0x17d0 net/core/dev.c:11134
 default_device_exit_batch+0x444/0x4a4 net/core/dev.c:11667
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x644/0xa98 net/core/net_namespace.c:635
 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310
 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457
 kthread+0x374/0x454 kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:856

The buggy address belongs to the object at ffff0000c9409800
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 64 bytes to the right of
 512-byte region [ffff0000c9409800, ffff0000c9409a00)
The buggy address belongs to the page:
page:00000000fb1638e4 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109408
head:00000000fb1638e4 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002600
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000c9409900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000c9409980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000c9409a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff0000c9409a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000c9409b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000004
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010a17c000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 42400805 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=-c)
pc : 0x0
lr : call_timer_fn+0x19c/0x858 kernel/time/timer.c:1451
sp : ffff800008007b40
x29: ffff800008007c00 x28: 1ffff00002836729 x27: dfff800000000000
x26: ffff700001000f6c x25: ffff80001418d310 x24: 0000000000000001
x23: ffff0000c9409a38 x22: ffff800008007b80 x21: 0000000000000101
x20: ffff8000141b3948 x19: 0000000000000000 x18: 0000000000000104
x17: 0000000000000000 x16: ffff8000111cd488 x15: 00000000ffffffff
x14: 0000000000ff0100 x13: 0000000000000000 x12: 0000000000ff0100
x11: 0000000000000101 x10: 0000000000000000 x9 : ffff80000837faac
x8 : ffff8000141b3940 x7 : 0000000000000000 x6 : ffff80000837f9f0
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff8000117d91e0 x0 : ffff0000c9409a38
Call trace:
 0x0
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x46c/0x6c4 kernel/time/timer.c:1767
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:457 [inline]
 __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
 irq_exit+0x14/0x88 kernel/softirq.c:683
 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903
 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0xcc/0x418 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x1c8/0x480 kernel/sched/idle.c:306
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
 rest_init+0x360/0x390 init/main.c:755
 arch_call_rest_init+0x14/0x20 init/main.c:907
 start_kernel+0x49c/0x54c init/main.c:1154
 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468