==================================================================
BUG: KASAN: slab-use-after-free in lock_timer_base+0x1d9/0x220 kernel/time/timer.c:1051
Read of size 4 at addr ffff88804c251150 by task kworker/0:4/5994

CPU: 0 UID: 0 PID: 5994 Comm: kworker/0:4 Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:489
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 lock_timer_base+0x1d9/0x220 kernel/time/timer.c:1051
 __try_to_del_timer_sync+0x8d/0x170 kernel/time/timer.c:1505
 __timer_delete_sync+0xf4/0x1b0 kernel/time/timer.c:1666
 del_timer_sync include/linux/timer.h:185 [inline]
 sk_stop_timer_sync+0x1b/0x80 net/core/sock.c:3533
 mptcp_pm_del_add_timer+0x1ae/0x320 net/mptcp/pm_netlink.c:355
 mptcp_incoming_options+0x1f4d/0x26a0 net/mptcp/options.c:1166
 tcp_data_queue+0x187e/0x4d80 net/ipv4/tcp_input.c:5233
 tcp_rcv_established+0x7df/0x20d0 net/ipv4/tcp_input.c:6264
 tcp_v4_do_rcv+0x5ca/0xa90 net/ipv4/tcp_ipv4.c:1916
 tcp_v4_rcv+0x33b4/0x43a0 net/ipv4/tcp_ipv4.c:2351
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5672
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785
 process_backlog+0x443/0x15f0 net/core/dev.c:6117
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883
 napi_poll net/core/dev.c:6952 [inline]
 net_rx_action+0xa94/0x1010 net/core/dev.c:7074
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 do_softirq kernel/softirq.c:462 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:449
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:389
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 unlock_sock_fast include/net/sock.h:1684 [inline]
 unlock_sock_fast include/net/sock.h:1676 [inline]
 __mptcp_pm_send_ack+0x1d3/0x1f0 net/mptcp/pm_netlink.c:499
 mptcp_pm_send_ack net/mptcp/pm_netlink.c:506 [inline]
 mptcp_pm_nl_addr_send_ack+0x422/0x4b0 net/mptcp/pm_netlink.c:798
 mptcp_pm_nl_work+0x29e/0x4f0 net/mptcp/pm_netlink.c:945
 mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2783
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 14842:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 mptcp_pm_alloc_anno_list+0x1cb/0x520 net/mptcp/pm_netlink.c:380
 mptcp_pm_create_subflow_or_signal_addr+0x6c5/0x23a0 net/mptcp/pm_netlink.c:598
 mptcp_nl_add_subflow_or_signal_addr net/mptcp/pm_netlink.c:1370 [inline]
 mptcp_pm_nl_add_addr_doit+0x68b/0xc80 net/mptcp/pm_netlink.c:1442
 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2542
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2583
 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2637
 __sys_sendmsg+0x16e/0x220 net/socket.c:2669
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Freed by task 14842:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x14f/0x4b0 mm/slub.c:4761
 remove_anno_list_by_saddr net/mptcp/pm_netlink.c:1457 [inline]
 mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1678 [inline]
 mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]
 mptcp_pm_nl_flush_addrs_doit+0x526/0xeb0 net/mptcp/pm_netlink.c:1750
 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2542
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2583
 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2637
 __sys_sendmsg+0x16e/0x220 net/socket.c:2669
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

The buggy address belongs to the object at ffff88804c251100
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 80 bytes inside of
 freed 192-byte region [ffff88804c251100, ffff88804c2511c0)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4c251
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801ac423c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 12746, tgid 12746 (syz-executor), ts 293886128856, free_ts 293881630196
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2589 [inline]
 new_slab+0x2c9/0x410 mm/slub.c:2642
 ___slab_alloc+0xce2/0x1650 mm/slub.c:3830
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 __kmalloc_cache_noprof+0xf6/0x420 mm/slub.c:4324
 kmalloc_noprof include/linux/slab.h:901 [inline]
 addr_event.part.0+0x7b/0x4f0 drivers/infiniband/core/roce_gid_mgmt.c:861
 addr_event drivers/infiniband/core/roce_gid_mgmt.c:845 [inline]
 inet6addr_event+0x165/0x1e0 drivers/infiniband/core/roce_gid_mgmt.c:904
 notifier_call_chain+0xb7/0x410 kernel/notifier.c:85
 atomic_notifier_call_chain+0x71/0x1c0 kernel/notifier.c:223
 ipv6_add_addr+0x13a2/0x2010 net/ipv6/addrconf.c:1180
 addrconf_add_linklocal+0x2a6/0x620 net/ipv6/addrconf.c:3336
 addrconf_addr_gen+0x37b/0x3d0 net/ipv6/addrconf.c:3467
 addrconf_dev_config net/ipv6/addrconf.c:3513 [inline]
 addrconf_init_auto_addrs+0x446/0x820 net/ipv6/addrconf.c:3591
page last free pid 11901 tgid 11901 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0x661/0x1080 mm/page_alloc.c:2659
 vfree+0x174/0x950 mm/vmalloc.c:3383
 xt_compat_flush_offsets+0x8f/0x160 net/netfilter/x_tables.c:691
 translate_compat_table+0x128d/0x18e0 net/ipv6/netfilter/ip6_tables.c:1463
 compat_do_replace+0x35d/0x500 net/ipv4/netfilter/ip_tables.c:1525
 do_ip6t_set_ctl+0x686/0xc20 net/ipv6/netfilter/ip6_tables.c:1641
 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998
 tcp_setsockopt+0xa4/0x100 net/ipv4/tcp.c:4030
 do_sock_setsockopt+0x222/0x480 net/socket.c:2313
 __sys_setsockopt+0x1a0/0x230 net/socket.c:2338
 __do_compat_sys_socketcall+0x51c/0x700 net/compat.c:491
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Memory state around the buggy address:
 ffff88804c251000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88804c251080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff88804c251100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff88804c251180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88804c251200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================