==================================================================
BUG: KASAN: use-after-free in __queue_work+0x609/0x1360 kernel/workqueue.c:2463
Read of size 8 at addr ffff88814d151c00 by task kworker/u8:4/62

CPU: 1 UID: 0 PID: 62 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 __queue_work+0x609/0x1360 kernel/workqueue.c:2463
 queue_work_on+0x106/0x1d0 kernel/workqueue.c:2599
 wg_packet_receive+0x115d/0x2350 drivers/net/wireguard/receive.c:570
 wg_receive+0x75/0xa0 drivers/net/wireguard/socket.c:325
 udp_queue_rcv_one_skb+0xfc5/0x10e0 net/ipv4/udp.c:2433
 udp_unicast_rcv_skb+0x21a/0x3a0 net/ipv4/udp.c:2621
 udp_rcv+0xf2d/0x1e60 net/ipv4/udp.c:2698
 ip_protocol_deliver_rcu+0x27e/0x440 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 __netif_receive_skb_one_core net/core/dev.c:6433 [inline]
 __netif_receive_skb net/core/dev.c:6546 [inline]
 process_backlog+0xa6b/0x18b0 net/core/dev.c:6897
 __napi_poll+0xaa/0x330 net/core/dev.c:7966
 napi_poll net/core/dev.c:8029 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8186
 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
 do_softirq+0x77/0xd0 kernel/softirq.c:569
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 wg_socket_send_skb_to_peer+0x16b/0x1d0 drivers/net/wireguard/socket.c:183
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x204/0x370 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d151
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005345448 ffffea0005345448 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88814d151b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88814d151b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88814d151c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88814d151c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88814d151d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================