==================================================================
BUG: KASAN: slab-use-after-free in timer_is_static_object+0x80/0x90 kernel/time/timer.c:691
Read of size 8 at addr ffff88806fc7a038 by task kworker/2:4/10164

CPU: 2 UID: 0 PID: 10164 Comm: kworker/2:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 timer_is_static_object+0x80/0x90 kernel/time/timer.c:691
 lookup_object_or_alloc.part.0+0x420/0x590 lib/debugobjects.c:679
 lookup_object_or_alloc lib/debugobjects.c:665 [inline]
 debug_object_assert_init+0x266/0x2f0 lib/debugobjects.c:1008
 debug_timer_assert_init kernel/time/timer.c:803 [inline]
 debug_assert_init kernel/time/timer.c:848 [inline]
 __try_to_del_timer_sync+0x7f/0x170 kernel/time/timer.c:1457
 __timer_delete_sync+0xf4/0x1b0 kernel/time/timer.c:1620
 sk_stop_timer_sync+0x1b/0x80 net/core/sock.c:3622
 mptcp_pm_del_add_timer+0x1ae/0x320 net/mptcp/pm.c:341
 mptcp_incoming_options+0x1ecd/0x2630 net/mptcp/options.c:1174
 tcp_data_queue+0x191a/0x4f90 net/ipv4/tcp_input.c:5154
 tcp_rcv_established+0x88c/0x23f0 net/ipv4/tcp_input.c:6216
 tcp_v4_do_rcv+0x5ca/0xa90 net/ipv4/tcp_ipv4.c:1926
 tcp_v4_rcv+0x2ee1/0x4640 net/ipv4/tcp_ipv4.c:2368
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x3f2/0x720 net/ipv4/ip_input.c:239
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:260
 dst_input include/net/dst.h:471 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:454 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip_rcv+0x2e0/0x600 net/ipv4/ip_input.c:574
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5991
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6104
 process_backlog+0x442/0x15e0 net/core/dev.c:6456
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:7506
 napi_poll net/core/dev.c:7569 [inline]
 net_rx_action+0xa9f/0xfe0 net/core/dev.c:7696
 handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
 do_softirq kernel/softirq.c:480 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:467
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:407
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 unlock_sock_fast include/net/sock.h:1730 [inline]
 unlock_sock_fast include/net/sock.h:1722 [inline]
 __mptcp_pm_send_ack+0x1d3/0x1f0 net/mptcp/pm.c:202
 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]
 mptcp_pm_addr_send_ack+0x422/0x4b0 net/mptcp/pm.c:228
 mptcp_pm_worker+0x272/0x300 net/mptcp/pm.c:978
 mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2726
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 10164:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
 kmalloc_noprof include/linux/slab.h:905 [inline]
 mptcp_pm_alloc_anno_list+0x1e3/0x4d0 net/mptcp/pm.c:365
 mptcp_pm_create_subflow_or_signal_addr+0x692/0x1e00 net/mptcp/pm_kernel.c:318
 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:372 [inline]
 __mptcp_pm_kernel_worker+0x129/0x1e0 net/mptcp/pm_kernel.c:1351
 mptcp_pm_worker+0x126/0x300 net/mptcp/pm.c:984
 mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2726
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 15583:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:243 [inline]
 __kasan_slab_free+0x60/0x70 mm/kasan/common.c:275
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2422 [inline]
 slab_free mm/slub.c:4695 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4894
 mptcp_remove_anno_list_by_saddr+0x29/0x40 net/mptcp/pm.c:158
 mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1032 [inline]
 mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1063 [inline]
 mptcp_pm_nl_flush_addrs_doit+0x567/0xb20 net/mptcp/pm_kernel.c:1103
 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg net/socket.c:729 [inline]
 ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614
 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
 __sys_sendmsg+0x16d/0x220 net/socket.c:2700
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

The buggy address belongs to the object at ffff88806fc7a000
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 56 bytes inside of
 freed 192-byte region [ffff88806fc7a000, ffff88806fc7a0c0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6fc7a
ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801b8423c0 ffffea000081f880 0000000000000003
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 15494, tgid 15482 (syz.7.2459), ts 481708954722, free_ts 475482999597
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
 prep_new_page mm/page_alloc.c:1859 [inline]
 get_page_from_freelist+0x132b/0x38e0 mm/page_alloc.c:3858
 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:5148
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:2492 [inline]
 allocate_slab mm/slub.c:2660 [inline]
 new_slab+0x247/0x330 mm/slub.c:2714
 ___slab_alloc+0xcf2/0x1750 mm/slub.c:3901
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3992
 __slab_alloc_node mm/slub.c:4067 [inline]
 slab_alloc_node mm/slub.c:4228 [inline]
 __do_kmalloc_node mm/slub.c:4375 [inline]
 __kmalloc_node_track_caller_noprof+0x2ee/0x510 mm/slub.c:4395
 kmemdup_noprof+0x29/0x60 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:765 [inline]
 neigh_parms_alloc+0x85/0x5d0 net/core/neighbour.c:1748
 ipv6_add_dev+0x3c4/0x15f0 net/ipv6/addrconf.c:403
 addrconf_notify+0x53e/0x19e0 net/ipv6/addrconf.c:3650
 notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2229
 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
 call_netdevice_notifiers net/core/dev.c:2281 [inline]
 register_netdevice+0x182e/0x2270 net/core/dev.c:11244
 register_netdev+0x34/0x50 net/core/dev.c:11322
page last free pid 15303 tgid 15302 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0x7d5/0x10f0 mm/page_alloc.c:2895
 comedi_buf_map_kref_release drivers/comedi/comedi_buf.c:40 [inline]
 kref_put include/linux/kref.h:65 [inline]
 comedi_buf_map_put.part.0+0x46a/0x620 drivers/comedi/comedi_buf.c:151
 comedi_buf_map_put drivers/comedi/comedi_buf.c:236 [inline]
 __comedi_buf_free drivers/comedi/comedi_buf.c:62 [inline]
 comedi_buf_alloc+0x1b4/0x9d0 drivers/comedi/comedi_buf.c:224
 comedi_device_detach_cleanup drivers/comedi/drivers.c:170 [inline]
 comedi_device_detach_locked+0x27e/0xa50 drivers/comedi/drivers.c:208
 do_devconfig_ioctl+0x555/0x710 drivers/comedi/comedi_fops.c:848
 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178
 comedi_compat_ioctl+0x1d0/0x990 drivers/comedi/comedi_fops.c:3249
 __do_compat_sys_ioctl fs/ioctl.c:696 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:639 [inline]
 __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:639
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Memory state around the buggy address:
 ffff88806fc79f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88806fc79f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88806fc7a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff88806fc7a080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88806fc7a100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================