ieee802154 phy0 wpan0: encryption failed: -22
ieee802154 phy1 wpan1: encryption failed: -22
==================================================================
BUG: KASAN: use-after-free in skb_update_prio net/core/dev.c:3882 [inline]
BUG: KASAN: use-after-free in __dev_queue_xmit+0x3294/0x3710 net/core/dev.c:4144
Read of size 8 at addr ffff88809ddb0b50 by task aoe_tx0/1375

CPU: 1 PID: 1375 Comm: aoe_tx0 Not tainted 5.14.0-rc5-next-20210809-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
 skb_update_prio net/core/dev.c:3882 [inline]
 __dev_queue_xmit+0x3294/0x3710 net/core/dev.c:4144
 tx+0x68/0xb0 drivers/block/aoe/aoenet.c:63
 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1230
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the page:
page:ffffea0002776c00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9ddb0
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001e3a408 ffffea0002895e08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP|__GFP_ZERO), pid 31698, ts 1114083554553, free_ts 1116063635656
 prep_new_page mm/page_alloc.c:2424 [inline]
 get_page_from_freelist+0xa72/0x2f80 mm/page_alloc.c:4152
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5374
 __alloc_pages_node include/linux/gfp.h:566 [inline]
 alloc_pages_node include/linux/gfp.h:589 [inline]
 kmalloc_large_node+0x62/0x130 mm/slub.c:4366
 __kmalloc_node+0x2f5/0x370 mm/slub.c:4382
 kmalloc_node include/linux/slab.h:614 [inline]
 kvmalloc_node+0xb4/0xf0 mm/util.c:612
 kvmalloc include/linux/slab.h:738 [inline]
 kvzalloc include/linux/slab.h:746 [inline]
 alloc_netdev_mqs+0x98/0xe80 net/core/dev.c:10779
 slc_alloc drivers/net/can/slcan.c:537 [inline]
 slcan_open+0x323/0xcc0 drivers/net/can/slcan.c:595
 tty_ldisc_open+0x9b/0x110 drivers/tty/tty_ldisc.c:449
 tty_ldisc_reinit+0x229/0x370 drivers/tty/tty_ldisc.c:686
 tty_reopen+0x24d/0x2b0 drivers/tty/tty_io.c:1371
 tty_open_by_driver drivers/tty/tty_io.c:2092 [inline]
 tty_open+0xad8/0x1000 drivers/tty/tty_io.c:2146
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:826
 do_open fs/namei.c:3405 [inline]
 path_openat+0x1c23/0x27f0 fs/namei.c:3538
 do_filp_open+0x1aa/0x400 fs/namei.c:3565
 do_sys_openat2+0x16d/0x420 fs/open.c:1204
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1338 [inline]
 free_pcp_prepare+0x373/0x860 mm/page_alloc.c:1389
 free_unref_page_prepare mm/page_alloc.c:3315 [inline]
 free_unref_page+0x19/0x690 mm/page_alloc.c:3394
 kvfree+0x42/0x50 mm/util.c:641
 device_release+0x9f/0x240 drivers/base/core.c:2193
 kobject_cleanup lib/kobject.c:705 [inline]
 kobject_release lib/kobject.c:736 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1c8/0x540 lib/kobject.c:753
 netdev_run_todo+0x75a/0xa80 net/core/dev.c:10589
 slcan_close drivers/net/can/slcan.c:663 [inline]
 slcan_hangup+0x14c/0x1b0 drivers/net/can/slcan.c:669
 tty_ldisc_hangup+0x17e/0x680 drivers/tty/tty_ldisc.c:725
 __tty_hangup.part.0+0x40a/0x830 drivers/tty/tty_io.c:639
 __tty_hangup drivers/tty/tty_io.c:594 [inline]
 tty_vhangup drivers/tty/tty_io.c:711 [inline]
 tty_ioctl+0xf6a/0x1600 drivers/tty/tty_io.c:2745
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Memory state around the buggy address:
 ffff88809ddb0a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809ddb0a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88809ddb0b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                 ^
 ffff88809ddb0b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809ddb0c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================