loop1: detected capacity change from 0 to 221
nfs4: Unknown parameter '.pending_reads'
FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
==================================================================
BUG: KASAN: use-after-free in inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
Read of size 8 at addr ffff88804094c280 by task ksoftirqd/1/17

CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 5.17.0-rc1-next-20220127 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 print_address_description.constprop.0+0x1f/0x190 mm/kasan/report.c:255
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
 inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
 call_timer_fn+0x182/0x600 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x666/0xa00 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1747
 __do_softirq+0x270/0x8c7 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x66f/0xa00 kernel/smpboot.c:164
 kthread+0x2f0/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 287:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:469
 kasan_slab_alloc include/linux/kasan.h:260 [inline]
 slab_post_alloc_hook mm/slab.h:732 [inline]
 slab_alloc_node mm/slub.c:3230 [inline]
 slab_alloc mm/slub.c:3238 [inline]
 kmem_cache_alloc+0x1aa/0x480 mm/slub.c:3243
 kmem_cache_zalloc include/linux/slab.h:705 [inline]
 net_alloc net/core/net_namespace.c:407 [inline]
 copy_net_ns+0x125/0x760 net/core/net_namespace.c:462
 create_new_namespaces+0x3f6/0xb30 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x445/0x8d0 kernel/fork.c:3048
 __do_sys_unshare kernel/fork.c:3119 [inline]
 __se_sys_unshare kernel/fork.c:3117 [inline]
 __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff88804094be40
 which belongs to the cache net_namespace of size 5056
The buggy address is located 1088 bytes inside of
 5056-byte region [ffff88804094be40, ffff88804094d200)
The buggy address belongs to the page:
page:00000000a77067ed refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804094be40 pfn:0x40948
head:00000000a77067ed order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88800c4bd501
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 0000000000000000 dead000000000001 ffff88800805d640
raw: ffff88804094be40 0000000080060004 00000001ffffffff ffff88800c4bd501
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88804094c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804094c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804094c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88804094c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804094c380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================