==================================================================
BUG: KASAN: use-after-free in inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
Read of size 8 at addr ffff888018771900 by task ksoftirqd/0/11

CPU: 0 PID: 11 Comm: ksoftirqd/0 Not tainted 5.17.0-rc1-next-20220127 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 print_address_description.constprop.0+0x1f/0x190 mm/kasan/report.c:255
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
 inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
 call_timer_fn+0x182/0x600 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x666/0xa00 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1747
 __do_softirq+0x270/0x8c7 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x66f/0xa00 kernel/smpboot.c:164
 kthread+0x2f0/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 27113:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:469
 kasan_slab_alloc include/linux/kasan.h:260 [inline]
 slab_post_alloc_hook mm/slab.h:732 [inline]
 slab_alloc_node mm/slub.c:3230 [inline]
 slab_alloc mm/slub.c:3238 [inline]
 kmem_cache_alloc+0x1aa/0x480 mm/slub.c:3243
 kmem_cache_zalloc include/linux/slab.h:705 [inline]
 net_alloc net/core/net_namespace.c:407 [inline]
 copy_net_ns+0x125/0x760 net/core/net_namespace.c:462
 create_new_namespaces+0x3f6/0xb30 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x445/0x8d0 kernel/fork.c:3048
 __do_sys_unshare kernel/fork.c:3119 [inline]
 __se_sys_unshare kernel/fork.c:3117 [inline]
 __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff8880187714c0
 which belongs to the cache net_namespace of size 5056
The buggy address is located 1088 bytes inside of
 5056-byte region [ffff8880187714c0, ffff888018772880)
The buggy address belongs to the page:
page:000000009eaa9b42 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880187714c0 pfn:0x18770
head:000000009eaa9b42 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88800fd1c901
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 0000000000000000 dead000000000122 ffff88800805d640
raw: ffff8880187714c0 0000000080060002 00000001ffffffff ffff88800fd1c901
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888018771800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888018771880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888018771900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888018771980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888018771a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================