==================================================================
BUG: KASAN: use-after-free in __write_once_size include/linux/compiler.h:250 [inline]
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:833 [inline]
BUG: KASAN: use-after-free in hlist_del_rcu include/linux/rculist.h:485 [inline]
BUG: KASAN: use-after-free in __change_pid+0x299/0x2b0 kernel/pid.c:344
Write of size 8 at addr ffff88800014e6f8 by task syz-executor.5/7674

CPU: 1 PID: 7674 Comm: syz-executor.5 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382
 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 __write_once_size include/linux/compiler.h:250 [inline]
 __hlist_del include/linux/list.h:833 [inline]
 hlist_del_rcu include/linux/rculist.h:485 [inline]
 __change_pid+0x299/0x2b0 kernel/pid.c:344
 __unhash_process kernel/exit.c:79 [inline]
 __exit_signal kernel/exit.c:148 [inline]
 release_task+0xd63/0x1580 kernel/exit.c:199
 wait_task_zombie kernel/exit.c:1078 [inline]
 wait_consider_task+0x2cd1/0x37a0 kernel/exit.c:1305
 do_wait_thread kernel/exit.c:1368 [inline]
 do_wait+0x442/0xa00 kernel/exit.c:1439
 kernel_wait4+0x14c/0x260 kernel/exit.c:1594
 __do_sys_wait4+0x147/0x160 kernel/exit.c:1606
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x4166ca
Code: 0f 83 6a 18 00 00 c3 66 0f 1f 84 00 00 00 00 00 8b 05 ce 1d 89 00 85 c0 75 36 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 d4 ff ff ff f7
RSP: 002b:00007ffee4329398 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 000000000011d792 RCX: 00000000004166ca
RDX: 0000000040000001 RSI: 00007ffee43293d0 RDI: ffffffffffffffff
RBP: 0000000000000d83 R08: 0000000000000001 R09: 000000000283b940
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c
R13: 00007ffee43293d0 R14: 000000000011d463 R15: 00007ffee43293e0

Allocated by task 7582:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc mm/kasan/common.c:495 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc_node mm/slab.c:3263 [inline]
 kmem_cache_alloc_node+0x13c/0x760 mm/slab.c:3575
 alloc_task_struct_node kernel/fork.c:169 [inline]
 dup_task_struct kernel/fork.c:871 [inline]
 copy_process+0x5e7/0x7110 kernel/fork.c:1924
 _do_fork+0x12d/0x1010 kernel/fork.c:2430
 __do_sys_clone+0xec/0x140 kernel/fork.c:2585
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

Freed by task 16:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kmem_cache_free+0x7f/0x320 mm/slab.c:3694
 __put_task_struct+0x22d/0x520 kernel/fork.c:754
 put_task_struct include/linux/sched/task.h:126 [inline]
 delayed_put_task_struct+0x248/0x3b0 kernel/exit.c:173
 rcu_do_batch kernel/rcu/tree.c:2206 [inline]
 rcu_core+0x59f/0x1370 kernel/rcu/tree.c:2433
 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292

The buggy address belongs to the object at ffff88800014e180
 which belongs to the cache task_struct of size 6400
The buggy address is located 1400 bytes inside of
 6400-byte region [ffff88800014e180, ffff88800014fa80)
The buggy address belongs to the page:
page:ffffea0000005380 refcount:1 mapcount:0 mapping:000000003636bc8d index:0x0 head:ffffea0000005380 order:1 compound_mapcount:0
flags: 0x7ffe0000010200(slab|head)
raw: 007ffe0000010200 ffffea00025c8188 ffffea0001293a88 ffff8880aa1eb8c0
raw: 0000000000000000 ffff88800014e180 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88800014e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88800014e600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88800014e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff88800014e700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88800014e780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================