==================================================================
BUG: KFENCE: use-after-free write in __xfrm_state_delete+0x696/0xca0

Use-after-free write at 0xffff8881364f4030 (in kfence-#121):
 __xfrm_state_delete+0x696/0xca0
 xfrm_state_flush+0x45f/0x770
 xfrm6_tunnel_net_exit+0x3f/0x100
 ops_undo_list+0x49a/0x990
 cleanup_net+0x4c5/0x800
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x3fc/0x770
 ret_from_fork_asm+0x1a/0x30

kfence-#121: 0xffff8881364f4e00-0xffff8881364f4f87, size=392, cache=kmalloc-512

allocated by task 23764 on cpu 0 at 621.679651s (4.923471s ago):
 alloc_perf_context+0x4e/0x220
 find_get_context+0x82/0x4f0
 __se_sys_perf_event_open+0xb30/0x1d70
 do_syscall_64+0xfa/0x3b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

freed by task 23769 on cpu 1 at 621.782168s (4.834697s ago):
 rcu_core+0xcab/0x1770
 handle_softirqs+0x286/0x870
 __irq_exit_rcu+0xca/0x1f0
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
 __local_bh_enable_ip+0x135/0x1c0
 __dev_queue_xmit+0x1d79/0x3b50
 ip_finish_output2+0xd03/0x1160
 ip_output+0x2a1/0x3c0
 __ip_queue_xmit+0x1106/0x1b00
 __tcp_transmit_skb+0x2215/0x3680
 tcp_rcv_state_process+0x2a99/0x4140
 tcp_v4_do_rcv+0x3f2/0xce0
 __release_sock+0x21c/0x350
 release_sock+0x5f/0x1f0
 mptcp_sendmsg_fastopen+0x1b3/0x580
 mptcp_sendmsg+0x176c/0x1970
 __sock_sendmsg+0x19c/0x270
 ____sys_sendmsg+0x505/0x830
 ___sys_sendmsg+0x21f/0x2a0
 __x64_sys_sendmsg+0x19b/0x260
 do_syscall_64+0xfa/0x3b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 16493 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:__xfrm_state_delete+0x696/0xca0
Code: 74 34 e8 2d af 9f f7 48 83 c3 08 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ca 24 03 f8 <4c> 89 3b eb 0c e8 00 af 9f f7 eb 34 e8 f9 ae 9f f7 48 b8 00 00 00
RSP: 0018:ffffc9000b0b7790 EFLAGS: 00010246
RAX: 1ffff11026c9e806 RBX: ffff8881364f4030 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 00000000fe000400 RDI: ffff888111bcb1a8
RBP: 1ffff11022379636 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52001616ee0 R12: ffff888111bcb1b0
R13: ffff88802c93a440 R14: ffff888111bcb180 R15: ffff88801fe6e098
FS:  0000000000000000(0000) GS:ffff8881a3c1c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8881364f4030 CR3: 0000000109da2000 CR4: 00000000000006f0
DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 xfrm_state_flush+0x45f/0x770
 xfrm6_tunnel_net_exit+0x3f/0x100
 ops_undo_list+0x49a/0x990
 cleanup_net+0x4c5/0x800
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x3fc/0x770
 ret_from_fork_asm+0x1a/0x30
 </TASK>
==================================================================
