syzkaller login: [   30.653507] BUG: Bad rss-counter state mm:00000000c124db40 type:MM_FILEPAGES val:33
[   30.654817] BUG: Bad rss-counter state mm:00000000c124db40 type:MM_ANONPAGES val:22
[   30.826205] ==================================================================
[   30.827333] BUG: KASAN: slab-use-after-free in vma_interval_tree_remove+0xc75/0xec0
[   30.828507] Read of size 8 at addr ffff8880146434e0 by task sshd/221
[   30.829549] 
[   30.829767] CPU: 1 PID: 221 Comm: sshd Not tainted 6.4.0-rc7-next-20230620 #1
[   30.830659] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[   30.831694] Call Trace:
[   30.832026]  <TASK>
[   30.832323]  dump_stack_lvl+0x91/0xf0
[   30.832829]  print_report+0xcc/0x620
[   30.833329]  ? __virt_addr_valid+0x102/0x340
[   30.833890]  ? vma_interval_tree_remove+0xc75/0xec0
[   30.834516]  ? vma_interval_tree_remove+0xc75/0xec0
[   30.835149]  kasan_report+0xbe/0xf0
[   30.835642]  ? vma_interval_tree_remove+0xc75/0xec0
[   30.836274]  vma_interval_tree_remove+0xc75/0xec0
[   30.836877]  vma_prepare+0xc54/0x11a0
[   30.837361]  __split_vma+0x5af/0x950
[   30.837832]  ? __pfx___split_vma+0x10/0x10
[   30.838366]  ? find_held_lock+0x2c/0x110
[   30.838897]  do_vmi_align_munmap+0x2ba/0x11f0
[   30.839469]  ? lock_is_held_type+0x9f/0x120
[   30.840011]  ? __pfx_do_vmi_align_munmap+0x10/0x10
[   30.840647]  ? mtree_range_walk+0x632/0x900
[   30.841203]  ? mas_walk+0x5c7/0x7c0
[   30.841678]  do_vmi_munmap+0x1f1/0x2b0
[   30.842182]  mmap_region+0x1f9/0x2660
[   30.842672]  ? vm_mmap_pgoff+0x15c/0x3a0
[   30.843212]  ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10
[   30.843944]  ? __pfx_lock_acquire+0x10/0x10
[   30.844497]  ? __pfx_mmap_region+0x10/0x10
[   30.845043]  ? security_mmap_addr+0x7d/0xa0
[   30.845598]  ? get_unmapped_area+0x1f5/0x3f0
[   30.846161]  do_mmap+0x854/0xf00
[   30.846617]  vm_mmap_pgoff+0x1a6/0x3a0
[   30.847119]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[   30.847696]  ksys_mmap_pgoff+0x3af/0x500
[   30.848221]  do_syscall_64+0x3f/0x90
[   30.848719]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   30.849383] RIP: 0033:0x7f07efe2bd82
[   30.849852] Code: eb aa 66 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 33 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 56 5b 5d c3 0f 1f 00 c7 05 ae 03 01 00 16 00
[   30.852083] RSP: 002b:00007ffda7fb7408 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
[   30.853002] RAX: ffffffffffffffda RBX: 0000000000000812 RCX: 00007f07efe2bd82
[   30.853859] RDX: 0000000000000005 RSI: 0000000000001000 RDI: 00007f07ef265000
[   30.854717] RBP: 00007f07ef265000 R08: 0000000000000009 R09: 0000000000001000
[   30.855571] R10: 0000000000000812 R11: 0000000000000206 R12: 000055ed233bcb20
[   30.856486] R13: 00007ffda7fb7420 R14: 00007ffda7fb7450 R15: 00007ffda7fb77b0
[   30.857344]  </TASK>
[   30.857638] 
[   30.857855] Allocated by task 214:
[   30.858291]  kasan_save_stack+0x22/0x50
[   30.858810]  kasan_set_track+0x25/0x30
[   30.859316]  __kasan_slab_alloc+0x59/0x70
[   30.859854]  kmem_cache_alloc+0x16b/0x370
[   30.860385]  vm_area_dup+0x20/0x160
[   30.860843]  __split_vma+0x170/0x950
[   30.861316]  split_vma+0xc6/0x110
[   30.861765]  mprotect_fixup+0x8d2/0xb30
[   30.862270]  do_mprotect_pkey+0x87e/0xd40
[   30.862794]  __x64_sys_mprotect+0x78/0xc0
[   30.863324]  do_syscall_64+0x3f/0x90
[   30.863838]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   30.864713] 
[   30.864943] Freed by task 214:
[   30.865354]  kasan_save_stack+0x22/0x50
[   30.865874]  kasan_set_track+0x25/0x30
[   30.866379]  kasan_save_free_info+0x2b/0x50
[   30.866921]  __kasan_slab_free+0x10a/0x190
[   30.867473]  kmem_cache_free+0x10d/0x4d0
[   30.867996]  rcu_core+0x8c8/0x2860
[   30.868467]  __do_softirq+0x1b7/0x7d4
[   30.868958] 
[   30.869177] Last potentially related work creation:
[   30.869845]  kasan_save_stack+0x22/0x50
[   30.870362]  __kasan_record_aux_stack+0x8e/0xa0
[   30.870943]  __call_rcu_common.constprop.0+0x6a/0xb90
[   30.871593]  remove_vma+0x139/0x170
[   30.872071]  do_vmi_align_munmap+0xd4a/0x11f0
[   30.872639]  do_vmi_munmap+0x1f1/0x2b0
[   30.873138]  __vm_munmap+0x138/0x3a0
[   30.873617]  __x64_sys_munmap+0x59/0x80
[   30.874121]  do_syscall_64+0x3f/0x90
[   30.874600]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   30.875252] 
[   30.875476] The buggy address belongs to the object at ffff888014643488
[   30.875476]  which belongs to the cache vm_area_struct of size 168
[   30.876983] The buggy address is located 88 bytes inside of
[   30.876983]  freed 168-byte region [ffff888014643488, ffff888014643530)
[   30.878412] 
[   30.878632] The buggy address belongs to the physical page:
[   30.879306] page:00000000d1fd6181 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14643
[   30.880432] memcg:ffff888018267f01
[   30.880874] flags: 0x100000000000200(slab|node=0|zone=1)
[   30.881539] page_type: 0xffffffff()
[   30.881995] raw: 0100000000000200 ffff8880087a0c80 dead000000000122 0000000000000000
[   30.882940] raw: 0000000000000000 0000000000110011 00000001ffffffff ffff888018267f01
[   30.883873] page dumped because: kasan: bad access detected
[   30.884559] 
[   30.884780] Memory state around the buggy address:
[   30.885365]  ffff888014643380: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00
[   30.886253]  ffff888014643400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   30.887132] >ffff888014643480: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.887993]                                                        ^
[   30.888764]  ffff888014643500: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
[   30.889632]  ffff888014643580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.890497] ==================================================================
[   30.891425] Disabling lock debugging due to kernel taint
[   33.665473] BUG: Bad rss-counter state mm:00000000d788b6b5 type:MM_FILEPAGES val:33
[   33.666420] BUG: Bad rss-counter state mm:00000000d788b6b5 type:MM_ANONPAGES val:22
[   34.126497] BUG: Bad rss-counter state mm:000000009de95ed4 type:MM_FILEPAGES val:33
[   34.128119] BUG: Bad rss-counter state mm:000000009de95ed4 type:MM_ANONPAGES val:22
Warning: Permanently added '[localhost]:51412' (ECDSA) to the list of known hosts.
2023/06/20 11:16:53 fuzzer started
2023/06/20 11:16:53 dialing manager at localhost:36067
2023/06/20 11:16:53 checking machine...
2023/06/20 11:16:53 checking revisions...
[   34.853220] kmemleak: Automatic memory scanning thread ended
2023/06/20 11:16:53 testing simple program...
[   34.907705] cgroup: Unknown subsys name 'net'
[   34.992057] cgroup: Unknown subsys name 'rlimit'
executing program
executing program
[   43.097548] general protection fault, probably for non-canonical address 0xe0fa1c0100000021: 0000 [#1] PREEMPT SMP KASAN NOPTI
[   43.098933] KASAN: maybe wild-memory-access in range [0x07d1000800000108-0x07d100080000010f]
[   43.099940] CPU: 0 PID: 266 Comm: cron Tainted: G    B              6.4.0-rc7-next-20230620 #1
[   43.100995] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[   43.101980] RIP: 0010:__rb_insert_augmented+0x9d/0x8b0
[   43.102635] Code: c2 48 c1 ea 03 42 80 3c 2a 00 0f 85 55 05 00 00 4d 8b 74 24 08 49 39 ee 0f 84 77 01 00 00 4d 85 f6 74 1c 4c 89 f2 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 61 05 00 00 41 f6 06 01 0f 84 7a 04 00 00 48
[   43.104799] RSP: 0018:ffff888016f5f8a8 EFLAGS: 00010216
[   43.105455] RAX: ffff888019218fb8 RBX: ffff88800e258c08 RCX: ffffffff844d49f9
[   43.106311] RDX: 00fa200100000021 RSI: 0000000000000008 RDI: ffff888019fc7138
[   43.107165] RBP: ffff88800845d340 R08: ffff888019fc7138 R09: 0000000000000000
[   43.108023] R10: 0000000000000000 R11: 00000000000b6a61 R12: ffff888019fc7130
[   43.108882] R13: dffffc0000000000 R14: 07d1000800000109 R15: ffffffff816e6340
[   43.109727] FS:  00007f643ca04840(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
[   43.110686] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.111397] CR2: 0000562c92d582e8 CR3: 0000000008c7e000 CR4: 0000000000350ef0
[   43.112282] Call Trace:
[   43.112600]  <TASK>
[   43.112895]  ? die_addr+0x3c/0xa0
[   43.113336]  ? exc_general_protection+0x125/0x220
[   43.113980]  ? asm_exc_general_protection+0x26/0x30
[   43.114615]  ? __pfx_vma_interval_tree_augment_rotate+0x10/0x10
[   43.115373]  ? __rb_insert_augmented+0x5e9/0x8b0
[   43.116010]  ? __rb_insert_augmented+0x9d/0x8b0
[   43.116629]  ? __rb_insert_augmented+0x5e9/0x8b0
[   43.117257]  vma_prepare+0xa1a/0x11a0
[   43.117746]  __split_vma+0x5af/0x950
[   43.118246]  ? __pfx___split_vma+0x10/0x10
[   43.118806]  ? lock_acquire+0x434/0x4c0
[   43.119319]  do_vmi_align_munmap+0x361/0x11f0
[   43.119925]  ? __pfx_do_vmi_align_munmap+0x10/0x10
[   43.120564]  ? mtree_range_walk+0x632/0x900
[   43.121157]  ? mas_walk+0x5c7/0x7c0
[   43.121646]  do_vmi_munmap+0x1f1/0x2b0
[   43.122159]  mmap_region+0x1f9/0x2660
[   43.122651]  ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10
[   43.123392]  ? __pfx_lock_acquire+0x10/0x10
[   43.123955]  ? __pfx_mmap_region+0x10/0x10
[   43.124514]  ? security_mmap_addr+0x7d/0xa0
[   43.125073]  ? get_unmapped_area+0x1f5/0x3f0
[   43.125633]  do_mmap+0x854/0xf00
[   43.126096]  vm_mmap_pgoff+0x1a6/0x3a0
[   43.126607]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[   43.127201]  ksys_mmap_pgoff+0x3af/0x500
[   43.127720]  do_syscall_64+0x3f/0x90
[   43.128244]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   43.128914] RIP: 0033:0x7f643cd26d82
[   43.129378] Code: eb aa 66 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 33 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 56 5b 5d c3 0f 1f 00 c7 05 ae 03 01 00 16 00
[   43.131539] RSP: 002b:00007fffe4fa0938 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
[   43.132499] RAX: ffffffffffffffda RBX: 0000000000000812 RCX: 00007f643cd26d82
[   43.133372] RDX: 0000000000000005 RSI: 0000000000001000 RDI: 00007f643c5e0000
[   43.134243] RBP: 00007f643c5e0000 R08: 0000000000000009 R09: 0000000000001000
[   43.135109] R10: 0000000000000812 R11: 0000000000000206 R12: 0000562c92d57e00
[   43.136002] R13: 00007fffe4fa0950 R14: 00007fffe4fa0980 R15: 00007fffe4fa0ce0
[   43.136904]  </TASK>
[   43.137199] Modules linked in:
[   43.137653] ---[ end trace 0000000000000000 ]---
[   43.138248] RIP: 0010:__rb_insert_augmented+0x9d/0x8b0
[   43.139139] Code: c2 48 c1 ea 03 42 80 3c 2a 00 0f 85 55 05 00 00 4d 8b 74 24 08 49 39 ee 0f 84 77 01 00 00 4d 85 f6 74 1c 4c 89 f2 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 61 05 00 00 41 f6 06 01 0f 84 7a 04 00 00 48
[   43.141563] RSP: 0018:ffff888016f5f8a8 EFLAGS: 00010216
[   43.142261] RAX: ffff888019218fb8 RBX: ffff88800e258c08 RCX: ffffffff844d49f9
[   43.143373] RDX: 00fa200100000021 RSI: 0000000000000008 RDI: ffff888019fc7138
[   43.144389] RBP: ffff88800845d340 R08: ffff888019fc7138 R09: 0000000000000000
[   43.145378] R10: 0000000000000000 R11: 00000000000b6a61 R12: ffff888019fc7130
[   43.146357] R13: dffffc0000000000 R14: 07d1000800000109 R15: ffffffff816e6340
[   43.147350] FS:  00007f643ca04840(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
[   43.148545] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.149282] CR2: 0000562c92d582e8 CR3: 0000000008c7e000 CR4: 0000000000350ef0
executing program

VM DIAGNOSIS:
11:16:53  Registers:
info registers vcpu 0
RAX=0000000000000000 RBX=dffffc0000000000 RCX=0000000000000000 RDX=0000000000000001
RSI=ffffffff815a65b5 RDI=ffffc90000689051 RBP=ffff888015c37d28 RSP=ffff888015c37c60
R8 =0000000000000004 R9 =000000007fff0000 R10=000000007fff0000 R11=0000000000000000
R12=00000000000000ac R13=ffff888015c37d28 R14=00000000000000ac R15=ffffc90000689050
RIP=ffffffff815a65ca RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f4924d1e900 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f49241814b0 CR3=00000000098b2000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ffffffffffffffffffffffffffffffff XMM01=30306234386136303638616663356134
XMM02=38303062343861363036386166633561 XMM03=2f6c616e72756f6a2f676f6c2f6e7572
XMM04=31a742af2df6413200000000000ae988 XMM05=f86c4683ce2a5ab50000000000132cd8
XMM06=00c3ffa147b8d8570000000000131ac8 XMM07=00000000000000000000000000000000
XMM08=415453454d49545f454d49544c414552 XMM09=00000000000000000000000000000000
XMM10=20200000000020202020202020200000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0100000000010200 RBX=ffff8880163ed608 RCX=ffffea000058fb01 RDX=ffffea000058fb00
RSI=0000000000000008 RDI=ffffffff84535ffc RBP=0000000000000000 RSP=ffff88801caf7a38
R8 =ffff8880163ed608 R9 =0000000000000000 R10=ffffffff85d3d357 R11=00000000000c000b
R12=dffffc0000000000 R13=ffff88801caf7a78 R14=0000000000000000 R15=ffff88800e758280
RIP=ffffffff818103a7 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fc26ecb1900 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffc35bc0000 CR3=000000000d8a6000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=635f6e6f69737365733a4d41503d706f XMM01=6f6c5f6d61702c78756e696c65735f6d
XMM02=61702c74696d7265705f6d61702c7469 XMM03=655f6d61702c7374696d696c5f6d6170
XMM04=3d6c616e696d72657420322e322e302e XMM05=3d656d616e74736f682022646873732f
XMM06=746f6f72223d746363612078756e696c XMM07=6e655f6d61702c7374696d696c5f6d61
XMM08=652075253d64692073253d706f000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000