==================================================================
BUG: KASAN: slab-use-after-free in flush_tlb_func+0x24d/0x560
Write of size 8 at addr ffff888015385140 by task syz-executor.0/12182
CPU: 0 UID: 0 PID: 12182 Comm: syz-executor.0 Not tainted 6.16.0-rc4-next-20250701 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_report+0xcb/0x670
kasan_report+0xca/0x100
kasan_check_range+0x37/0x1a0
flush_tlb_func+0x24d/0x560
__flush_smp_call_function_queue+0x20d/0x740
__sysvec_call_function_single+0x6d/0x360
sysvec_call_function_single+0xa1/0xc0
asm_sysvec_call_function_single+0x1a/0x20
RIP: 0010:finish_task_switch.isra.0+0x20f/0x840
Code: 4c 89 ff 48 c7 03 00 00 00 00 e8 3c 9b 73 03 4d 85 e4 75 ba 4c 89 ff e8 9f 81 73 03 e8 fa cd 34 00 fb 65 48 8b 1d 79 ed 3b 06 <48> 8d bb f0 14 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffff88803f357360 EFLAGS: 00000202
RAX: 00000000000009df RBX: ffff888018009b80 RCX: 0000000000000040
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8146f296
RBP: ffff88803f3573a0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff86438657 R11: 0000000000000001 R12: ffff88806ce36f18
R13: ffff8880151cb700 R14: ffff88806cf36f00 R15: ffff88806ce36f00
__schedule+0xe4e/0x3520
__cond_resched+0x4c/0x80
__ext4_handle_dirty_metadata+0x3e/0x8f0
ext4_mark_iloc_dirty+0x65c/0x1bf0
ext4_orphan_del+0x3b0/0xe20
ext4_dio_write_end_io+0x571/0x710
iomap_dio_complete+0x14d/0x9e0
iomap_dio_rw+0x73/0xa0
ext4_file_write_iter+0xe0b/0x1990
iter_file_splice_write+0x927/0x10c0
direct_splice_actor+0x192/0x7b0
splice_direct_to_actor+0x347/0x9d0
do_splice_direct+0x179/0x250
do_sendfile+0xa8e/0xdc0
__x64_sys_sendfile64+0x1d3/0x210
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7febc8ccfb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007febc6245188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007febc8de2f60 RCX: 00007febc8ccfb19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007febc8d29f6d R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000c0000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff5f7570ff R14: 00007febc6245300 R15: 0000000000022000
Allocated by task 283:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x59/0x70
kmem_cache_alloc_noprof+0x13e/0x470
copy_process+0x6f3a/0x73e0
kernel_clone+0xea/0x820
__do_sys_clone+0xce/0x120
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 12192:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3c/0x90
__kasan_slab_free+0x3c/0x60
kmem_cache_free+0x2a5/0x460
mmput+0x305/0x390
do_exit+0x79d/0x2970
do_group_exit+0xd3/0x2a0
get_signal+0x2315/0x2340
arch_do_signal_or_restart+0x80/0x790
exit_to_user_mode_loop+0x8b/0x100
do_syscall_64+0x2f7/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880153847c0
which belongs to the cache mm_struct of size 2456
The buggy address is located 2432 bytes inside of
freed 2456-byte region [ffff8880153847c0, ffff888015385158)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15380
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888009c2a401
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888008c4bc80 ffffea0000742a00 dead000000000002
raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff888009c2a401
head: 0100000000000040 ffff888008c4bc80 ffffea0000742a00 dead000000000002
head: 0000000000000000 00000000800c000c 00000000f5000000 ffff888009c2a401
head: 0100000000000003 ffffea000054e001 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888015385000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888015385080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888015385100: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
^
ffff888015385180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888015385200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 4c 89 ff mov %r15,%rdi
3: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
a: e8 3c 9b 73 03 callq 0x3739b4b
f: 4d 85 e4 test %r12,%r12
12: 75 ba jne 0xffffffce
14: 4c 89 ff mov %r15,%rdi
17: e8 9f 81 73 03 callq 0x37381bb
1c: e8 fa cd 34 00 callq 0x34ce1b
21: fb sti
22: 65 48 8b 1d 79 ed 3b mov %gs:0x63bed79(%rip),%rbx # 0x63beda3
29: 06
* 2a: 48 8d bb f0 14 00 00 lea 0x14f0(%rbx),%rdi <-- trapping instruction
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 48 89 fa mov %rdi,%rdx
3e: 48 rex.W
3f: c1 .byte 0xc1