==================================================================
BUG: KASAN: slab-use-after-free in mas_next_slot+0x15e3/0x1ac0
Read of size 8 at addr ffff888008fd4c00 by task syz-executor.2/105045
CPU: 1 UID: 0 PID: 105045 Comm: syz-executor.2 Not tainted 6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_report+0xcb/0x5f0
kasan_report+0xca/0x100
mas_next_slot+0x15e3/0x1ac0
mas_find+0x355/0x730
__do_sys_mremap+0x638/0x12d0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9406adcb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9404052188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f9406beff60 RCX: 00007f9406adcb19
RDX: 0000000000004000 RSI: 0000000000004000 RDI: 0000000020ffc000
RBP: 00007f9406b36f6d R08: 0000000020ff4000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc1dbe109f R14: 00007f9404052300 R15: 0000000000022000
Allocated by task 105045:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x59/0x70
kmem_cache_alloc_noprof+0x13c/0x470
mas_alloc_nodes+0x432/0x8f0
mas_node_count_gfp+0x106/0x140
mas_preallocate+0x2af/0x690
__split_vma+0x304/0xde0
vma_modify+0xa9c/0x2030
vma_modify_flags+0x1b0/0x250
mlock_fixup+0x1b5/0xda0
apply_vma_lock_flags+0x252/0x380
do_mlock+0x2ac/0x800
__x64_sys_mlock+0x59/0x80
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x38/0x50
kmem_cache_free+0x2a1/0x460
rcu_core+0x7c8/0x1790
handle_softirqs+0x1b1/0x770
run_ksoftirqd+0x2e/0x60
smpboot_thread_fn+0x41d/0x9d0
kthread+0x3c8/0x740
ret_from_fork+0x34b/0x430
ret_from_fork_asm+0x1a/0x30
Last potentially related work creation:
kasan_save_stack+0x24/0x50
kasan_record_aux_stack+0x89/0xa0
__call_rcu_common.constprop.0+0x70/0x960
mas_topiary_replace+0xdbf/0x1ed0
mas_split+0xa8e/0x1590
mas_commit_b_node.isra.0+0x72/0xb0
mas_wr_bnode+0x12d/0x1b0
mas_wr_store_entry+0x940/0x2d40
mas_store_prealloc+0x622/0xb00
vma_complete+0xb62/0x12a0
__split_vma+0x94b/0xde0
vms_gather_munmap_vmas+0x16e/0xc60
do_vmi_align_munmap+0x25b/0x550
do_vmi_munmap+0x1eb/0x3c0
do_munmap+0xbd/0x100
mremap_to+0x242/0x460
__do_sys_mremap+0x9f2/0x12d0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888008fd4c00
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
freed 256-byte region [ffff888008fd4c00, ffff888008fd4d00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8fd4
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888008c7f140 ffffea0000353a80 dead000000000002
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888008c7f140 ffffea0000353a80 dead000000000002
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000001 ffffea000023f501 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888008fd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888008fd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888008fd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888008fd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888008fd4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
loop7: detected capacity change from 0 to 136
isofs_fill_super: bread failed, dev=loop7, iso_blknum=34, block=68
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
CPU: 0 UID: 0 PID: 105057 Comm: syz-executor.3 Tainted: G B 6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
should_fail_ex+0x4d7/0x5e0
_copy_to_user+0x32/0xd0
simple_read_from_buffer+0xe0/0x180
proc_fail_nth_read+0x189/0x270
vfs_read+0x1eb/0xbe0
ksys_read+0x121/0x240
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f232c7bb69c
Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
RSP: 002b:00007f2329d7e170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000000000000002a RCX: 00007f232c7bb69c
RDX: 000000000000000f RSI: 00007f2329d7e1e0 RDI: 0000000000000003
RBP: 00007f2329d7e1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffb3f24e8f R14: 00007f2329d7e300 R15: 0000000000022000
loop7: detected capacity change from 0 to 128
isofs_fill_super: bread failed, dev=loop7, iso_blknum=32, block=64