R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe6cab6d9f R14: 00007f89a9b34300 R15: 0000000000022000
==================================================================
BUG: KASAN: slab-use-after-free in mas_next_slot+0x15e3/0x1ac0
Read of size 8 at addr ffff888015e98000 by task syz-executor.2/62740
CPU: 0 UID: 0 PID: 62740 Comm: syz-executor.2 Not tainted 6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_report+0xcb/0x5f0
kasan_report+0xca/0x100
mas_next_slot+0x15e3/0x1ac0
mas_find+0x355/0x730
__do_sys_mremap+0x654/0x1490
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f912fb0ab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f912d080188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f912fc1df60 RCX: 00007f912fb0ab19
RDX: 0000000000002000 RSI: 0000000000002000 RDI: 0000000020ffd000
RBP: 00007f912fb64f6d R08: 0000000020ff6000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd6c850cff R14: 00007f912d080300 R15: 0000000000022000
Allocated by task 62740:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x59/0x70
kmem_cache_alloc_noprof+0x13c/0x470
mas_alloc_nodes+0x432/0x8f0
mas_node_count_gfp+0x106/0x140
mas_preallocate+0x2af/0x690
__split_vma+0x304/0xde0
vma_modify+0x16fb/0x2030
vma_modify_policy+0x1b0/0x250
mbind_range+0x17a/0x570
do_mbind+0x7b4/0xd70
kernel_mbind+0x1e7/0x200
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 62738:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x38/0x50
kmem_cache_free+0x2a1/0x460
rcu_core+0x7c8/0x1790
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
Last potentially related work creation:
kasan_save_stack+0x24/0x50
kasan_record_aux_stack+0x89/0xa0
__call_rcu_common.constprop.0+0x70/0x960
mas_wr_node_store+0xd2c/0x1460
mas_wr_store_entry+0x11ce/0x2d40
mas_store_prealloc+0x622/0xb00
vma_complete+0xb62/0x12a0
__split_vma+0x94b/0xde0
vms_gather_munmap_vmas+0x16e/0xc60
do_vmi_align_munmap+0x25b/0x550
do_vmi_munmap+0x1eb/0x3c0
do_munmap+0xbd/0x100
mremap_to+0x242/0x420
__do_sys_mremap+0xbfb/0x1490
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888015e98000
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
freed 256-byte region [ffff888015e98000, ffff888015e98100)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15e98
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888008c7f140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888008c7f140 dead000000000100 dead000000000122
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000001 ffffea000057a601 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888015e97f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888015e97f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888015e98000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888015e98080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888015e98100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 UID: 0 PID: 62916 Comm: syz-executor.7 Tainted: G B 6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
should_fail_ex+0x4d7/0x5e0
should_failslab+0xc2/0x120
kmem_cache_alloc_noprof+0x5f/0x470
mas_alloc_nodes+0x432/0x8f0
mas_node_count_gfp+0x106/0x140
mas_preallocate+0x2af/0x690
__split_vma+0x304/0xde0
vms_gather_munmap_vmas+0x16e/0xc60
do_vmi_align_munmap+0x25b/0x550
do_vmi_munmap+0x1eb/0x3c0
do_munmap+0xbd/0x100
mremap_to+0x242/0x420
__do_sys_mremap+0xbfb/0x1490
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f89ac5beb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f89a9b34188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f89ac6d1f60 RCX: 00007f89ac5beb19
RDX: 0000000000004000 RSI: 0000000000004000 RDI: 0000000020ffc000
RBP: 00007f89a9b341d0 R08: 0000000020ff4000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe6cab6d9f R14: 00007f89a9b34300 R15: 0000000000022000