==================================================================
BUG: KASAN: slab-use-after-free in mas_next_slot+0x15e3/0x1ac0
Read of size 8 at addr ffff8880156ec400 by task syz-executor.2/5831

CPU: 1 UID: 0 PID: 5831 Comm: syz-executor.2 Not tainted 6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xca/0x120
 print_report+0xcb/0x5f0
 kasan_report+0xca/0x100
 mas_next_slot+0x15e3/0x1ac0
 mas_find+0x355/0x730
 __do_sys_mremap+0x654/0x1490
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8979402b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8976978188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f8979515f60 RCX: 00007f8979402b19
RDX: 0000000000004000 RSI: 0000000000004000 RDI: 000000002086f000
RBP: 00007f89769781d0 R08: 0000000020874000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffde1b22c7f R14: 00007f8976978300 R15: 0000000000022000
 </TASK>

Allocated by task 5831:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_slab_alloc+0x59/0x70
 kmem_cache_alloc_noprof+0x13c/0x470
 mas_alloc_nodes+0x432/0x8f0
 mas_node_count_gfp+0x106/0x140
 mas_preallocate+0x2af/0x690
 __split_vma+0x304/0xde0
 vma_modify+0xa9c/0x2030
 vma_modify_flags+0x1b0/0x250
 mprotect_fixup+0x2c5/0xb70
 do_mprotect_pkey+0xa0f/0xd30
 __x64_sys_pkey_mprotect+0x97/0x100
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 112:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x38/0x50
 kmem_cache_free+0x2a1/0x460
 rcu_core+0x7c8/0x1790
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 asm_sysvec_apic_timer_interrupt+0x1a/0x20

Last potentially related work creation:
 kasan_save_stack+0x24/0x50
 kasan_record_aux_stack+0x89/0xa0
 __call_rcu_common.constprop.0+0x70/0x960
 mas_wr_node_store+0xd2c/0x1460
 mas_wr_store_entry+0x11ce/0x2d40
 mas_store_prealloc+0x622/0xb00
 vma_complete+0xb62/0x12a0
 __split_vma+0x94b/0xde0
 vms_gather_munmap_vmas+0x16e/0xc60
 do_vmi_align_munmap+0x25b/0x550
 do_vmi_munmap+0x1eb/0x3c0
 do_munmap+0xbd/0x100
 mremap_to+0x242/0x420
 __do_sys_mremap+0xbfb/0x1490
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880156ec400
 which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
 freed 256-byte region [ffff8880156ec400, ffff8880156ec500)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x156ec
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888008c7f140 ffffea00005edb80 dead000000000003
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888008c7f140 ffffea00005edb80 dead000000000003
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000001 ffffea000055bb01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880156ec300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880156ec380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880156ec400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8880156ec480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880156ec500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
loop4: detected capacity change from 0 to 512
loop5: detected capacity change from 0 to 256
FAT-fs (loop5): bogus number of reserved sectors
FAT-fs (loop5): Can't find a valid FAT filesystem
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop3: detected capacity change from 0 to 8336
EXT4-fs error (device loop3): __ext4_fill_super:5500: inode #2: comm syz-executor.3: iget: special inode unallocated
EXT4-fs (loop3): get root inode failed
EXT4-fs (loop3): mount failed
loop3: detected capacity change from 0 to 8336
loop1: detected capacity change from 0 to 8336
EXT4-fs error (device loop3): __ext4_fill_super:5500: inode #2: comm syz-executor.3: iget: special inode unallocated
EXT4-fs error (device loop1): __ext4_fill_super:5500: inode #2: comm syz-executor.1: iget: special inode unallocated
EXT4-fs (loop3): get root inode failed
EXT4-fs (loop3): mount failed
EXT4-fs (loop1): get root inode failed
EXT4-fs (loop1): mount failed
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 UID: 0 PID: 5864 Comm: syz-executor.2 Tainted: G    B               6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xfa/0x120
 should_fail_ex+0x4d7/0x5e0
 should_failslab+0xc2/0x120
 kmem_cache_alloc_noprof+0x5f/0x470
 mas_alloc_nodes+0x432/0x8f0
 mas_node_count_gfp+0x106/0x140
 mas_preallocate+0x2af/0x690
 __split_vma+0x304/0xde0
 vms_gather_munmap_vmas+0x16e/0xc60
 do_vmi_align_munmap+0x25b/0x550
 do_vmi_munmap+0x1eb/0x3c0
 do_munmap+0xbd/0x100
 mremap_to+0x242/0x420
 __do_sys_mremap+0xbfb/0x1490
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8979402b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8976978188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f8979515f60 RCX: 00007f8979402b19
RDX: 0000000000004000 RSI: 0000000000004000 RDI: 000000002086f000
RBP: 00007f89769781d0 R08: 0000000020874000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffde1b22c7f R14: 00007f8976978300 R15: 0000000000022000
 </TASK>
CPU: 0 UID: 0 PID: 5869 Comm: syz-executor.6 Tainted: G    B               6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xfa/0x120
 should_fail_ex+0x4d7/0x5e0
 should_failslab+0xc2/0x120
 __kmalloc_node_noprof+0xba/0x490
 __vmalloc_node_range_noprof+0x552/0x13e0
 __vmalloc_node_noprof+0xac/0xf0
 kernel_read_file+0x685/0x7b0
 init_module_from_file+0xb8/0x150
 idempotent_init_module+0x330/0x610
 __x64_sys_finit_module+0xbd/0x120
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa02aaaab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa028020188 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 00007fa02abbdf60 RCX: 00007fa02aaaab19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007fa0280201d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd529ba81f R14: 00007fa028020300 R15: 0000000000022000
 </TASK>
loop4: detected capacity change from 0 to 512
warn_alloc: 1 callbacks suppressed
syz-executor.6: vmalloc error: size 69632, failed to allocated page array size 136, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null)
loop1: detected capacity change from 0 to 8336
,cpuset=/,mems_allowed=0
CPU: 0 UID: 0 PID: 5869 Comm: syz-executor.6 Tainted: G    B               6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xfa/0x120
 warn_alloc+0x211/0x360
 __vmalloc_node_range_noprof+0xf90/0x13e0
 __vmalloc_node_noprof+0xac/0xf0
 kernel_read_file+0x685/0x7b0
 init_module_from_file+0xb8/0x150
 idempotent_init_module+0x330/0x610
 __x64_sys_finit_module+0xbd/0x120
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa02aaaab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa028020188 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 00007fa02abbdf60 RCX: 00007fa02aaaab19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007fa0280201d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd529ba81f R14: 00007fa028020300 R15: 0000000000022000
 </TASK>
Mem-Info:
active_anon:53 inactive_anon:45625 isolated_anon:0
 active_file:8477 inactive_file:39972 isolated_file:0
 unevictable:0 dirty:172 writeback:0
 slab_reclaimable:5413 slab_unreclaimable:52768
 mapped:80982 shmem:97 pagetables:3085
 sec_pagetables:0 bounce:0
 kernel_misc_reclaimable:0
 free:178658 free_pcp:859 free_cma:0
Node 0 active_anon:212kB inactive_anon:182500kB active_file:33908kB inactive_file:159888kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:323928kB dirty:688kB writeback:0kB shmem:388kB kernel_stack:6208kB pagetables:12424kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
loop5: detected capacity change from 0 to 256
Node 0 DMA free:15360kB boost:0kB min:44kB low:56kB high:68kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]: 0 1601 1601 1601
Node 0 DMA32 free:699272kB boost:0kB min:5076kB low:6700kB high:8324kB reserved_highatomic:0KB free_highatomic:0KB active_anon:212kB inactive_anon:182584kB active_file:33908kB inactive_file:159804kB unevictable:0kB writepending:688kB present:2080640kB managed:1639644kB mlocked:0kB bounce:0kB free_pcp:3164kB local_pcp:1976kB free_cma:0kB
lowmem_reserve[]: 0 0 0 0
Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
Node 0 DMA32: 19*4kB (E) 14*8kB (ME) 32*16kB (UME) 159*32kB (UME) 19*64kB (UME) 4*128kB (UE) 1*256kB (M) 2*512kB (UE) 2*1024kB (UE) 2*2048kB (UM) 167*4096kB (UM) = 698972kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
21002 total pagecache pages
0 pages in swap cache
Free swap  = 0kB
Total swap = 0kB
524158 pages RAM
0 pages HighMem/MovableOnly
110407 pages reserved
EXT4-fs error (device loop1): __ext4_fill_super:5500: inode #2: comm syz-executor.1: iget: special inode unallocated
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
EXT4-fs (loop1): get root inode failed
EXT4-fs (loop1): mount failed
loop3: detected capacity change from 0 to 8336
FAT-fs (loop5): bogus number of reserved sectors
FAT-fs (loop5): Can't find a valid FAT filesystem
EXT4-fs error (device loop3): __ext4_fill_super:5500: inode #2: comm syz-executor.3: iget: special inode unallocated
EXT4-fs (loop3): get root inode failed
EXT4-fs (loop3): mount failed
EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop5: detected capacity change from 0 to 256
FAT-fs (loop5): bogus number of reserved sectors
FAT-fs (loop5): Can't find a valid FAT filesystem