FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
==================================================================
BUG: KASAN: slab-use-after-free in mas_next_slot+0x15e3/0x1ac0
Read of size 8 at addr ffff888015f0b600 by task syz-executor.6/86291

CPU: 0 UID: 0 PID: 86291 Comm: syz-executor.6 Not tainted 6.16.0-rc6-next-20250716 #1 PREEMPT(voluntary) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xca/0x120
 print_report+0xcb/0x5f0
 kasan_report+0xca/0x100
 mas_next_slot+0x15e3/0x1ac0
 mas_find+0x355/0x730
 __do_sys_mremap+0x654/0x1490
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa312ceeb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa310264188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007fa312e01f60 RCX: 00007fa312ceeb19
RDX: 0000000000004000 RSI: 0000000000004000 RDI: 000000002086f000
RBP: 00007fa312d48f6d R08: 0000000020874000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc2dea6faf R14: 00007fa310264300 R15: 0000000000022000
 </TASK>

Allocated by task 86291:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_slab_alloc+0x59/0x70
 kmem_cache_alloc_noprof+0x13c/0x470
 mas_alloc_nodes+0x432/0x8f0
 mas_node_count_gfp+0x106/0x140
 mas_preallocate+0x2af/0x690
 __split_vma+0x304/0xde0
 vma_modify+0xa9c/0x2030
 vma_modify_flags+0x1b0/0x250
 mprotect_fixup+0x2c5/0xb70
 do_mprotect_pkey+0xa0f/0xd30
 __x64_sys_pkey_mprotect+0x97/0x100
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 12:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x38/0x50
 kmem_cache_free+0x2a1/0x460
 rcu_core+0x7c8/0x1790
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 asm_sysvec_apic_timer_interrupt+0x1a/0x20

Last potentially related work creation:
 kasan_save_stack+0x24/0x50
 kasan_record_aux_stack+0x89/0xa0
 __call_rcu_common.constprop.0+0x70/0x960
 mas_wr_node_store+0xd2c/0x1460
 mas_wr_store_entry+0x11ce/0x2d40
 mas_store_prealloc+0x622/0xb00
 vma_complete+0xb62/0x12a0
 __split_vma+0x94b/0xde0
 vms_gather_munmap_vmas+0x16e/0xc60
 do_vmi_align_munmap+0x25b/0x550
 do_vmi_munmap+0x1eb/0x3c0
 do_munmap+0xbd/0x100
 mremap_to+0x242/0x420
 __do_sys_mremap+0xbfb/0x1490
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888015f0b600
 which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
 freed 256-byte region [ffff888015f0b600, ffff888015f0b700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15f0a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888008c7f140 ffffea00005e5980 dead000000000005
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888008c7f140 ffffea00005e5980 dead000000000005
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0100000000000001 ffffea000057c281 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888015f0b500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888015f0b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888015f0b600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888015f0b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888015f0b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=90657 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=90781 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=90897 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=90955 comm=syz-executor.5
No source specified
No source specified
No source specified
No source specified
No source specified