9pnet_fd: p9_fd_create_tcp (12380): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12380): problem connecting socket to 127.0.0.1 No source specified No source specified ================================================================== BUG: KASAN: slab-use-after-free in mas_next_slot+0x15e3/0x1ac0 Read of size 8 at addr ffff888016aa5200 by task syz-executor.1/12385 CPU: 0 UID: 0 PID: 12385 Comm: syz-executor.1 Not tainted 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: dump_stack_lvl+0xca/0x120 print_report+0xcb/0x5f0 kasan_report+0xca/0x100 mas_next_slot+0x15e3/0x1ac0 mas_find+0x355/0x730 __do_sys_mremap+0x654/0x1490 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f86c93e4b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f86c695a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f86c94f7f60 RCX: 00007f86c93e4b19 RDX: 0000000000004000 RSI: 0000000000004000 RDI: 0000000020ffc000 RBP: 00007f86c943ef6d R08: 0000000020ff4000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff6601845f R14: 00007f86c695a300 R15: 0000000000022000 program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO Allocated by task 12385: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x59/0x70 kmem_cache_alloc_noprof+0x13c/0x3d0 mas_alloc_nodes+0x432/0x8f0 mas_node_count_gfp+0x106/0x140 mas_preallocate+0x2af/0x690 __split_vma+0x304/0xde0 vma_modify+0xa9c/0x2030 vma_modify_flags+0x1b0/0x250 mlock_fixup+0x1b5/0xda0 apply_vma_lock_flags+0x252/0x380 do_mlock+0x2ac/0x800 __x64_sys_mlock+0x59/0x80 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12382: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x38/0x50 kmem_cache_free+0x2a1/0x460 rcu_core+0x7c8/0x17a0 handle_softirqs+0x1b1/0x770 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 Last potentially related work creation: kasan_save_stack+0x24/0x50 kasan_record_aux_stack+0x89/0xa0 __call_rcu_common.constprop.0+0x70/0x960 mas_topiary_replace+0xdbf/0x1ed0 mas_split+0xa8e/0x1590 mas_commit_b_node.isra.0+0x72/0xb0 mas_wr_bnode+0x12d/0x1b0 mas_wr_store_entry+0x940/0x2d40 mas_store_prealloc+0x622/0xb00 vma_complete+0xb62/0x12a0 __split_vma+0x94b/0xde0 vms_gather_munmap_vmas+0x16e/0xc60 do_vmi_align_munmap+0x25b/0x550 do_vmi_munmap+0x1eb/0x3c0 do_munmap+0xbd/0x100 mremap_to+0x242/0x420 __do_sys_mremap+0xbfb/0x1490 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888016aa5200 which belongs to the cache maple_node of size 256 The buggy address is located 0 bytes inside of freed 256-byte region [ffff888016aa5200, ffff888016aa5300) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16aa4 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888008c7f140 ffffea00005af600 dead000000000003 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888008c7f140 ffffea00005af600 dead000000000003 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0100000000000001 ffffea00005aa901 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888016aa5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888016aa5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888016aa5200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888016aa5280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888016aa5300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== hpet: Lost 5 RTC interrupts 9pnet_fd: p9_fd_create_tcp (12398): problem connecting socket to 127.0.0.1 No source specified No source specified 9pnet_fd: p9_fd_create_tcp (12402): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12402): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12422): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12422): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12426): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12428): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12434): problem connecting socket to 127.0.0.1 No source specified 9pnet_fd: p9_fd_create_tcp (12434): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12444): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12445): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12447): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12450): problem connecting socket to 127.0.0.1 ext4: Unknown parameter 'ÿÿÿÿÿÿÿÿ' ext4: Unknown parameter 'ÿÿÿÿÿÿÿÿ' 9pnet_fd: p9_fd_create_tcp (12456): problem connecting socket to 127.0.0.1 9pnet_fd: p9_fd_create_tcp (12459): problem connecting socket to 127.0.0.1