audit: type=1326 audit(1688788283.833:12): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=4666 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f86eb064b19 code=0x0
==================================================================
BUG: KASAN: slab-use-after-free in shrink_folio_list+0x141d/0x37d0
Read of size 8 at addr ffff88801be2f0d1 by task syz-executor.3/4664

CPU: 1 PID: 4664 Comm: syz-executor.3 Not tainted 6.4.0-next-20230706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x91/0xf0
 print_report+0xcc/0x620
 kasan_report+0xbe/0xf0
 kasan_check_range+0x39/0x1b0
 shrink_folio_list+0x141d/0x37d0
 reclaim_folio_list+0xc4/0x300
 reclaim_pages+0x377/0x520
 madvise_cold_or_pageout_pte_range+0xc9c/0xf90
 walk_pgd_range+0xcc3/0x1740
 __walk_page_range+0x5f6/0x720
 walk_page_range+0x316/0x4b0
 madvise_pageout+0x30b/0x580
 madvise_vma_behavior+0x413/0x20a0
 do_madvise.part.0+0x39a/0x650
 __x64_sys_madvise+0x10c/0x160
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
RIP: 0033:0x7fa730641b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa72dbb7188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007fa730754f60 RCX: 00007fa730641b19
RDX: 0000000000000015 RSI: 0000000000004000 RDI: 0000000020ffa000
RBP: 00007fa73069bf6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff2a715c1f R14: 00007fa72dbb7300 R15: 0000000000022000
 </TASK>

Allocated by task 4610:
 kasan_save_stack+0x22/0x50
 kasan_set_track+0x25/0x30
 __kasan_kmalloc+0x7f/0x90
 __kmalloc_node+0x5d/0x160
 kvmalloc_node+0xaa/0x200
 simple_xattr_alloc+0x47/0xa0
 shmem_initxattrs+0x161/0x220
 security_inode_init_security+0x1ab/0x360
 shmem_mknod+0xd7/0x220
 lookup_open.isra.0+0x1028/0x1400
 path_openat+0x96c/0x2710
 do_filp_open+0x1ba/0x410
 do_sys_openat2+0x164/0x1d0
 __x64_sys_openat+0x143/0x200
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Freed by task 4610:
 kasan_save_stack+0x22/0x50
 kasan_set_track+0x25/0x30
 kasan_save_free_info+0x2b/0x50
 __kasan_slab_free+0x10a/0x190
 __kmem_cache_free+0xe1/0x330
 kvfree+0x46/0x50
 simple_xattrs_free+0x6d/0x90
 shmem_evict_inode+0xdf/0x9c0
 evict+0x284/0x610
 iput.part.0+0x4d2/0x6f0
 iput+0x5c/0x80
 dentry_unlink_inode+0x2b4/0x460
 __dentry_kill+0x36f/0x5c0
 dput+0x6c3/0xe60
 do_renameat2+0x554/0xc20
 __x64_sys_rename+0x81/0xa0
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Last potentially related work creation:
 kasan_save_stack+0x22/0x50
 __kasan_record_aux_stack+0x8e/0xa0
 kvfree_call_rcu+0x29/0x900
 cfg80211_update_known_bss+0x822/0xa70
 __cfg80211_bss_update+0xd5/0x20b0
 cfg80211_inform_single_bss_frame_data+0x73d/0xf90
 cfg80211_inform_bss_frame_data+0xc2/0x290
 ieee80211_bss_info_update+0x371/0x9b0
 ieee80211_ibss_rx_queued_mgmt+0x198e/0x2e70
 ieee80211_iface_work+0x9bf/0xcb0
 cfg80211_wiphy_work+0x1f7/0x290
 process_one_work+0xabf/0x1770
 worker_thread+0x64f/0x12a0
 kthread+0x33f/0x440
 ret_from_fork+0x2c/0x50

Second to last potentially related work creation:
 kasan_save_stack+0x22/0x50
 __kasan_record_aux_stack+0x8e/0xa0
 kvfree_call_rcu+0x29/0x900
 cfg80211_update_known_bss+0x822/0xa70
 __cfg80211_bss_update+0xd5/0x20b0
 cfg80211_inform_single_bss_frame_data+0x73d/0xf90
 cfg80211_inform_bss_frame_data+0xc2/0x290
 ieee80211_bss_info_update+0x371/0x9b0
 ieee80211_ibss_rx_queued_mgmt+0x198e/0x2e70
 ieee80211_iface_work+0x9bf/0xcb0
 cfg80211_wiphy_work+0x1f7/0x290
 process_one_work+0xabf/0x1770
 worker_thread+0x64f/0x12a0
 kthread+0x33f/0x440
 ret_from_fork+0x2c/0x50

The buggy address belongs to the object at ffff88801be2f080
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 81 bytes inside of
 freed 96-byte region [ffff88801be2f080, ffff88801be2f0e0)

The buggy address belongs to the physical page:
page:000000008e980a9b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1be2f
flags: 0x100000000000200(slab|node=0|zone=1)
page_type: 0xffffffff()
raw: 0100000000000200 ffff888008441780 ffffea0000ea7740 dead000000000002
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801be2ef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff88801be2f000: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88801be2f080: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
                                                 ^
 ffff88801be2f100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88801be2f180: 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc
==================================================================
loop4: detected capacity change from 0 to 549
audit: type=1326 audit(1688788284.660:13): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=4666 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f86eb064b19 code=0x0
Quota error (device loop4): v2_read_file_info: Number of blocks too big for quota file size (94542401536 > 6144).
EXT4-fs warning (device loop4): ext4_enable_quotas:7061: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix.
EXT4-fs (loop4): mount failed