==================================================================
BUG: KASAN: use-after-free in __vma_adjust+0x1834/0x1890
Read of size 8 at addr ffff88800f0cf1f8 by task syz-executor.4/8941

CPU: 0 PID: 8941 Comm: syz-executor.4 Not tainted 5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 print_report.cold+0x5e/0x5e5
 kasan_report+0xb1/0x1c0
 __vma_adjust+0x1834/0x1890
 vma_merge+0x298/0x810
 mprotect_fixup+0x307/0x8c0
 do_mprotect_pkey+0x70d/0xa80
 __x64_sys_pkey_mprotect+0x93/0x100
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fcd75cd6b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcd7324c188 EFLAGS: 00000246 ORIG_RAX: 0000000000000149
RAX: ffffffffffffffda RBX: 00007fcd75de9f60 RCX: 00007fcd75cd6b19
RDX: 0000000000000002 RSI: 0000000000004000 RDI: 0000000020000000
RBP: 00007fcd7324c1d0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffc765378ff R14: 00007fcd7324c300 R15: 0000000000022000
 </TASK>

Allocated by task 8941:
 kasan_save_stack+0x1e/0x40
 __kasan_slab_alloc+0x66/0x80
 kmem_cache_alloc+0x1b1/0x4a0
 vm_area_alloc+0x1c/0x100
 mmap_region+0x44b/0x1a00
 do_mmap+0x828/0xf40
 vm_mmap_pgoff+0x1af/0x270
 ksys_mmap_pgoff+0x3d0/0x4f0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 8941:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_set_free_info+0x20/0x40
 __kasan_slab_free+0x108/0x190
 kmem_cache_free+0xfb/0x610
 __vma_adjust+0x95b/0x1890
 vma_merge+0x298/0x810
 mprotect_fixup+0x307/0x8c0
 do_mprotect_pkey+0x70d/0xa80
 __x64_sys_pkey_mprotect+0x93/0x100
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff88800f0cf1a0
 which belongs to the cache vm_area_struct of size 144
The buggy address is located 88 bytes inside of
 144-byte region [ffff88800f0cf1a0, ffff88800f0cf230)

The buggy address belongs to the physical page:
page:0000000026a35e35 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf0cf
memcg:ffff8880088cf001
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 ffffea0000341400 dead000000000006 ffff888008032c80
raw: 0000000000000000 0000000000130013 00000001ffffffff ffff8880088cf001
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88800f0cf080: 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 00 00
 ffff88800f0cf100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
>ffff88800f0cf180: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff88800f0cf200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc 00 00
 ffff88800f0cf280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
BUG: Bad page map in process syz-executor.4  pte:8000000006111225 pmd:428d2067
addr:00007ffc765d8000 vm_flags:00102070 anon_vma:0000000000000000 mapping:ffff88801eb42c98 index:f77c33c09
file:file1 fault:filemap_fault mmap:ext4_file_mmap read_folio:ext4_read_folio
CPU: 1 PID: 8941 Comm: syz-executor.4 Tainted: G    B              5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 print_bad_pte.cold+0x2a5/0x2dd
 vm_normal_page+0x10c/0x2e0
 unmap_page_range+0xa51/0x2720
 unmap_single_vma+0x190/0x350
 unmap_vmas+0x21e/0x370
 exit_mmap+0x154/0x680
 mmput+0xd1/0x390
 do_exit+0x9e0/0x27a0
 do_group_exit+0xd2/0x2f0
 get_signal+0x2205/0x24b0
 arch_do_signal_or_restart+0x89/0x1be0
 exit_to_user_mode_prepare+0x131/0x1a0
 syscall_exit_to_user_mode+0x19/0x40
 do_syscall_64+0x48/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fcd75cd6b19
Code: Unable to access opcode bytes at RIP 0x7fcd75cd6aef.
RSP: 002b:00007fcd7324c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fcd75de9f68 RCX: 00007fcd75cd6b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcd75de9f68
RBP: 00007fcd75de9f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcd75de9f6c
R13: 00007ffc765378ff R14: 00007fcd7324c300 R15: 0000000000022000
 </TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 8941 Comm: syz-executor.4 Tainted: G    B              5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:do_raw_spin_lock+0x5a/0x260
Code: 65 94 e6 84 48 c1 ed 03 48 c7 44 24 18 c0 00 2a 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 65 48 8b 0c 25 28 00 00 00 48 89 4c 24 60 31
RSP: 0018:ffff88804435f5d0 EFLAGS: 00010257
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000004
RBP: 1ffff1100886bebb R08: 0000000000000000 R09: ffffffff858ec597
R10: fffffbfff0b1d8b2 R11: 0000000000000001 R12: 0000000007603067
R13: 0000000000007603 R14: ffff888007603000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd49d98c98 CR3: 000000001e0ae000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unmap_page_range+0x7ac/0x2720
 unmap_single_vma+0x190/0x350
 unmap_vmas+0x21e/0x370
 exit_mmap+0x154/0x680
 mmput+0xd1/0x390
 do_exit+0x9e0/0x27a0
 do_group_exit+0xd2/0x2f0
 get_signal+0x2205/0x24b0
 arch_do_signal_or_restart+0x89/0x1be0
 exit_to_user_mode_prepare+0x131/0x1a0
 syscall_exit_to_user_mode+0x19/0x40
 do_syscall_64+0x48/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fcd75cd6b19
Code: Unable to access opcode bytes at RIP 0x7fcd75cd6aef.
RSP: 002b:00007fcd7324c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fcd75de9f68 RCX: 00007fcd75cd6b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcd75de9f68
RBP: 00007fcd75de9f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcd75de9f6c
R13: 00007ffc765378ff R14: 00007fcd7324c300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:do_raw_spin_lock+0x5a/0x260
Code: 65 94 e6 84 48 c1 ed 03 48 c7 44 24 18 c0 00 2a 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 65 48 8b 0c 25 28 00 00 00 48 89 4c 24 60 31
RSP: 0018:ffff88804435f5d0 EFLAGS: 00010257
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000004
RBP: 1ffff1100886bebb R08: 0000000000000000 R09: ffffffff858ec597
R10: fffffbfff0b1d8b2 R11: 0000000000000001 R12: 0000000007603067
R13: 0000000000007603 R14: ffff888007603000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd49d98c98 CR3: 000000001e0ae000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
note: syz-executor.4[8941] exited with preempt_count 1
Fixing recursive fault but reboot is needed!
BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.4/8941
caller is __schedule+0x7f/0x24a0
CPU: 1 PID: 8941 Comm: syz-executor.4 Tainted: G    B D            5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 check_preemption_disabled+0x16f/0x180
 __schedule+0x7f/0x24a0
 do_task_dead+0xd1/0x100
 make_task_dead.cold+0xb9/0x1c9
 rewind_stack_and_make_dead+0x17/0x17
RIP: 0033:0x7fcd75cd6b19
Code: Unable to access opcode bytes at RIP 0x7fcd75cd6aef.
RSP: 002b:00007fcd7324c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fcd75de9f68 RCX: 00007fcd75cd6b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcd75de9f68
RBP: 00007fcd75de9f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcd75de9f6c
R13: 00007ffc765378ff R14: 00007fcd7324c300 R15: 0000000000022000
 </TASK>
BUG: scheduling while atomic: syz-executor.4/8941/0x00000000
INFO: lockdep is turned off.
Modules linked in:
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 8941 Comm: syz-executor.4 Tainted: G    B D            5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 __schedule_bug.cold+0x133/0x143
 __schedule+0x18f2/0x24a0
 do_task_dead+0xd1/0x100
 make_task_dead.cold+0xb9/0x1c9
 rewind_stack_and_make_dead+0x17/0x17
RIP: 0033:0x7fcd75cd6b19
Code: Unable to access opcode bytes at RIP 0x7fcd75cd6aef.
RSP: 002b:00007fcd7324c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fcd75de9f68 RCX: 00007fcd75cd6b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcd75de9f68
RBP: 00007fcd75de9f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcd75de9f6c
R13: 00007ffc765378ff R14: 00007fcd7324c300 R15: 0000000000022000
 </TASK>
BUG: unable to handle page fault for address: ffffebde00800048
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#2] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 8517 Comm: kworker/1:0 Tainted: G    B D W          5.19.0-rc6-next-20220714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events_freezable_power_ disk_events_workfn
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 63 c3 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 41 c3 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888044cf79f0 EFLAGS: 00010282
RAX: ffffebde00800040 RBX: 0000000020001000 RCX: 0000000080130011
RDX: 00000000a0001000 RSI: ffffea00003c33c0 RDI: 0000000040000000
RBP: 0000000000000000 R08: 0000000020001000 R09: 0000000080130011
R10: ffffea00003c33c0 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888044cf7a30 R14: 0000000000000000 R15: ffff88800f0cf1a0
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffebde00800048 CR3: 0000000017d24000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kasan_quarantine_reduce+0x184/0x210
 __kasan_kmalloc+0x97/0xa0
 bio_kmalloc+0x3a/0x70
 blk_rq_map_kern+0x4a1/0x920
 __scsi_execute+0x4a7/0x5e0
 sr_check_events+0x17e/0xa40
 cdrom_check_events+0x64/0x110
 sr_block_check_events+0xbf/0x100
 disk_check_events+0xc7/0x420
 process_one_work+0xa0f/0x1690
 worker_thread+0x637/0x1260
 kthread+0x2ed/0x3a0
 ret_from_fork+0x22/0x30
 </TASK>
Modules linked in:
CR2: ffffebde00800048
---[ end trace 0000000000000000 ]---
RIP: 0010:do_raw_spin_lock+0x5a/0x260
Code: 65 94 e6 84 48 c1 ed 03 48 c7 44 24 18 c0 00 2a 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 65 48 8b 0c 25 28 00 00 00 48 89 4c 24 60 31
RSP: 0018:ffff88804435f5d0 EFLAGS: 00010257
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000004
RBP: 1ffff1100886bebb R08: 0000000000000000 R09: ffffffff858ec597
R10: fffffbfff0b1d8b2 R11: 0000000000000001 R12: 0000000007603067
R13: 0000000000007603 R14: ffff888007603000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffebde00800048 CR3: 0000000017d24000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	65 94                	gs xchg %eax,%esp
   2:	e6 84                	out    %al,$0x84
   4:	48 c1 ed 03          	shr    $0x3,%rbp
   8:	48 c7 44 24 18 c0 00 	movq   $0xffffffff812a00c0,0x18(%rsp)
   f:	2a 81
  11:	48 8d 54 05 00       	lea    0x0(%rbp,%rax,1),%rdx
  16:	c7 02 f1 f1 f1 f1    	movl   $0xf1f1f1f1,(%rdx)
  1c:	c7 42 04 04 f3 f3 f3 	movl   $0xf3f3f304,0x4(%rdx)
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx <-- trapping instruction
  2e:	48 89 f8             	mov    %rdi,%rax
  31:	65 48 8b 0c 25 28 00 	mov    %gs:0x28,%rcx
  38:	00 00
  3a:	48 89 4c 24 60       	mov    %rcx,0x60(%rsp)
  3f:	31                   	.byte 0x31