==================================================================
BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6f1/0x760 mm/filemap.c:172
Read of size 4 at addr ffff888144239470 by task syz.4.10636/22377
CPU: 1 PID: 22377 Comm: syz.4.10636 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
unaccount_page_cache_page+0x6f1/0x760 mm/filemap.c:172
__delete_from_page_cache+0xbe/0x470 mm/filemap.c:240
__remove_mapping+0x601/0x990 mm/vmscan.c:1216
shrink_page_list+0x2a24/0x5800 mm/vmscan.c:1829
shrink_inactive_list mm/vmscan.c:2338 [inline]
shrink_list mm/vmscan.c:2583 [inline]
shrink_lruvec+0x11eb/0x3b00 mm/vmscan.c:5800
shrink_node_memcgs mm/vmscan.c:5992 [inline]
shrink_node+0x11ee/0x2a40 mm/vmscan.c:6022
shrink_zones mm/vmscan.c:6228 [inline]
do_try_to_free_pages+0x5a7/0x1580 mm/vmscan.c:6286
try_to_free_mem_cgroup_pages+0x261/0x610 mm/vmscan.c:6608
mem_cgroup_force_empty mm/memcontrol.c:3595 [inline]
mem_cgroup_force_empty_write+0x130/0x170 mm/memcontrol.c:3616
cgroup_file_write+0x294/0x560 kernel/cgroup/cgroup.c:4011
kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2218 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x831/0xfd0 fs/read_write.c:594
ksys_write+0x14a/0x260 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:656
x64_sys_call+0x8ef/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fce35074b19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fce33acc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fce352fafa0 RCX: 00007fce35074b19
RDX: 0000000000000001 RSI: 0000200000000380 RDI: 0000000000000003
RBP: 00007fce3510cb70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fce352fb038 R14: 00007fce352fafa0 R15: 00007ffe06cf1328
general protection fault, probably for non-canonical address 0xdead000000000020: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 22377 Comm: syz.4.10636 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:nearest_obj include/linux/slub_def.h:175 [inline]
RIP: 0010:print_address_description+0x178/0x2c0 mm/kasan/report.c:253
Code: f7 01 00 02 00 00 0f 84 52 ff ff ff 4d 8b 7e 18 4c 89 f0 48 c1 e0 06 48 b9 00 00 00 00 80 08 05 00 48 01 c1 48 89 d8 48 29 c8 <41> 8b 7f 18 48 99 48 f7 ff 48 89 d8 48 29 d0 41 0f b7 76 2a 81 e6
RSP: 0018:ffffc90000be6ad8 EFLAGS: 00010002
RAX: 0000000000000470 RBX: ffff888144239470 RCX: ffff888144239000
RDX: ffffc90003774000 RSI: 0000000000043e14 RDI: 0000000000043e15
RBP: ffffc90000be6b08 R08: ffff8881f7127493 R09: 1ffff1103ee24e92
R10: dffffc0000000000 R11: ffffed103ee24e93 R12: 0000000000000004
R13: 0000000000000096 R14: ffffea0005108e40 R15: dead000000000008
FS: 00007fce33acc6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce33acbff8 CR3: 000000011ada1000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
unaccount_page_cache_page+0x6f1/0x760 mm/filemap.c:172
__delete_from_page_cache+0xbe/0x470 mm/filemap.c:240
__remove_mapping+0x601/0x990 mm/vmscan.c:1216
shrink_page_list+0x2a24/0x5800 mm/vmscan.c:1829
shrink_inactive_list mm/vmscan.c:2338 [inline]
shrink_list mm/vmscan.c:2583 [inline]
shrink_lruvec+0x11eb/0x3b00 mm/vmscan.c:5800
shrink_node_memcgs mm/vmscan.c:5992 [inline]
shrink_node+0x11ee/0x2a40 mm/vmscan.c:6022
shrink_zones mm/vmscan.c:6228 [inline]
do_try_to_free_pages+0x5a7/0x1580 mm/vmscan.c:6286
try_to_free_mem_cgroup_pages+0x261/0x610 mm/vmscan.c:6608
mem_cgroup_force_empty mm/memcontrol.c:3595 [inline]
mem_cgroup_force_empty_write+0x130/0x170 mm/memcontrol.c:3616
cgroup_file_write+0x294/0x560 kernel/cgroup/cgroup.c:4011
kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2218 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x831/0xfd0 fs/read_write.c:594
ksys_write+0x14a/0x260 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:656
x64_sys_call+0x8ef/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fce35074b19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fce33acc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fce352fafa0 RCX: 00007fce35074b19
RDX: 0000000000000001 RSI: 0000200000000380 RDI: 0000000000000003
RBP: 00007fce3510cb70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fce352fb038 R14: 00007fce352fafa0 R15: 00007ffe06cf1328
Modules linked in:
---[ end trace 86c3ecbad61bee6c ]---
RIP: 0010:nearest_obj include/linux/slub_def.h:175 [inline]
RIP: 0010:print_address_description+0x178/0x2c0 mm/kasan/report.c:253
Code: f7 01 00 02 00 00 0f 84 52 ff ff ff 4d 8b 7e 18 4c 89 f0 48 c1 e0 06 48 b9 00 00 00 00 80 08 05 00 48 01 c1 48 89 d8 48 29 c8 <41> 8b 7f 18 48 99 48 f7 ff 48 89 d8 48 29 d0 41 0f b7 76 2a 81 e6
RSP: 0018:ffffc90000be6ad8 EFLAGS: 00010002
RAX: 0000000000000470 RBX: ffff888144239470 RCX: ffff888144239000
RDX: ffffc90003774000 RSI: 0000000000043e14 RDI: 0000000000043e15
RBP: ffffc90000be6b08 R08: ffff8881f7127493 R09: 1ffff1103ee24e92
R10: dffffc0000000000 R11: ffffed103ee24e93 R12: 0000000000000004
R13: 0000000000000096 R14: ffffea0005108e40 R15: dead000000000008
FS: 00007fce33acc6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce33acbff8 CR3: 000000011ada1000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: f7 01 00 02 00 00 testl $0x200,(%rcx)
6: 0f 84 52 ff ff ff je 0xffffff5e
c: 4d 8b 7e 18 mov 0x18(%r14),%r15
10: 4c 89 f0 mov %r14,%rax
13: 48 c1 e0 06 shl $0x6,%rax
17: 48 b9 00 00 00 00 80 movabs $0x5088000000000,%rcx
1e: 08 05 00
21: 48 01 c1 add %rax,%rcx
24: 48 89 d8 mov %rbx,%rax
27: 48 29 c8 sub %rcx,%rax
* 2a: 41 8b 7f 18 mov 0x18(%r15),%edi <-- trapping instruction
2e: 48 99 cqto
30: 48 f7 ff idiv %rdi
33: 48 89 d8 mov %rbx,%rax
36: 48 29 d0 sub %rdx,%rax
39: 41 0f b7 76 2a movzwl 0x2a(%r14),%esi
3e: 81 .byte 0x81
3f: e6 .byte 0xe6