================================================================== BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline] BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:110 [inline] BUG: KASAN: use-after-free in unaccount_page_cache_page+0x9e0/0xac0 mm/filemap.c:175 Read of size 4 at addr ffff888126b7a470 by task kswapd0/39 CPU: 0 PID: 39 Comm: kswapd0 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0xe2/0x130 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline] cleancache_invalidate_page include/linux/cleancache.h:110 [inline] unaccount_page_cache_page+0x9e0/0xac0 mm/filemap.c:175 __delete_from_page_cache+0xc3/0x470 mm/filemap.c:243 __remove_mapping+0x562/0x690 mm/vmscan.c:985 shrink_page_list+0x21a9/0x4250 mm/vmscan.c:1498 shrink_inactive_list+0x532/0xef0 mm/vmscan.c:2075 shrink_list mm/vmscan.c:2294 [inline] shrink_lruvec+0x1235/0x2860 mm/vmscan.c:5473 shrink_node_memcgs mm/vmscan.c:5660 [inline] shrink_node+0xf0c/0x2690 mm/vmscan.c:5690 kswapd_shrink_node mm/vmscan.c:6444 [inline] balance_pgdat mm/vmscan.c:6601 [inline] kswapd+0x1566/0x3040 mm/vmscan.c:6858 kthread+0x346/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Allocated by task 281: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xda/0x110 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x1a4/0x330 mm/slub.c:4038 __kmalloc_node include/linux/slab.h:421 [inline] kmalloc_node include/linux/slab.h:578 [inline] kvmalloc_node+0x88/0x130 mm/util.c:612 kvmalloc include/linux/mm.h:833 [inline] kvmalloc_array include/linux/mm.h:851 [inline] alloc_fdtable+0xea/0x2a0 fs/file.c:150 dup_fd+0x792/0xa90 fs/file.c:360 copy_files+0xcf/0x170 kernel/fork.c:1541 copy_process+0x10f2/0x3300 kernel/fork.c:2256 kernel_clone+0x233/0x960 kernel/fork.c:2650 __do_sys_clone kernel/fork.c:2776 [inline] __se_sys_clone kernel/fork.c:2760 [inline] __x64_sys_clone+0x198/0x210 kernel/fork.c:2760 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38 __kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358 __call_rcu kernel/rcu/tree.c:2980 [inline] call_rcu+0x11a/0x10b0 kernel/rcu/tree.c:3054 netlink_release+0x12ea/0x1710 net/netlink/af_netlink.c:795 __sock_release net/socket.c:597 [inline] sock_close+0xe0/0x270 net/socket.c:1286 __fput+0x2fb/0x770 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb Second to last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38 __kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358 __call_rcu kernel/rcu/tree.c:2980 [inline] call_rcu+0x11a/0x10b0 kernel/rcu/tree.c:3054 netlink_release+0x12ea/0x1710 net/netlink/af_netlink.c:795 __sock_release net/socket.c:597 [inline] sock_close+0xe0/0x270 net/socket.c:1286 __fput+0x2fb/0x770 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888126b7a000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1136 bytes inside of 2048-byte region [ffff888126b7a000, ffff888126b7a800) The buggy address belongs to the page: page:ffffea00049ade00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888126b78000 pfn:0x126b78 head:ffffea00049ade00 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea0004991a08 ffffea00049bc808 ffff888100042d80 raw: ffff888126b78000 0000000000080003 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 282, ts 28869378134, free_ts 0 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x179/0x180 mm/page_alloc.c:2462 get_page_from_freelist+0x223b/0x23d0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x290/0x620 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2a6/0x450 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x1fe/0x330 mm/slub.c:4034 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] __register_sysctl_table+0xeb/0x1250 fs/proc/proc_sysctl.c:1323 register_net_sysctl+0x2c/0x40 net/sysctl_net.c:121 __devinet_sysctl_register+0x2cd/0x3a0 net/ipv4/devinet.c:2598 devinet_sysctl_register+0x169/0x1e0 net/ipv4/devinet.c:2638 inetdev_init+0x273/0x480 net/ipv4/devinet.c:277 inetdev_event+0x1f7/0x1040 net/ipv4/devinet.c:1544 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410 call_netdevice_notifiers_info net/core/dev.c:2054 [inline] call_netdevice_notifiers_extack net/core/dev.c:2066 [inline] call_netdevice_notifiers+0x119/0x190 net/core/dev.c:2080 register_netdevice+0x1056/0x13e0 net/core/dev.c:10100 page_owner free stack trace missing Memory state around the buggy address: ffff888126b7a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888126b7a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888126b7a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888126b7a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888126b7a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================