syzbot

==================================================================
BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6d8/0x750 mm/filemap.c:167
Read of size 4 at addr ffff88811ff80470 by task syz-executor/15775

CPU: 0 PID: 15775 Comm: syz-executor Tainted: G        W         5.15.167-syzkaller-android13-5.15.167_r00 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x151/0x1c0 lib/dump_stack.c:106
 print_address_description+0x87/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
 cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
 unaccount_page_cache_page+0x6d8/0x750 mm/filemap.c:167
 __delete_from_page_cache+0xc6/0x5b0 mm/filemap.c:235
 __remove_mapping+0x566/0x690 mm/vmscan.c:1201
 shrink_page_list+0x2723/0x5c50 mm/vmscan.c:1798
 shrink_inactive_list mm/vmscan.c:2305 [inline]
 shrink_list mm/vmscan.c:2550 [inline]
 shrink_lruvec+0x17ec/0x4580 mm/vmscan.c:5755
 shrink_node_memcgs mm/vmscan.c:5947 [inline]
 shrink_node+0x1083/0x2550 mm/vmscan.c:5977
 shrink_zones mm/vmscan.c:6183 [inline]
 do_try_to_free_pages+0x5c6/0x1600 mm/vmscan.c:6241
 try_to_free_pages+0x3a5/0xd70 mm/vmscan.c:6476
 __perform_reclaim mm/page_alloc.c:4949 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4972 [inline]
 __alloc_pages_slowpath+0x15fe/0x38e0 mm/page_alloc.c:5396
 __alloc_pages+0x503/0x8f0 mm/page_alloc.c:5792
 __vmalloc_area_node mm/vmalloc.c:2955 [inline]
 __vmalloc_node_range+0x482/0x8d0 mm/vmalloc.c:3086
 __vmalloc_node mm/vmalloc.c:3151 [inline]
 vzalloc+0x78/0x90 mm/vmalloc.c:3221
 alloc_counters+0x69/0x500 net/ipv4/netfilter/ip_tables.c:800
 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:822 [inline]
 get_entries net/ipv4/netfilter/ip_tables.c:1023 [inline]
 do_ipt_get_ctl+0xeac/0x1880 net/ipv4/netfilter/ip_tables.c:1669
 nf_getsockopt+0x26c/0x290 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x153a/0x2160 net/ipv4/ip_sockglue.c:1797
 tcp_getsockopt+0x249/0x7030 net/ipv4/tcp.c:4305
 sock_common_getsockopt+0x99/0xb0 net/core/sock.c:3432
 __sys_getsockopt+0x290/0x4f0 net/socket.c:2242
 __do_sys_getsockopt net/socket.c:2257 [inline]
 __se_sys_getsockopt net/socket.c:2254 [inline]
 __x64_sys_getsockopt+0xbf/0xd0 net/socket.c:2254
 x64_sys_call+0x1a9/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:56
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fe1033a445a
Code: ff c3 66 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb b8 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7
RSP: 002b:00007ffdd9639ca8 EFLAGS: 00000216 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffdd9639d30 RCX: 00007fe1033a445a
RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007ffdd9639ccc R09: 0079746972756365
R10: 00007ffdd9639d30 R11: 0000000000000216 R12: 00007fe10352f940
R13: 00007ffdd9639ccc R14: 0000000000000000 R15: 00007fe103530000
 </TASK>

Allocated by task 15856:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc_track_caller+0x139/0x260 mm/slub.c:4950
 kmalloc_reserve net/core/skbuff.c:357 [inline]
 __alloc_skb+0x10c/0x550 net/core/skbuff.c:428
 alloc_skb include/linux/skbuff.h:1183 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 audit_buffer_alloc kernel/audit.c:1799 [inline]
 audit_log_start+0x456/0xa80 kernel/audit.c:1917
 common_lsm_audit+0xd8/0x18b0 security/lsm_audit.c:457
 slow_avc_audit+0x26c/0x3c0 security/selinux/avc.c:802
 avc_xperms_audit security/selinux/avc.c:433 [inline]
 avc_has_extended_perms+0xa2d/0x10f0 security/selinux/avc.c:1107
 ioctl_has_perm+0x3f5/0x560 security/selinux/hooks.c:3763
 selinux_file_ioctl+0x3cc/0x540
 security_file_ioctl+0x74/0xb0 security/security.c:1556
 __do_sys_ioctl fs/ioctl.c:868 [inline]
 __se_sys_ioctl+0x53/0x190 fs/ioctl.c:860
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:860
 x64_sys_call+0x98/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 30:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1723 [inline]
 slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749
 slab_free mm/slub.c:3519 [inline]
 kfree+0xc8/0x220 mm/slub.c:4579
 skb_free_head net/core/skbuff.c:656 [inline]
 skb_release_data+0x8a9/0xa80 net/core/skbuff.c:678
 skb_release_all net/core/skbuff.c:743 [inline]
 __kfree_skb net/core/skbuff.c:757 [inline]
 kfree_skb_reason net/core/skbuff.c:778 [inline]
 kfree_skb+0xba/0x360 net/core/skbuff.c:792
 kauditd_hold_skb+0x115/0x200 kernel/audit.c:614
 kauditd_send_queue+0x28d/0x2e0 kernel/audit.c:769
 kauditd_thread+0x529/0x8b0 kernel/audit.c:893
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 insert_work+0x56/0x320 kernel/workqueue.c:1373
 __queue_work+0x92a/0xcd0 kernel/workqueue.c:1539
 queue_work_on+0x105/0x170 kernel/workqueue.c:1566
 queue_work include/linux/workqueue.h:510 [inline]
 schedule_work include/linux/workqueue.h:571 [inline]
 destroy_super_rcu+0xd1/0xe0 fs/super.c:172
 rcu_do_batch+0x57a/0xc10 kernel/rcu/tree.c:2523
 rcu_core+0x517/0x1020 kernel/rcu/tree.c:2763
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2776
 handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
 run_ksoftirqd+0x28/0x40 kernel/softirq.c:941
 smpboot_thread_fn+0x466/0x8d0 kernel/smpboot.c:164
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 __call_rcu_common kernel/rcu/tree.c:3007 [inline]
 call_rcu+0x123/0x10b0 kernel/rcu/tree.c:3125
 __put_super+0x26d/0x2e0 fs/super.c:299
 put_super fs/super.c:313 [inline]
 deactivate_locked_super+0xe1/0x110 fs/super.c:346
 mount_bdev+0x29e/0x3b0 fs/super.c:1400
 f2fs_mount+0x34/0x40 fs/f2fs/super.c:4623
 legacy_get_tree+0xf1/0x190 fs/fs_context.c:611
 vfs_get_tree+0x88/0x290 fs/super.c:1528
 do_new_mount+0x2ba/0xb30 fs/namespace.c:3005
 path_mount+0x671/0x1070 fs/namespace.c:3335
 do_mount fs/namespace.c:3348 [inline]
 __do_sys_mount fs/namespace.c:3556 [inline]
 __se_sys_mount+0x2c4/0x3b0 fs/namespace.c:3533
 __x64_sys_mount+0xbf/0xd0 fs/namespace.c:3533
 x64_sys_call+0x49d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88811ff80000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1136 bytes inside of
 2048-byte region [ffff88811ff80000, ffff88811ff80800)
The buggy address belongs to the page:
page:ffffea00047fe000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ff80
head:ffffea00047fe000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043200
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 290, ts 21285542252, free_ts 21168566715
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2605
 prep_new_page+0x1b/0x110 mm/page_alloc.c:2611
 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4485
 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5779
 allocate_slab mm/slub.c:1932 [inline]
 new_slab+0x9a/0x4e0 mm/slub.c:1995
 ___slab_alloc+0x39e/0x830 mm/slub.c:3028
 __slab_alloc+0x4a/0x90 mm/slub.c:3115
 slab_alloc_node mm/slub.c:3206 [inline]
 slab_alloc mm/slub.c:3248 [inline]
 __kmalloc_track_caller+0x16c/0x260 mm/slub.c:4945
 kmemdup+0x24/0x50 mm/util.c:132
 neigh_sysctl_register+0xb0/0x530 net/core/neighbour.c:3647
 devinet_sysctl_register+0xaa/0x1e0 net/ipv4/devinet.c:2628
 inetdev_init+0x284/0x4b0 net/ipv4/devinet.c:283
 inetdev_event+0x205/0x10a0 net/ipv4/devinet.c:1531
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x8c/0xf0 kernel/notifier.c:391
 call_netdevice_notifiers_info net/core/dev.c:2025 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2037 [inline]
 call_netdevice_notifiers+0x145/0x1b0 net/core/dev.c:2051
 register_netdevice+0x1035/0x1390 net/core/dev.c:10395
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1472 [inline]
 free_pcp_prepare mm/page_alloc.c:1544 [inline]
 free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3534
 free_unref_page+0xe8/0x750 mm/page_alloc.c:3616
 free_the_page mm/page_alloc.c:805 [inline]
 free_compound_page+0x78/0xa0 mm/page_alloc.c:828
 destroy_compound_page include/linux/mm.h:989 [inline]
 __put_compound_page+0x73/0xb0 mm/swap.c:111
 __put_page+0xbf/0xe0 mm/swap.c:127
 put_page include/linux/mm.h:1295 [inline]
 __skb_frag_unref include/linux/skbuff.h:3252 [inline]
 skb_release_data+0x405/0xa80 net/core/skbuff.c:673
 skb_release_all net/core/skbuff.c:743 [inline]
 __kfree_skb+0x50/0x70 net/core/skbuff.c:757
 sk_eat_skb include/net/sock.h:2732 [inline]
 tcp_recvmsg_locked+0x17fd/0x2890 net/ipv4/tcp.c:2517
 tcp_recvmsg+0x24e/0x7f0 net/ipv4/tcp.c:2563
 inet_recvmsg+0x158/0x500 net/ipv4/af_inet.c:863
 sock_recvmsg_nosec net/socket.c:966 [inline]
 sock_recvmsg net/socket.c:984 [inline]
 sock_read_iter+0x353/0x480 net/socket.c:1057
 call_read_iter include/linux/fs.h:2198 [inline]
 new_sync_read fs/read_write.c:404 [inline]
 vfs_read+0xa81/0xd40 fs/read_write.c:485
 ksys_read+0x199/0x2c0 fs/read_write.c:623
 __do_sys_read fs/read_write.c:633 [inline]
 __se_sys_read fs/read_write.c:631 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:631
 x64_sys_call+0x28/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88811ff80300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811ff80380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88811ff80400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff88811ff80480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811ff80500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================