syzbot

==================================================================
BUG: KASAN: slab-use-after-free in kvm_iodevice_destructor virt/kvm/kvm_main.c:5769 [inline]
BUG: KASAN: slab-use-after-free in kvm_io_bus_destroy virt/kvm/kvm_main.c:5780 [inline]
BUG: KASAN: slab-use-after-free in kvm_destroy_vm virt/kvm/kvm_main.c:1324 [inline]
BUG: KASAN: slab-use-after-free in kvm_put_kvm+0x2dc/0x97c virt/kvm/kvm_main.c:1386
Read of size 8 at addr f9f000001638b080 by task syz.0.43/3526
Pointer tag: [f9], memory tag: [fe]

CPU: 0 UID: 0 PID: 3526 Comm: syz.0.43 Not tainted 6.11.0-rc5-syzkaller-g17a000564499 #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x1b4/0x500 mm/kasan/report.c:488
 kasan_report+0xd8/0x138 mm/kasan/report.c:601
 kasan_tag_mismatch+0x28/0x3c mm/kasan/sw_tags.c:174
 __hwasan_tag_mismatch+0x30/0x60 arch/arm64/lib/kasan_sw_tags.S:55
 kvm_iodevice_destructor virt/kvm/kvm_main.c:5769 [inline]
 kvm_io_bus_destroy virt/kvm/kvm_main.c:5780 [inline]
 kvm_destroy_vm virt/kvm/kvm_main.c:1324 [inline]
 kvm_put_kvm+0x2dc/0x97c virt/kvm/kvm_main.c:1386
 kvm_vm_release+0x40/0x54 virt/kvm/kvm_main.c:1409
 __fput+0x150/0x554 fs/file_table.c:422
 ____fput+0x20/0x30 fs/file_table.c:450
 task_work_run+0x154/0x1c4 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x3bc/0x10e0 kernel/exit.c:882
 do_group_exit+0xfc/0x13c kernel/exit.c:1031
 get_signal+0xd40/0xdb8 kernel/signal.c:2917
 do_signal+0x17c/0x2bac arch/arm64/kernel/signal.c:1308
 do_notify_resume+0x7c/0x1b8 arch/arm64/kernel/entry-common.c:148
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
 el0_svc+0xac/0x14c arch/arm64/kernel/entry-common.c:713
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Allocated by task 3527:
 kasan_save_stack+0x40/0x6c mm/kasan/common.c:47
 save_stack_info+0x34/0x144 mm/kasan/tags.c:106
 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x90/0x94 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3988 [inline]
 slab_alloc_node mm/slub.c:4037 [inline]
 kmem_cache_alloc_noprof+0x1c0/0x35c mm/slub.c:4044
 kvm_vm_ioctl_create_vcpu+0x114/0x588 virt/kvm/kvm_main.c:4241
 kvm_vm_ioctl+0x4dc/0x11e8 virt/kvm/kvm_main.c:5162
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Freed by task 3527:
 kasan_save_stack+0x40/0x6c mm/kasan/common.c:47
 save_stack_info+0x34/0x144 mm/kasan/tags.c:106
 kasan_save_free_info+0x18/0x24 mm/kasan/tags.c:147
 poison_slab_object+0x19c/0x1a0 mm/kasan/common.c:240
 __kasan_slab_free+0x10/0x20 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2252 [inline]
 slab_free mm/slub.c:4473 [inline]
 kmem_cache_free+0x158/0x4b8 mm/slub.c:4548
 kvm_vm_ioctl_create_vcpu+0x404/0x588 virt/kvm/kvm_main.c:4320
 kvm_vm_ioctl+0x4dc/0x11e8 virt/kvm/kvm_main.c:5162
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

The buggy address belongs to the object at fff0000016389cb0
 which belongs to the cache kvm_vcpu of size 7344
The buggy address is located 5072 bytes inside of
 7344-byte region [fff0000016389cb0, fff000001638b960)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56388
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:df0000015df5141
flags: 0x1ffc00000000040(head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
page_type: 0xfdffffff(slab)
raw: 01ffc00000000040 00f000000ad9d000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080040004 00000001fdffffff 0df0000015df5141
head: 01ffc00000000040 00f000000ad9d000 dead000000000122 0000000000000000
head: 0000000000000000 0000000080040004 00000001fdffffff 0df0000015df5141
head: 01ffc00000000003 ffffc1ffc058e201 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff000001638ae00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 fff000001638af00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>fff000001638b000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                                           ^
 fff000001638b100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 fff000001638b200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================