==================================================================
BUG: KASAN: slab-use-after-free in __update_min_deadline kernel/sched/fair.c:805 [inline]
BUG: KASAN: slab-use-after-free in min_deadline_update kernel/sched/fair.c:819 [inline]
BUG: KASAN: slab-use-after-free in min_deadline_cb_propagate kernel/sched/fair.c:825 [inline]
BUG: KASAN: slab-use-after-free in reweight_entity+0x8e3/0xa60 kernel/sched/fair.c:3660
Read of size 8 at addr ffff8880263e0630 by task syz-executor426/6018

CPU: 1 PID: 6018 Comm: syz-executor426 Not tainted 6.6.0-rc6-syzkaller-00285-g9c5d00cb7b6b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 __update_min_deadline kernel/sched/fair.c:805 [inline]
 min_deadline_update kernel/sched/fair.c:819 [inline]
 min_deadline_cb_propagate kernel/sched/fair.c:825 [inline]
 reweight_entity+0x8e3/0xa60 kernel/sched/fair.c:3660
 entity_tick kernel/sched/fair.c:5317 [inline]
 task_tick_fair+0xee/0xcd0 kernel/sched/fair.c:12392
 scheduler_tick+0x210/0x650 kernel/sched/core.c:5657
 update_process_times+0x19f/0x220 kernel/time/timer.c:2076
 tick_sched_handle+0x8e/0x170 kernel/time/tick-sched.c:254
 tick_sched_timer+0xe9/0x110 kernel/time/tick-sched.c:1492
 __run_hrtimer kernel/time/hrtimer.c:1688 [inline]
 __hrtimer_run_queues+0x647/0xc10 kernel/time/hrtimer.c:1752
 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1063 [inline]
 __sysvec_apic_timer_interrupt+0x105/0x3f0 arch/x86/kernel/apic/apic.c:1080
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1074
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__vmcs_readl arch/x86/kvm/vmx/vmx_ops.h:97 [inline]
RIP: 0010:vmcs_read32 arch/x86/kvm/vmx/vmx_ops.h:166 [inline]
RIP: 0010:vmx_read_guest_seg_limit arch/x86/kvm/vmx/vmx.c:859 [inline]
RIP: 0010:vmx_get_segment+0x28e/0x760 arch/x86/kvm/vmx/vmx.c:3506
Code: 8a 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e af 03 00 00 4c 89 e8 48 c1 e0 04 44 8b b8 c8 d4 84 8a 45 0f 78 fe <0f> 86 74 03 00 00 e8 57 1e 65 00 e8 52 1e 65 00 4b 8d 44 6d 00 48
RSP: 0018:ffffc9000605fc38 EFLAGS: 00000202
RAX: 0000000000000070 RBX: ffff88801c8a00a8 RCX: 0000000000000000
RDX: 1ffffffff1509aa7 RSI: ffffffff8121a983 RDI: ffffffff8a84d538
RBP: ffff888020ad8a00 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000007
R13: 0000000000000007 R14: 00000000000007ff R15: 000000000000480c
 kvm_get_segment arch/x86/kvm/x86.c:7291 [inline]
 __get_sregs_common+0x3f5/0x7d0 arch/x86/kvm/x86.c:11316
 __get_sregs+0x1a/0x180 arch/x86/kvm/x86.c:11338
 kvm_arch_vcpu_ioctl_get_sregs+0x24/0x40 arch/x86/kvm/x86.c:11368
 kvm_vcpu_ioctl+0xadf/0x1040 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4201
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fbca8dff69b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffcd1f76f80 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000fec00000 RCX: 00007fbca8dff69b
RDX: 00007ffcd1f77500 RSI: 000000008138ae83 RDI: 0000000000000005
RBP: 00007ffcd1f77640 R08: 0000000000009120 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 0000000000000000 R14: 0000000000000018 R15: 0000000020018000
 </TASK>

Allocated by task 2:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook mm/slab.h:762 [inline]
 slab_alloc_node mm/slab.c:3237 [inline]
 kmem_cache_alloc_node+0x173/0x540 mm/slab.c:3509
 alloc_task_struct_node kernel/fork.c:173 [inline]
 dup_task_struct kernel/fork.c:1110 [inline]
 copy_process+0x41c/0x73f0 kernel/fork.c:2327
 kernel_clone+0xfd/0x920 kernel/fork.c:2909
 kernel_thread+0xc0/0x100 kernel/fork.c:2971
 create_kthread kernel/kthread.c:411 [inline]
 kthreadd+0x4fb/0x7d0 kernel/kthread.c:746
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Freed by task 5158:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free+0x138/0x190 mm/kasan/common.c:200
 kasan_slab_free include/linux/kasan.h:164 [inline]
 __cache_free mm/slab.c:3370 [inline]
 __do_kmem_cache_free mm/slab.c:3557 [inline]
 kmem_cache_free+0x104/0x380 mm/slab.c:3582
 put_task_struct include/linux/sched/task.h:136 [inline]
 put_task_struct include/linux/sched/task.h:123 [inline]
 delayed_put_task_struct+0x21b/0x2b0 kernel/exit.c:226
 rcu_do_batch kernel/rcu/tree.c:2139 [inline]
 rcu_core+0x805/0x1bb0 kernel/rcu/tree.c:2403
 __do_softirq+0x218/0x965 kernel/softirq.c:553

Last potentially related work creation:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 __kasan_record_aux_stack+0x78/0x80 mm/kasan/generic.c:492
 __call_rcu_common.constprop.0+0x9a/0x790 kernel/rcu/tree.c:2653
 put_task_struct_rcu_user kernel/exit.c:232 [inline]
 put_task_struct_rcu_user+0x87/0xc0 kernel/exit.c:229
 context_switch kernel/sched/core.c:5385 [inline]
 __schedule+0xee9/0x5a10 kernel/sched/core.c:6695
 schedule+0xe7/0x1b0 kernel/sched/core.c:6771
 schedule_timeout+0x157/0x2c0 kernel/time/timer.c:2167
 rcu_gp_fqs_loop+0x1ec/0xa50 kernel/rcu/tree.c:1613
 rcu_gp_kthread+0x249/0x380 kernel/rcu/tree.c:1812
 kthread+0x33c/0x440 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Second to last potentially related work creation:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 __kasan_record_aux_stack+0x78/0x80 mm/kasan/generic.c:492
 __call_rcu_common.constprop.0+0x9a/0x790 kernel/rcu/tree.c:2653
 put_task_struct_rcu_user kernel/exit.c:232 [inline]
 put_task_struct_rcu_user+0x87/0xc0 kernel/exit.c:229
 context_switch kernel/sched/core.c:5385 [inline]
 __schedule+0xee9/0x5a10 kernel/sched/core.c:6695
 schedule+0xe7/0x1b0 kernel/sched/core.c:6771
 do_nanosleep+0x218/0x500 kernel/time/hrtimer.c:2047
 hrtimer_nanosleep+0x1ae/0x440 kernel/time/hrtimer.c:2100
 common_nsleep+0xa1/0xc0 kernel/time/posix-timers.c:1350
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1396 [inline]
 __se_sys_clock_nanosleep kernel/time/posix-timers.c:1373 [inline]
 __x64_sys_clock_nanosleep+0x344/0x490 kernel/time/posix-timers.c:1373
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff8880263e0580
 which belongs to the cache task_struct of size 8960
The buggy address is located 176 bytes inside of
 freed 8960-byte region [ffff8880263e0580, ffff8880263e2880)

The buggy address belongs to the physical page:
page:ffffea000098f800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x263e0
head:ffffea000098f800 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88801c214a81
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0x1()
raw: 00fff00000000840 ffff88810005a500 ffffea0000bea310 ffffea0000940110
raw: 0000000000000000 ffff8880263e0580 0000000100000001 ffff88801c214a81
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 4863, tgid 4863 (dhcpcd), ts 33424992604, free_ts 33344567958
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1536
 prep_new_page mm/page_alloc.c:1543 [inline]
 get_page_from_freelist+0xee0/0x2f20 mm/page_alloc.c:3170
 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4426
 __alloc_pages_node include/linux/gfp.h:237 [inline]
 kmem_getpages mm/slab.c:1356 [inline]
 cache_grow_begin+0x99/0x3a0 mm/slab.c:2550
 cache_alloc_refill+0x294/0x3a0 mm/slab.c:2923
 ____cache_alloc mm/slab.c:2999 [inline]
 ____cache_alloc mm/slab.c:2982 [inline]
 __do_cache_alloc mm/slab.c:3182 [inline]
 slab_alloc_node mm/slab.c:3230 [inline]
 kmem_cache_alloc_node+0x481/0x540 mm/slab.c:3509
 alloc_task_struct_node kernel/fork.c:173 [inline]
 dup_task_struct kernel/fork.c:1110 [inline]
 copy_process+0x41c/0x73f0 kernel/fork.c:2327
 kernel_clone+0xfd/0x920 kernel/fork.c:2909
 __do_sys_clone3+0x1f1/0x260 kernel/fork.c:3210
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1136 [inline]
 free_unref_page_prepare+0x476/0xa40 mm/page_alloc.c:2312
 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2405
 slab_destroy mm/slab.c:1608 [inline]
 slabs_destroy+0x85/0xc0 mm/slab.c:1628
 cache_flusharray mm/slab.c:3341 [inline]
 ___cache_free+0x2b7/0x420 mm/slab.c:3404
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x4c/0x1b0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook mm/slab.h:762 [inline]
 slab_alloc_node mm/slab.c:3237 [inline]
 slab_alloc mm/slab.c:3246 [inline]
 __kmem_cache_alloc_lru mm/slab.c:3423 [inline]
 kmem_cache_alloc+0x159/0x400 mm/slab.c:3432
 mt_alloc_one lib/maple_tree.c:160 [inline]
 mas_alloc_nodes+0x182/0x830 lib/maple_tree.c:1265
 mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1345
 mas_preallocate+0x2d7/0xda0 lib/maple_tree.c:5520
 vma_iter_prealloc mm/internal.h:1077 [inline]
 vma_expand+0x63c/0x12a0 mm/mmap.c:650
 shift_arg_pages+0x1b8/0x410 fs/exec.c:708
 setup_arg_pages+0x4fe/0xd20 fs/exec.c:837
 load_elf_binary+0xab7/0x4f10 fs/binfmt_elf.c:1018
 search_binary_handler fs/exec.c:1739 [inline]
 exec_binprm fs/exec.c:1781 [inline]
 bprm_execve fs/exec.c:1856 [inline]
 bprm_execve+0x7fc/0x1a40 fs/exec.c:1812

Memory state around the buggy address:
 ffff8880263e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880263e0580: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880263e0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff8880263e0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880263e0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	8a 48 89             	mov    -0x77(%rax),%cl
   3:	fa                   	cli
   4:	48 c1 ea 03          	shr    $0x3,%rdx
   8:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax
   c:	84 c0                	test   %al,%al
   e:	74 08                	je     0x18
  10:	3c 03                	cmp    $0x3,%al
  12:	0f 8e af 03 00 00    	jle    0x3c7
  18:	4c 89 e8             	mov    %r13,%rax
  1b:	48 c1 e0 04          	shl    $0x4,%rax
  1f:	44 8b b8 c8 d4 84 8a 	mov    -0x757b2b38(%rax),%r15d
  26:	45 0f 78 fe          	vmread %r15,%r14
* 2a:	0f 86 74 03 00 00    	jbe    0x3a4 <-- trapping instruction
  30:	e8 57 1e 65 00       	call   0x651e8c
  35:	e8 52 1e 65 00       	call   0x651e8c
  3a:	4b 8d 44 6d 00       	lea    0x0(%r13,%r13,2),%rax
  3f:	48                   	rex.W