==================================================================
BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6f2/0x760 mm/filemap.c:172
Read of size 4 at addr ffff8881186df470 by task syz.6.13422/18558

CPU: 1 PID: 18558 Comm: syz.6.13422 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0xf1/0x140 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
 cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
 unaccount_page_cache_page+0x6f2/0x760 mm/filemap.c:172
 __delete_from_page_cache+0xbe/0x420 mm/filemap.c:240
 __remove_mapping+0x60b/0x930 mm/vmscan.c:1216
 shrink_page_list+0x2778/0x5040 mm/vmscan.c:1824
 shrink_inactive_list mm/vmscan.c:2331 [inline]
 shrink_list mm/vmscan.c:2576 [inline]
 shrink_lruvec+0x10f3/0x36a0 mm/vmscan.c:5793
 shrink_node_memcgs mm/vmscan.c:5985 [inline]
 shrink_node+0x11e9/0x2a70 mm/vmscan.c:6015
 shrink_zones mm/vmscan.c:6221 [inline]
 do_try_to_free_pages+0x57e/0x1550 mm/vmscan.c:6279
 try_to_free_mem_cgroup_pages+0x233/0x5b0 mm/vmscan.c:6593
 try_charge_memcg+0x3da/0x1450 mm/memcontrol.c:2713
 try_charge mm/memcontrol.c:2838 [inline]
 charge_memcg+0x6d/0x1a0 mm/memcontrol.c:6861
 __mem_cgroup_charge+0x37/0x130 mm/memcontrol.c:6897
 mem_cgroup_charge include/linux/memcontrol.h:715 [inline]
 shmem_add_to_page_cache+0x62f/0xc30 mm/shmem.c:723
 shmem_getpage_gfp+0x1164/0x2310 mm/shmem.c:1946
 shmem_getpage mm/shmem.c:156 [inline]
 shmem_write_begin+0xce/0x1b0 mm/shmem.c:2480
 generic_perform_write+0x2ad/0x670 mm/filemap.c:3869
 __generic_file_write_iter+0x268/0x480 mm/filemap.c:3997
 generic_file_write_iter+0xa9/0x1d0 mm/filemap.c:4029
 __kernel_write+0x4e7/0x910 fs/read_write.c:539
 __dump_emit+0x240/0x360 fs/coredump.c:880
 dump_emit+0x383/0x3f0 fs/coredump.c:917
 dump_user_range+0x86/0x1c0 fs/coredump.c:954
 elf_core_dump+0x2ae5/0x3020 fs/binfmt_elf.c:2285
 do_coredump+0x141b/0x2860 fs/coredump.c:831
 get_signal+0x38d/0x1480 kernel/signal.c:2893
 arch_do_signal_or_restart+0xc1/0x10f0 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:320
 irqentry_exit+0x12/0x40 kernel/entry/common.c:411
 exc_page_fault+0x5e/0xb0 arch/x86/mm/fault.c:1568
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7f704d35abb1
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f704d5a1fa0 RCX: 00007f704d35aba9
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007f704d3dde19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f704d5a2038 R14: 00007f704d5a1fa0 R15: 00007fff744ca4c8
 </TASK>

The buggy address belongs to the page:
page:ffffea000461b7c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1186df
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 0000000000000000 ffffea0004819608 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152dc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 18308, ts 2029216721161, free_ts 2029284608550
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2605
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2611
 get_page_from_freelist+0x2cc5/0x2d50 mm/page_alloc.c:4485
 __alloc_pages+0x18f/0x440 mm/page_alloc.c:5808
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 __get_free_pages+0x10/0x30 mm/page_alloc.c:5845
 alloc_one_pg_vec_page net/packet/af_packet.c:4357 [inline]
 alloc_pg_vec net/packet/af_packet.c:4387 [inline]
 packet_set_ring+0x75c/0x23c0 net/packet/af_packet.c:4472
 packet_setsockopt+0x1159/0x1860 net/packet/af_packet.c:3853
 __sys_setsockopt+0x2f0/0x460 net/socket.c:2203
 __do_sys_setsockopt net/socket.c:2214 [inline]
 __se_sys_setsockopt net/socket.c:2211 [inline]
 __x64_sys_setsockopt+0xbf/0xd0 net/socket.c:2211
 x64_sys_call+0x982/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:55
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1472 [inline]
 free_pcp_prepare mm/page_alloc.c:1544 [inline]
 free_unref_page_prepare+0x542/0x550 mm/page_alloc.c:3534
 free_unref_page+0xa2/0x550 mm/page_alloc.c:3616
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5884
 free_pages+0x82/0x90 mm/page_alloc.c:5895
 free_pg_vec net/packet/af_packet.c:4343 [inline]
 packet_set_ring+0x1889/0x23c0 net/packet/af_packet.c:4562
 packet_release+0x791/0xc90 net/packet/af_packet.c:3170
 __sock_release net/socket.c:649 [inline]
 sock_close+0xe0/0x270 net/socket.c:1336
 __fput+0x20b/0x8b0 fs/file_table.c:311
 ____fput+0x15/0x20 fs/file_table.c:339
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff8881186df300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881186df380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881186df400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                             ^
 ffff8881186df480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881186df500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================