==================================================================
BUG: KASAN: slab-out-of-bounds in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
BUG: KASAN: slab-out-of-bounds in cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
BUG: KASAN: slab-out-of-bounds in unaccount_page_cache_page+0x99f/0xa80 mm/filemap.c:175
Read of size 4 at addr ffff888117b74470 by task syz-executor.2/2041

CPU: 1 PID: 2041 Comm: syz-executor.2 Not tainted 5.10.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline]
 cleancache_invalidate_page include/linux/cleancache.h:110 [inline]
 unaccount_page_cache_page+0x99f/0xa80 mm/filemap.c:175
 __delete_from_page_cache+0xd0/0x5d0 mm/filemap.c:243
 __remove_mapping+0x567/0x690 mm/vmscan.c:978
 shrink_page_list+0x1f38/0x4c60 mm/vmscan.c:1491
 shrink_inactive_list+0x591/0x1150 mm/vmscan.c:2048
 shrink_list mm/vmscan.c:2267 [inline]
 shrink_lruvec+0xced/0x3860 mm/vmscan.c:5408
 shrink_node_memcgs mm/vmscan.c:5595 [inline]
 shrink_node+0xdf3/0x1fb0 mm/vmscan.c:5625
 shrink_zones mm/vmscan.c:5828 [inline]
 do_try_to_free_pages+0x67e/0x15e0 mm/vmscan.c:5886
 try_to_free_mem_cgroup_pages+0x369/0x830 mm/vmscan.c:6204
 try_charge+0x4b8/0x15f0 mm/memcontrol.c:2742
 __mem_cgroup_charge+0x147/0x6e0 mm/memcontrol.c:6847
 mem_cgroup_charge include/linux/memcontrol.h:458 [inline]
 __add_to_page_cache_locked+0x29d/0xba0 mm/filemap.c:854
 add_to_page_cache_lru+0x117/0x2c0 mm/filemap.c:948
 pagecache_get_page+0x71e/0x950 mm/filemap.c:1859
 grab_cache_page_write_begin+0x5d/0xa0 mm/filemap.c:3456
 ext4_da_write_begin+0x587/0xf60 fs/ext4/inode.c:3065
 generic_perform_write+0x2cd/0x570 mm/filemap.c:3506
 ext4_buffered_write_iter+0x482/0x610 fs/ext4/file.c:271
 ext4_file_write_iter+0x193/0x1c80 fs/ext4/file.c:685
 __kernel_write+0x5ab/0x9d0 fs/read_write.c:550
 dump_emit+0x261/0x3a0 fs/coredump.c:849
 dump_user_range+0x71/0x1a0 fs/coredump.c:902
 elf_core_dump+0x33bd/0x3c10 fs/binfmt_elf.c:2287
 do_coredump+0x1eb8/0x2d60 fs/coredump.c:811
 get_signal+0x102c/0x1410 kernel/signal.c:2768
 arch_do_signal_or_restart+0xbd/0x17c0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:145 [inline]
 exit_to_user_mode_loop+0x9b/0xd0 kernel/entry/common.c:169
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 irqentry_exit_to_user_mode+0x55/0x80 kernel/entry/common.c:287
 irqentry_exit+0x12/0x60 kernel/entry/common.c:375
 exc_page_fault+0x33d/0x5b0 arch/x86/mm/fault.c:1521
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:571
RIP: 0033:0x610344e88e
Code: Unable to access opcode bytes at RIP 0x610344e864.
RSP: 002b:0000000020000398 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fd5047d9120 RCX: 00007fd5046b9b29
RDX: 0000000020000080 RSI: 0000000020000390 RDI: 0000000004000000
RBP: 00007fd50470547a R08: 00000000200003c0 R09: 00000000200003c0
R10: 00000000200000c0 R11: 0000000000000206 R12: 0000000000000000
R13: 000000000000000b R14: 00007fd5047d9120 R15: 00007ffc31b78b18

Allocated by task 1877:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:463
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 __alloc_file+0x29/0x330 fs/file_table.c:101
 alloc_empty_file+0x95/0x180 fs/file_table.c:151
 path_openat+0x105/0x3000 fs/namei.c:3501
 do_filp_open+0x21c/0x460 fs/namei.c:3542
 do_sys_openat2+0x13f/0x6f0 fs/open.c:1217
 do_sys_open fs/open.c:1233 [inline]
 __do_sys_openat fs/open.c:1249 [inline]
 __se_sys_openat fs/open.c:1244 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1244
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

Freed by task 1873:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1595 [inline]
 slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
 slab_free mm/slub.c:3203 [inline]
 kmem_cache_free+0xa9/0x1e0 mm/slub.c:3219
 file_free_rcu+0x9f/0xb0 fs/file_table.c:50
 rcu_do_batch+0x597/0xc40 kernel/rcu/tree.c:2493
 rcu_core+0x5ad/0xe40 kernel/rcu/tree.c:2734
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2747
 __do_softirq+0x268/0x5bb kernel/softirq.c:309

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 __call_rcu kernel/rcu/tree.c:2975 [inline]
 call_rcu+0x135/0x11f0 kernel/rcu/tree.c:3049
 file_free fs/file_table.c:58 [inline]
 __fput+0x59d/0x760 fs/file_table.c:299
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x129/0x190 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xbf/0xd0 kernel/entry/common.c:172
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 syscall_exit_to_user_mode+0xbc/0x1d0 kernel/entry/common.c:274
 do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack+0xe/0x10 mm/kasan/generic.c:353
 task_work_add+0x27/0x1d0 kernel/task_work.c:38
 fput_many+0xef/0x1b0 fs/file_table.c:342
 fput+0x1a/0x20 fs/file_table.c:358
 filp_close+0x106/0x150 fs/open.c:1331
 __close_fd+0x33/0x50 fs/file.c:703
 __do_sys_close fs/open.c:1344 [inline]
 __se_sys_close fs/open.c:1342 [inline]
 __x64_sys_close+0x68/0xc0 fs/open.c:1342
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

The buggy address belongs to the object at ffff888117b74300
 which belongs to the cache filp of size 296
The buggy address is located 72 bytes to the right of
 296-byte region [ffff888117b74300, ffff888117b74428)
The buggy address belongs to the page:
page:ffffea00045edd00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888117b74000 pfn:0x117b74
head:ffffea00045edd00 order:1 compound_mapcount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 ffffea0004750388 ffffea000462b008 ffff88810018b800
raw: ffff888117b74000 0000000000150011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 21168, ts 1278944228866, free_ts 1094786592010
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2455 [inline]
 prep_new_page+0x166/0x180 mm/page_alloc.c:2461
 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4253
 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5345
 allocate_slab mm/slub.c:1808 [inline]
 new_slab+0x80/0x400 mm/slub.c:1869
 new_slab_objects mm/slub.c:2627 [inline]
 ___slab_alloc+0x302/0x4b0 mm/slub.c:2791
 __slab_alloc+0x63/0xa0 mm/slub.c:2831
 slab_alloc_node mm/slub.c:2913 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x1b9/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 __alloc_file+0x29/0x330 fs/file_table.c:101
 alloc_empty_file+0x95/0x180 fs/file_table.c:151
 path_openat+0x105/0x3000 fs/namei.c:3501
 do_filp_open+0x21c/0x460 fs/namei.c:3542
 do_sys_openat2+0x13f/0x6f0 fs/open.c:1217
 do_sys_open fs/open.c:1233 [inline]
 __do_sys_openat fs/open.c:1249 [inline]
 __se_sys_openat fs/open.c:1244 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1244
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1348 [inline]
 free_pcp_prepare mm/page_alloc.c:1420 [inline]
 free_unref_page_prepare+0x2ae/0x2d0 mm/page_alloc.c:3335
 free_unref_page mm/page_alloc.c:3390 [inline]
 free_the_page+0x9e/0x370 mm/page_alloc.c:5404
 __free_pages+0x67/0xc0 mm/page_alloc.c:5415
 free_pages+0x7c/0x90 mm/page_alloc.c:5426
 kasan_depopulate_vmalloc_pte+0x6a/0x90 mm/kasan/shadow.c:354
 apply_to_pte_range mm/memory.c:2465 [inline]
 apply_to_pmd_range mm/memory.c:2501 [inline]
 apply_to_pud_range mm/memory.c:2529 [inline]
 apply_to_p4d_range mm/memory.c:2557 [inline]
 __apply_to_page_range+0x720/0x9e0 mm/memory.c:2584
 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2833
 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:464
 __purge_vmap_area_lazy+0x150e/0x1620 mm/vmalloc.c:1376
 _vm_unmap_aliases+0x334/0x3b0 mm/vmalloc.c:1773
 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:1796
 change_page_attr_set_clr+0x308/0x1050 arch/x86/mm/pat/set_memory.c:1732
 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1789 [inline]
 set_memory_ro+0xa1/0xe0 arch/x86/mm/pat/set_memory.c:1935
 bpf_jit_binary_lock_ro include/linux/filter.h:839 [inline]
 bpf_int_jit_compile+0x9829/0x9dc0 arch/x86/net/bpf_jit_comp.c:2130
 bpf_prog_select_runtime+0x735/0x9c0 kernel/bpf/core.c:1868
 bpf_prog_load kernel/bpf/syscall.c:2237 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:4429 [inline]
 __se_sys_bpf+0x1080e/0x11cb0 kernel/bpf/syscall.c:4385

Memory state around the buggy address:
 ffff888117b74300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888117b74380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888117b74400: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
                                                             ^
 ffff888117b74480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888117b74500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================