==================================================================
BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:54 [inline]
BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:108 [inline]
BUG: KASAN: use-after-free in unaccount_page_cache_page+0x639/0x6b0 mm/filemap.c:169
Read of size 4 at addr ffff88819994a488 by task syz-executor.0/17286

CPU: 0 PID: 17286 Comm: syz-executor.0 Not tainted 5.4.225-syzkaller-00003-gf4e4be09c27c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 cleancache_fs_enabled_mapping include/linux/cleancache.h:54 [inline]
 cleancache_invalidate_page include/linux/cleancache.h:108 [inline]
 unaccount_page_cache_page+0x639/0x6b0 mm/filemap.c:169
 __delete_from_page_cache+0xc3/0x510 mm/filemap.c:237
 __remove_mapping+0x46e/0x550 mm/vmscan.c:978
 shrink_page_list+0x2467/0x3e70 mm/vmscan.c:1482
 shrink_inactive_list+0x4f6/0xfd0 mm/vmscan.c:2001
 shrink_list mm/vmscan.c:2293 [inline]
 shrink_node_memcg+0xc42/0x2430 mm/vmscan.c:2623
 shrink_node+0x396/0x12b0 mm/vmscan.c:2836
 shrink_zones mm/vmscan.c:3053 [inline]
 do_try_to_free_pages+0x625/0x1280 mm/vmscan.c:3111
 try_to_free_mem_cgroup_pages+0x3f6/0x9b0 mm/vmscan.c:3412
 try_charge+0x505/0x14e0 mm/memcontrol.c:2616
 mem_cgroup_try_charge+0x249/0x370 mm/memcontrol.c:6571
 __add_to_page_cache_locked+0x22e/0x8f0 mm/filemap.c:865
 add_to_page_cache_lru+0x117/0x2c0 mm/filemap.c:962
 pagecache_get_page+0x50a/0x750 mm/filemap.c:1701
 grab_cache_page_write_begin+0x51/0x90 mm/filemap.c:3261
 ext4_da_write_begin+0x58d/0xfe0 fs/ext4/inode.c:3151
 generic_perform_write+0x2c7/0x560 mm/filemap.c:3311
 __generic_file_write_iter+0x239/0x490 mm/filemap.c:3440
 ext4_file_write_iter+0x499/0x10e0 fs/ext4/file.c:270
 call_write_iter include/linux/fs.h:1981 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0x5d3/0x750 fs/read_write.c:496
 __kernel_write+0x10f/0x350 fs/read_write.c:515
 dump_emit+0x213/0x350 fs/coredump.c:838
 elf_core_dump+0x3e06/0x4730 fs/binfmt_elf.c:2352
 do_coredump+0x1fd7/0x2da0 fs/coredump.c:801
 get_signal+0xd66/0x13f0 kernel/signal.c:2729
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 retint_user+0x8/0x8

Allocated by task 13944:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x130/0x1d0 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0xfb/0x290 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1079 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 rtmsg_ifinfo_build_skb+0x81/0x180 net/core/rtnetlink.c:3503
 rollback_registered_many+0xd17/0x12e0 net/core/dev.c:8621
 unregister_netdevice_many+0x46/0x250 net/core/dev.c:9774
 ip_tunnel_delete_nets+0x33b/0x380 net/ipv4/ip_tunnel.c:1115
 ops_exit_list net/core/net_namespace.c:184 [inline]
 cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
 process_one_work+0x765/0xd20 kernel/workqueue.c:2287
 worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354

Freed by task 13944:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x178/0x230 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0xeb/0x320 mm/slub.c:4071
 skb_release_all net/core/skbuff.c:675 [inline]
 __kfree_skb net/core/skbuff.c:689 [inline]
 consume_skb+0xa5/0x2a0 net/core/skbuff.c:849
 netlink_broadcast_filtered+0x115f/0x1280 net/netlink/af_netlink.c:1522
 netlink_broadcast net/netlink/af_netlink.c:1544 [inline]
 nlmsg_multicast include/net/netlink.h:968 [inline]
 nlmsg_notify+0xf7/0x1b0 net/netlink/af_netlink.c:2542
 rollback_registered_many+0xda9/0x12e0 net/core/dev.c:8634
 unregister_netdevice_many+0x46/0x250 net/core/dev.c:9774
 ip_tunnel_delete_nets+0x33b/0x380 net/ipv4/ip_tunnel.c:1115
 ops_exit_list net/core/net_namespace.c:184 [inline]
 cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
 process_one_work+0x765/0xd20 kernel/workqueue.c:2287
 worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354

The buggy address belongs to the object at ffff88819994a000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1160 bytes inside of
 2048-byte region [ffff88819994a000, ffff88819994a800)
The buggy address belongs to the page:
page:ffffea0006665200 refcount:1 mapcount:0 mapping:ffff8881f5c0c000 index:0xffff88819994c000 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea00069e0c08 ffffea00069e3408 ffff8881f5c0c000
raw: ffff88819994c000 0000000000080006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2ce8/0x2d70 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x5a/0x90 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x168/0x290 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 pskb_expand_head+0x10d/0x1060 net/core/skbuff.c:1647
 netlink_trim+0x198/0x230 net/netlink/af_netlink.c:1294
 netlink_broadcast_filtered+0x62/0x1280 net/netlink/af_netlink.c:1499
 netlink_broadcast net/netlink/af_netlink.c:1544 [inline]
 nlmsg_multicast include/net/netlink.h:968 [inline]
 nlmsg_notify+0xf7/0x1b0 net/netlink/af_netlink.c:2542
 netdev_state_change+0x15a/0x1e0 net/core/dev.c:1275
 linkwatch_do_dev+0xfc/0x130 net/core/link_watch.c:159
 __linkwatch_run_queue+0x4cc/0x7f0 net/core/link_watch.c:205
 linkwatch_event+0x48/0x50 net/core/link_watch.c:244
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x83d/0x940 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4953 [inline]
 __free_pages+0x91/0x140 mm/page_alloc.c:4959
 __free_slab+0x221/0x2e0 mm/slub.c:1774
 free_slab mm/slub.c:1789 [inline]
 discard_slab mm/slub.c:1795 [inline]
 unfreeze_partials+0x14e/0x180 mm/slub.c:2288
 put_cpu_partial+0xb4/0x150 mm/slub.c:2324
 __slab_free+0x288/0x350 mm/slub.c:2971
 qlist_free_all+0x43/0xb0 mm/kasan/quarantine.c:167
 quarantine_reduce+0x174/0x190 mm/kasan/quarantine.c:260
 __kasan_kmalloc+0x43/0x1d0 mm/kasan/common.c:507
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc+0x100/0x2b0 mm/slub.c:3909
 kmalloc include/linux/slab.h:561 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 fib_create_info+0x8d8/0x1f40 net/ipv4/fib_semantics.c:1455
 fib_table_insert+0x1cc/0x19b0 net/ipv4/fib_trie.c:1142
 fib_magic net/ipv4/fib_frontend.c:1097 [inline]
 fib_add_ifaddr+0x10ae/0x1a40 net/ipv4/fib_frontend.c:1143
 fib_netdev_event+0x1f0/0x550 net/ipv4/fib_frontend.c:1481
 notifier_call_chain kernel/notifier.c:98 [inline]
 __raw_notifier_call_chain kernel/notifier.c:399 [inline]
 raw_notifier_call_chain+0x95/0x110 kernel/notifier.c:406
 __dev_notify_flags+0x26e/0x510 net/core/dev.c:1670

Memory state around the buggy address:
 ffff88819994a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88819994a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88819994a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88819994a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88819994a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syz-executor.0 (17286) used greatest stack depth: 19384 bytes left