==================================================================
BUG: KASAN: use-after-free in __rb_insert lib/rbtree.c:115 [inline]
BUG: KASAN: use-after-free in __rb_insert_augmented+0xaa/0x670 lib/rbtree.c:459
Read of size 8 at addr ffff8881c0000008 by task syz-executor.0/17308

CPU: 0 PID: 17308 Comm: syz-executor.0 Tainted: G        W         5.15.75-syzkaller-00546-gd9d889009b78 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
 print_address_description+0x87/0x3d0 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x1a6/0x1f0 mm/kasan/report.c:452
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 __rb_insert lib/rbtree.c:115 [inline]
 __rb_insert_augmented+0xaa/0x670 lib/rbtree.c:459
 rb_insert_augmented include/linux/rbtree_augmented.h:50 [inline]
 rb_insert_augmented_cached include/linux/rbtree_augmented.h:60 [inline]
 vma_interval_tree_insert+0x2f3/0x310 mm/interval_tree.c:23
 __vma_link_file mm/mmap.c:674 [inline]
 vma_link+0x18a/0x1f0 mm/mmap.c:700
 mmap_region+0x16dd/0x1af0 mm/mmap.c:1853
 do_mmap+0x785/0xe40 mm/mmap.c:1584
 vm_mmap_pgoff+0x1d4/0x420 mm/util.c:554
 vm_mmap+0x8d/0xb0 mm/util.c:574
 elf_map+0x1b1/0x310 fs/binfmt_elf.c:392
 load_elf_binary+0x101c/0x27c0 fs/binfmt_elf.c:1141
 search_binary_handler fs/exec.c:1739 [inline]
 exec_binprm+0x2a8/0xbc0 fs/exec.c:1780
 bprm_execve+0x4f0/0x7f0 fs/exec.c:1849
 do_execveat_common+0xa92/0xc80 fs/exec.c:1954
 do_execve fs/exec.c:2024 [inline]
 __do_sys_execve fs/exec.c:2100 [inline]
 __se_sys_execve fs/exec.c:2095 [inline]
 __x64_sys_execve+0x92/0xb0 fs/exec.c:2095
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x4ae0d6
Code: Unable to access opcode bytes at RIP 0x4ae0ac.
RSP: 002b:000000c00336b288 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004ae0d6
RDX: 000000c01319c960 RSI: 000000c00b5e6048 RDI: 000000c01bcbe318
RBP: 000000c00336b430 R08: 0000000000000008 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00000000004a4aef
R13: 0000000000000001 R14: 000000c0004bb040 R15: ffffffffffffffff
 </TASK>

The buggy address belongs to the page:
page:ffffea0007000000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1c0000
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0007010008 ffffea0006ff0008 0000000000000000
raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff8881bfffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881bfffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881c0000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff8881c0000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881c0000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================