================================================================== BUG: KASAN: use-after-free in cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline] BUG: KASAN: use-after-free in cleancache_invalidate_page include/linux/cleancache.h:110 [inline] BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6d8/0x750 mm/filemap.c:163 Read of size 4 at addr ffff88812dea0470 by task syz-executor.2/25230 CPU: 0 PID: 25230 Comm: syz-executor.2 Tainted: G W 5.15.132-syzkaller-01173-g754f8cc9b7de #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:444 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 cleancache_fs_enabled_mapping include/linux/cleancache.h:56 [inline] cleancache_invalidate_page include/linux/cleancache.h:110 [inline] unaccount_page_cache_page+0x6d8/0x750 mm/filemap.c:163 __delete_from_page_cache+0xc6/0x5b0 mm/filemap.c:231 __remove_mapping+0x566/0x690 mm/vmscan.c:1200 shrink_page_list+0x2723/0x5c50 mm/vmscan.c:1797 shrink_inactive_list mm/vmscan.c:2304 [inline] shrink_list mm/vmscan.c:2549 [inline] shrink_lruvec+0x17ec/0x4580 mm/vmscan.c:5752 shrink_node_memcgs mm/vmscan.c:5944 [inline] shrink_node+0x1077/0x24e0 mm/vmscan.c:5974 shrink_zones mm/vmscan.c:6177 [inline] do_try_to_free_pages+0x5b6/0x1570 mm/vmscan.c:6235 try_to_free_mem_cgroup_pages+0x36c/0x850 mm/vmscan.c:6549 try_charge_memcg+0x48f/0x1550 mm/memcontrol.c:2686 try_charge mm/memcontrol.c:2811 [inline] charge_memcg+0x6b/0x1a0 mm/memcontrol.c:6813 __mem_cgroup_charge+0x37/0x130 mm/memcontrol.c:6849 mem_cgroup_charge include/linux/memcontrol.h:715 [inline] shmem_add_to_page_cache+0x6cf/0xe90 mm/shmem.c:719 shmem_getpage_gfp+0x1559/0x23c0 mm/shmem.c:1941 shmem_getpage mm/shmem.c:152 [inline] shmem_write_begin+0xca/0x1b0 mm/shmem.c:2478 generic_perform_write+0x2bc/0x5a0 mm/filemap.c:3833 __generic_file_write_iter+0x25b/0x4b0 mm/filemap.c:3960 generic_file_write_iter+0xaf/0x1c0 mm/filemap.c:3992 call_write_iter include/linux/fs.h:2159 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0xd5d/0x1110 fs/read_write.c:594 ksys_write+0x199/0x2c0 fs/read_write.c:647 __do_sys_write fs/read_write.c:659 [inline] __se_sys_write fs/read_write.c:656 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:656 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f24ce80782f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 b9 80 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c 81 02 00 48 RSP: 002b:00007f24cd58ae70 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000004000000 RCX: 00007f24ce80782f RDX: 0000000004000000 RSI: 00007f24c516b000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000105a0 R10: 00000000200106c2 R11: 0000000000000293 R12: 0000000000000003 R13: 00007f24cd58af3c R14: 00007f24cd58af40 R15: 00007f24c516b000 The buggy address belongs to the page: page:ffffea0004b7a800 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x12dea0 flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea0004363a08 ffffea000463ca08 0000000000000000 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112c42(GFP_NOFS|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 16655, ts 2836814392107, free_ts 2837116654533 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2602 prep_new_page+0x1b/0x110 mm/page_alloc.c:2608 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4482 __alloc_pages+0x206/0x5e0 mm/page_alloc.c:5773 __alloc_pages_node include/linux/gfp.h:591 [inline] alloc_pages_node include/linux/gfp.h:605 [inline] alloc_pages include/linux/gfp.h:618 [inline] __page_cache_alloc include/linux/pagemap.h:305 [inline] page_cache_ra_unbounded+0x316/0x920 mm/readahead.c:227 do_page_cache_ra mm/readahead.c:280 [inline] ondemand_readahead+0x9c8/0xfa0 mm/readahead.c:565 page_cache_async_ra+0x2a3/0x2e0 mm/readahead.c:624 page_cache_async_readahead include/linux/pagemap.h:854 [inline] filemap_readahead mm/filemap.c:2525 [inline] filemap_get_pages mm/filemap.c:2567 [inline] filemap_read+0x922/0x21c0 mm/filemap.c:2634 generic_file_read_iter+0xae/0x420 mm/filemap.c:2785 call_read_iter include/linux/fs.h:2153 [inline] generic_file_splice_read+0x4aa/0x780 fs/splice.c:311 do_splice_to fs/splice.c:796 [inline] splice_direct_to_actor+0x439/0xbe0 fs/splice.c:870 do_splice_direct+0x27f/0x3c0 fs/splice.c:979 do_sendfile+0x616/0xfe0 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline] __x64_sys_sendfile64+0x1ce/0x230 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1469 [inline] free_pcp_prepare mm/page_alloc.c:1541 [inline] free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3531 free_unref_page_list+0x14b/0xa60 mm/page_alloc.c:3668 release_pages+0x1310/0x1370 mm/swap.c:1009 __pagevec_release+0x84/0x100 mm/swap.c:1029 pagevec_release include/linux/pagevec.h:81 [inline] truncate_inode_pages_range+0x482/0x1160 mm/truncate.c:329 truncate_inode_pages mm/truncate.c:425 [inline] truncate_inode_pages_final+0x83/0x90 mm/truncate.c:464 evict+0x2b6/0x630 fs/inode.c:589 iput_final fs/inode.c:1705 [inline] iput+0x63b/0x7e0 fs/inode.c:1731 dentry_unlink_inode+0x34f/0x440 fs/dcache.c:376 __dentry_kill+0x447/0x660 fs/dcache.c:582 shrink_dentry_list+0x35e/0x4b0 fs/dcache.c:1176 shrink_dcache_parent+0xc9/0x340 do_one_tree+0x27/0xe0 fs/dcache.c:1657 shrink_dcache_for_umount+0x7d/0x120 fs/dcache.c:1674 generic_shutdown_super+0x69/0x2e0 fs/super.c:447 kill_anon_super fs/super.c:1076 [inline] kill_litter_super+0x76/0xa0 fs/super.c:1085 Memory state around the buggy address: ffff88812dea0300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812dea0380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88812dea0400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88812dea0480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812dea0500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================