[syzbot] [mm?] KASAN: slab-use-after-free Read in mas_walk

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 192c0159402e Merge tag 'powerpc-7.0-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1304cc02580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aaa1d655bee4457b
dashboard link: https://syzkaller.appspot.com/bug?extid=54245a237762e7cbecf0
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d40ffa580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1704cc02580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a42150718371/disk-192c0159.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4cda72c184d0/vmlinux-192c0159.xz
kernel image: https://storage.googleapis.com/syzbot-assets/404b09fd74ca/bzImage-192c0159.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54245a...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in ma_dead_node lib/maple_tree.c:572 [inline]
BUG: KASAN: slab-use-after-free in mte_dead_node lib/maple_tree.c:587 [inline]
BUG: KASAN: slab-use-after-free in mas_start lib/maple_tree.c:1207 [inline]
BUG: KASAN: slab-use-after-free in mas_state_walk lib/maple_tree.c:3291 [inline]
BUG: KASAN: slab-use-after-free in mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
Read of size 8 at addr ffff888078907400 by task syz.0.18/6008

CPU: 0 UID: 0 PID: 6008 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
ma_dead_node lib/maple_tree.c:572 [inline]
mte_dead_node lib/maple_tree.c:587 [inline]
mas_start lib/maple_tree.c:1207 [inline]
mas_state_walk lib/maple_tree.c:3291 [inline]
mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
lock_vma_under_rcu+0x101/0x5a0 mm/mmap_lock.c:253
do_user_addr_fault+0x41f/0x12f0 arch/x86/mm/fault.c:1325
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x342000
Code: Unable to access opcode bytes at 0x341fd6.
RSP: 002b:000000000000000e EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007ff2e4816090 RCX: 00007ff2e459bf79
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0002000020003b4a
RBP: 00007ff2e46327e0 R08: 0000000000000103 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff2e4816128 R14: 00007ff2e4816090 R15: 00007ffc4f622688
</TASK>

Allocated by task 5934:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
mt_alloc_one lib/maple_tree.c:174 [inline]
mas_dup_build lib/maple_tree.c:6299 [inline]
__mt_dup+0x5a8/0xc20 lib/maple_tree.c:6382
dup_mmap+0x36d/0x1e20 mm/mmap.c:1744
dup_mm kernel/fork.c:1530 [inline]
copy_mm kernel/fork.c:1582 [inline]
copy_process+0x7371/0x79b0 kernel/fork.c:2223
kernel_clone+0xfc/0x930 kernel/fork.c:2654
__do_sys_clone+0xd9/0x120 kernel/fork.c:2795
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6003:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kfree+0x1c7/0x690 mm/slub.c:6886
mt_destroy_walk+0xc0a/0xfa0 lib/maple_tree.c:5028
mte_destroy_walk lib/maple_tree.c:5049 [inline]
mte_destroy_walk lib/maple_tree.c:5040 [inline]
__mt_destroy+0x2d7/0x390 lib/maple_tree.c:6446
exit_mmap+0x5d3/0xae0 mm/mmap.c:1312
__mmput+0x12a/0x410 kernel/fork.c:1174
mmput+0x67/0x80 kernel/fork.c:1197
exit_mm kernel/exit.c:581 [inline]
do_exit+0x78a/0x2a30 kernel/exit.c:959
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
__do_sys_exit_group kernel/exit.c:1123 [inline]
__se_sys_exit_group kernel/exit.c:1121 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888078907400
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
freed 256-byte region [ffff888078907400, ffff888078907500)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78906
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffea0001e24181 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5699, tgid 5699 (rm), ts 81546835733, free_ts 81543034225
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xdb3/0x1cb0 mm/slub.c:4656
__kmem_cache_alloc_bulk+0x20f/0x700 mm/slub.c:7439
refill_sheaf mm/slub.c:2650 [inline]
__prefill_sheaf_pfmemalloc+0x42/0x90 mm/slub.c:5328
kmem_cache_prefill_sheaf+0x1b7/0x420 mm/slub.c:5422
mt_get_sheaf lib/maple_tree.c:189 [inline]
mas_alloc_nodes+0x2c3/0x390 lib/maple_tree.c:1140
mas_preallocate+0x39c/0xf10 lib/maple_tree.c:5194
vma_iter_prealloc mm/vma.h:505 [inline]
vma_link+0x12c/0x750 mm/vma.c:1823
insert_vm_struct+0xf4/0x2d0 mm/vma.c:3288
__install_special_mapping mm/mmap.c:1460 [inline]
_install_special_mapping+0x187/0x3d0 mm/mmap.c:1496
map_vdso+0x1b0/0x560 arch/x86/entry/vdso/vma.c:168
arch_setup_additional_pages+0x41/0x60 arch/x86/entry/vdso/vma.c:238
page last free pid 5699 tgid 5699 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
__pagetable_free include/linux/mm.h:3197 [inline]
pagetable_free include/linux/mm.h:3221 [inline]
pagetable_dtor_free include/linux/mm.h:3325 [inline]
__pgd_free include/asm-generic/pgalloc.h:303 [inline]
_pgd_free arch/x86/mm/pgtable.c:319 [inline]
pgd_free+0x3f4/0x560 arch/x86/mm/pgtable.c:381
mm_free_pgd kernel/fork.c:585 [inline]
__mmdrop+0xe5/0x750 kernel/fork.c:727
mmdrop include/linux/sched/mm.h:55 [inline]
__mmput+0x379/0x410 kernel/fork.c:1186
mmput+0x67/0x80 kernel/fork.c:1197
exec_mmap fs/exec.c:893 [inline]
begin_new_exec+0x10f0/0x3840 fs/exec.c:1148
load_elf_binary+0x8f7/0x5110 fs/binfmt_elf.c:1010
search_binary_handler fs/exec.c:1664 [inline]
exec_binprm fs/exec.c:1696 [inline]
bprm_execve fs/exec.c:1748 [inline]
bprm_execve+0x8fb/0x1620 fs/exec.c:1724
do_execveat_common.isra.0+0x4a5/0x580 fs/exec.c:1846
__do_sys_execve fs/exec.c:1930 [inline]
__se_sys_execve fs/exec.c:1924 [inline]
__x64_sys_execve+0x93/0xd0 fs/exec.c:1924
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
ffff888078907300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888078907380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888078907400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888078907480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888078907500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Liam R. Howlett]

* syzbot <syzbot+54245a...@syzkaller.appspotmail.com> [260212 14:22]:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 192c0159402e Merge tag 'powerpc-7.0-1' of git://git.kernel..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1304cc02580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=aaa1d655bee4457b
> dashboard link: https://syzkaller.appspot.com/bug?extid=54245a237762e7cbecf0
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d40ffa580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1704cc02580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a42150718371/disk-192c0159.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/4cda72c184d0/vmlinux-192c0159.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/404b09fd74ca/bzImage-192c0159.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+54245a...@syzkaller.appspotmail.com

This looks like the mm is not reference counted correctly.

The maple tree has been destroyed via exit_mmap() while
do_user_addr_fault() is executing.

>
> ==================================================================
> BUG: KASAN: slab-use-after-free in ma_dead_node lib/maple_tree.c:572 [inline]
> BUG: KASAN: slab-use-after-free in mte_dead_node lib/maple_tree.c:587 [inline]
> BUG: KASAN: slab-use-after-free in mas_start lib/maple_tree.c:1207 [inline]

This shows it is the root node that is incorrect (which is stored in the
mm_struct directly).

> BUG: KASAN: slab-use-after-free in mas_state_walk lib/maple_tree.c:3291 [inline]
> BUG: KASAN: slab-use-after-free in mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
> Read of size 8 at addr ffff888078907400 by task syz.0.18/6008
>
> CPU: 0 UID: 0 PID: 6008 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x156/0x4c9 mm/kasan/report.c:482
> kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
> ma_dead_node lib/maple_tree.c:572 [inline]
> mte_dead_node lib/maple_tree.c:587 [inline]
> mas_start lib/maple_tree.c:1207 [inline]
> mas_state_walk lib/maple_tree.c:3291 [inline]
> mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
> lock_vma_under_rcu+0x101/0x5a0 mm/mmap_lock.c:253
> do_user_addr_fault+0x41f/0x12f0 arch/x86/mm/fault.c:1325

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

__mt_destroy() is called with rcu disabled because the last mm_struct
user should be gone.

exit_mmap() is only called when there are no mm users left, and then the
mm is write locked before removing the rcu protection on the tree.

It appears that somehow the fault has the mm without holding a reference
to it.

[Suren Baghdasaryan]

I tried reproducing on my qemu with the same head commit, config and
using C reproducer and it did not reproduce. I think the only
difference I have is the GCC version I used. Mine is gcc (Debian
15.2.0-3) 15.2.0.

[Liam R. Howlett]

* Suren Baghdasaryan <sur...@google.com> [260212 16:31]:

I get futex issues before I see this issue - but it could be related.

I was planning to add some debug tomorrow to see if I could figure it
out.

[Hillf Danton]

> Date: Thu, 12 Feb 2026 11:22:34 -0800 [thread overview]

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 192c0159402e Merge tag 'powerpc-7.0-1' of git://git.kernel..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1304cc02580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=aaa1d655bee4457b
> dashboard link: https://syzkaller.appspot.com/bug?extid=54245a237762e7cbecf0
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d40ffa580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1704cc02580000

Test tglx's fix.

#syz test

--- x/fs/proc/task_mmu.c
+++ y/fs/proc/task_mmu.c
@@ -780,7 +780,7 @@ static int do_procmap_query(struct mm_st
} else {
if (karg.build_id_size < build_id_sz) {
err = -ENAMETOOLONG;
- goto out;
+ goto out_file;
}
karg.build_id_size = build_id_sz;
}
@@ -808,6 +808,7 @@ static int do_procmap_query(struct mm_st
out:
query_vma_teardown(&lock_ctx);
mmput(mm);
+out_file:
if (vm_file)
fput(vm_file);
kfree(name_buf);
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+54245a...@syzkaller.appspotmail.com
Tested-by: syzbot+54245a...@syzkaller.appspotmail.com

Tested on:

commit: cee73b1e Merge tag 'riscv-for-linus-7.0-mw1' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10477a52580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe62ec9519bfdb19

dashboard link: https://syzkaller.appspot.com/bug?extid=54245a237762e7cbecf0
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=160a2eef980000

Note: testing is done by a robot and is best-effort only.

[Suren Baghdasaryan]

Thanks Hillf!
Makes sense. The reproduced does use PROCMAP_QUERY. The fix
https://lore.kernel.org/all/2026021223405...@smtp.kernel.org/
did not reach Linus' tree yet.

[Liam R. Howlett]

* Suren Baghdasaryan <sur...@google.com> [260213 01:00]:

Yes, thank you Hillf [1].

Happy to see it's already not a problem, and especially happy that I
don't need to dig deeper.

Cheers,
Liam

[1]. https://lore.kernel.org/all/20260213033815...@sina.com/