BUG: Bad page map in process syz.4.316  pte:ffff8881dea171c0 pmd:1e124b067
addr:000000110c239000 vm_flags:000000f9 anon_vma:0000000000000000 mapping:ffff8881e9f48280 index:9
file:syz.UBvUyI fault:ext4_filemap_fault mmap:ext4_file_mmap readpage:ext4_readpage
CPU: 0 PID: 1566 Comm: syz.4.316 Not tainted 5.4.290-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_bad_pte+0x572/0x590 mm/memory.c:560
 vm_normal_page+0x13c/0x1f0 mm/memory.c:649
 zap_pte_range mm/memory.c:1078 [inline]
 zap_pmd_range mm/memory.c:1222 [inline]
 zap_pud_range mm/memory.c:1251 [inline]
 zap_p4d_range mm/memory.c:1272 [inline]
 unmap_page_range+0xc00/0x2620 mm/memory.c:1293
 unmap_single_vma mm/memory.c:1338 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1370
 exit_mmap+0x2bc/0x520 mm/mmap.c:3191
 __mmput+0x92/0x2d0 kernel/fork.c:1101
 mmput+0x54/0x70 kernel/fork.c:1122
 exit_mm kernel/exit.c:538 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:848
 do_group_exit+0x13e/0x310 kernel/exit.c:984
 get_signal+0xe28/0x14b0 kernel/signal.c:2738
 do_signal+0xb3/0xf10 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc4/0x1b0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x19c/0x200 arch/x86/entry/common.c:194
 ret_from_intr+0x1c/0x1c
RIP: 0033:0x7f9f8e9624cd
Code: ff 48 83 e8 01 48 89 ee bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 e9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 11 fd ff ff e9 c0 fd ff ff e8 7b 32
RSP: 002b:00007ffe2a200dc0 EFLAGS: 00010202
RAX: 000000110c234000 RBX: 00007f9f8f7d9720 RCX: 0000000000000004
RDX: 00000000000011e1 RSI: 0000000000003147 RDI: 0000000000000010
RBP: ffffffff817c51e1 R08: 00007f9f8ecaa038 R09: 00007f9f8ec96000
R10: 00007f9f8e0f3008 R11: 0000000000000002 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff817c50c2 R15: 00000000000000c9
BUG: Bad rss-counter state mm:ffff8881f32d0000 type:MM_FILEPAGES val:1
==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: use-after-free in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: use-after-free in detach_if_pending+0x1c6/0x3d0 kernel/time/timer.c:841
Write of size 8 at addr ffff8881e124b1c8 by task syz.4.316/1566

CPU: 1 PID: 1566 Comm: syz.4.316 Tainted: G    B             5.4.290-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:137
 __hlist_del include/linux/list.h:791 [inline]
 detach_timer kernel/time/timer.c:824 [inline]
 detach_if_pending+0x1c6/0x3d0 kernel/time/timer.c:841
 try_to_del_timer_sync kernel/time/timer.c:1267 [inline]
 del_timer_sync+0x13c/0x230 kernel/time/timer.c:1410
 tun_flow_uninit+0x2f/0x290 drivers/net/tun.c:1452
 tun_free_netdev+0x7a/0x1b0 drivers/net/tun.c:2404
 netdev_run_todo+0xb7f/0xdf0 net/core/dev.c:9477
 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:112
 tun_detach drivers/net/tun.c:766 [inline]
 tun_chr_close+0xc4/0x140 drivers/net/tun.c:3563
 __fput+0x289/0x6c0 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x146/0x170 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xcaf/0x2bc0 kernel/exit.c:861
 do_group_exit+0x13e/0x310 kernel/exit.c:984
 get_signal+0xe28/0x14b0 kernel/signal.c:2738
 do_signal+0xb3/0xf10 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc4/0x1b0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x19c/0x200 arch/x86/entry/common.c:194
 ret_from_intr+0x1c/0x1c
RIP: 0033:0x7f9f8e9624cd
Code: Bad RIP value.
RSP: 002b:00007ffe2a200dc0 EFLAGS: 00010202
RAX: 000000110c234000 RBX: 00007f9f8f7d9720 RCX: 0000000000000004
RDX: 00000000000011e1 RSI: 0000000000003147 RDI: 0000000000000010
RBP: ffffffff817c51e1 R08: 00007f9f8ecaa038 R09: 00007f9f8ec96000
R10: 00007f9f8e0f3008 R11: 0000000000000002 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff817c50c2 R15: 00000000000000c9

The buggy address belongs to the page:
page:ffffea00078492c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 ffffea00071de688 ffffea00078da508 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x192/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 __alloc_pages include/linux/gfp.h:503 [inline]
 __alloc_pages_node include/linux/gfp.h:516 [inline]
 alloc_pages_node include/linux/gfp.h:530 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1f/0xc0 arch/x86/mm/pgtable.c:26
 do_fault_around mm/memory.c:3652 [inline]
 do_read_fault mm/memory.c:3693 [inline]
 do_fault mm/memory.c:3828 [inline]
 handle_pte_fault mm/memory.c:4059 [inline]
 __handle_mm_fault mm/memory.c:4183 [inline]
 handle_mm_fault+0x24ac/0x4920 mm/memory.c:4220
 do_user_addr_fault arch/x86/mm/fault.c:1444 [inline]
 __do_page_fault+0x515/0xb90 arch/x86/mm/fault.c:1505
 do_page_fault+0x37/0x360 arch/x86/mm/fault.c:1529
 page_fault+0x2f/0x40 arch/x86/entry/entry_64.S:1206
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare mm/page_alloc.c:1233 [inline]
 free_unref_page_prepare+0x2a3/0x390 mm/page_alloc.c:3085
 free_unref_page_list+0x10a/0x590 mm/page_alloc.c:3154
 release_pages+0xad8/0xb20 mm/swap.c:842
 free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:297
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:189 [inline]
 tlb_flush_mmu mm/mmu_gather.c:196 [inline]
 tlb_finish_mmu+0x177/0x320 mm/mmu_gather.c:277
 exit_mmap+0x2dc/0x520 mm/mmap.c:3193
 __mmput+0x92/0x2d0 kernel/fork.c:1101
 mmput+0x54/0x70 kernel/fork.c:1122
 exit_mm kernel/exit.c:538 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:848
 do_group_exit+0x13e/0x310 kernel/exit.c:984
 get_signal+0xe28/0x14b0 kernel/signal.c:2738
 do_signal+0xb3/0xf10 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc4/0x1b0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x19c/0x200 arch/x86/entry/common.c:194
 swapgs_restore_regs_and_return_to_usermode+0x0/0x54

Memory state around the buggy address:
 ffff8881e124b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881e124b100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881e124b180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8881e124b200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881e124b280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================