==================================================================
BUG: KASAN: use-after-free in __ptep_get arch/arm64/include/asm/pgtable.h:414 [inline]
BUG: KASAN: use-after-free in ptep_get arch/arm64/include/asm/pgtable.h:1749 [inline]
BUG: KASAN: use-after-free in filemap_map_folio_range mm/filemap.c:3666 [inline]
BUG: KASAN: use-after-free in filemap_map_pages+0xa94/0x155c mm/filemap.c:3783
Read of size 8 at addr ffff000102cdc000 by task syz.1.62/7002

CPU: 1 UID: 0 PID: 7002 Comm: syz.1.62 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 __ptep_get arch/arm64/include/asm/pgtable.h:414 [inline]
 ptep_get arch/arm64/include/asm/pgtable.h:1749 [inline]
 filemap_map_folio_range mm/filemap.c:3666 [inline]
 filemap_map_pages+0xa94/0x155c mm/filemap.c:3783
 do_fault_around mm/memory.c:5531 [inline]
 do_read_fault mm/memory.c:5564 [inline]
 do_fault mm/memory.c:5707 [inline]
 do_pte_missing mm/memory.c:4234 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x2b64/0x4d34 mm/memory.c:6364
 faultin_page mm/gup.c:1144 [inline]
 __get_user_pages+0x1f40/0x2da0 mm/gup.c:1446
 populate_vma_page_range+0x258/0x348 mm/gup.c:1880
 __mm_populate+0x208/0x330 mm/gup.c:1983
 mm_populate include/linux/mm.h:3367 [inline]
 vm_mmap_pgoff+0x398/0x45c mm/util.c:585
 ksys_mmap_pgoff+0x394/0x5b8 mm/mmap.c:604
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1b6a pfn:0x142cdc
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffdffc40b3748 ffff00019bd1e620 0000000000000000
raw: 0000000000001b6a 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000102cdbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff000102cdbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff000102cdc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff000102cdc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000102cdc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
page: refcount:99 mapcount:1 mapping:0000000062e3da14 index:0x380 pfn:0x140800
head: order:6 mapcount:34 entire_mapcount:0 nr_pages_mapped:34 pincount:0
memcg:ffff0000c19c0c80
aops:shmem_aops ino:2 dentry name(?):"memory.events.local"
flags: 0x5ffc0000002017d(locked|referenced|uptodate|dirty|lru|active|head|swapbacked|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc0000002017d fffffdffc3fc6008 fffffdffc4022808 ffff0000fa616c20
raw: 0000000000000380 0000000000000000 0000006300000000 ffff0000c19c0c80
head: 05ffc0000002017d fffffdffc3fc6008 fffffdffc4022808 ffff0000fa616c20
head: 0000000000000380 0000000000000000 0000006300000000 ffff0000c19c0c80
head: 05ffc00000000206 fffffdffc4020001 0000002200000021 00000000ffffffff
head: ffffffff00000021 0000000000000029 0000000000000000 0000000000000040
page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7002 at ./include/linux/rmap.h:427 __folio_rmap_sanity_checks+0x2ec/0x430 include/linux/rmap.h:427
Modules linked in:
CPU: 1 UID: 0 PID: 7002 Comm: syz.1.62 Tainted: G    B               6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __folio_rmap_sanity_checks+0x2ec/0x430 include/linux/rmap.h:427
lr : __folio_rmap_sanity_checks+0x2ec/0x430 include/linux/rmap.h:427
sp : ffff8000a3e472c0
x29: ffff8000a3e472c0 x28: 0000000000032c60 x27: 00000000203a0000
x26: 00e8000140822f43 x25: dfff800000000000 x24: 000000000020ac5d
x23: fffffdffc4cd2080 x22: fffffdffc4cd2048 x21: 0000000000000000
x20: 0000000000032c60 x19: fffffdffc4020000 x18: 0000000000000000
x17: 3030303030303020 x16: ffff80008b007230 x15: 0000000000000001
x14: 1ffff000147c8d84 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000080000 x10: 000000000007ffff x9 : 99214b6a19dda800
x8 : 99214b6a19dda800 x7 : 0000000000000001 x6 : ffff800080563af4
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807de560
x2 : 0000000000000002 x1 : 0000000000000001 x0 : 00000000000000e5
Call trace:
 __folio_rmap_sanity_checks+0x2ec/0x430 include/linux/rmap.h:427 (P)
 __folio_add_rmap mm/rmap.c:1252 [inline]
 __folio_add_file_rmap mm/rmap.c:1620 [inline]
 folio_add_file_rmap_ptes+0x84/0x8e8 mm/rmap.c:1642
 set_pte_range+0x2e4/0x49c mm/memory.c:5311
 filemap_map_folio_range mm/filemap.c:3673 [inline]
 filemap_map_pages+0xb54/0x155c mm/filemap.c:3783
 do_fault_around mm/memory.c:5531 [inline]
 do_read_fault mm/memory.c:5564 [inline]
 do_fault mm/memory.c:5707 [inline]
 do_pte_missing mm/memory.c:4234 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x2b64/0x4d34 mm/memory.c:6364
 faultin_page mm/gup.c:1144 [inline]
 __get_user_pages+0x1f40/0x2da0 mm/gup.c:1446
 populate_vma_page_range+0x258/0x348 mm/gup.c:1880
 __mm_populate+0x208/0x330 mm/gup.c:1983
 mm_populate include/linux/mm.h:3367 [inline]
 vm_mmap_pgoff+0x398/0x45c mm/util.c:585
 ksys_mmap_pgoff+0x394/0x5b8 mm/mmap.c:604
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
irq event stamp: 249
hardirqs last  enabled at (249): [<ffff80008b00487c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline]
hardirqs last  enabled at (249): [<ffff80008b00487c>] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96
hardirqs last disabled at (248): [<ffff80008b001cbc>] __el1_irq arch/arm64/kernel/entry-common.c:650 [inline]
hardirqs last disabled at (248): [<ffff80008b001cbc>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:668
softirqs last  enabled at (10): [<ffff800080201608>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (8): [<ffff8000802015d4>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7002 at ./include/linux/rmap.h:214 __folio_large_mapcount_sanity_checks+0x3d4/0x5dc include/linux/rmap.h:214
Modules linked in:
CPU: 1 UID: 0 PID: 7002 Comm: syz.1.62 Tainted: G    B   W           6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT 
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __folio_large_mapcount_sanity_checks+0x3d4/0x5dc include/linux/rmap.h:214
lr : __folio_large_mapcount_sanity_checks+0x3d4/0x5dc include/linux/rmap.h:214
sp : ffff8000a3e472b0
x29: ffff8000a3e472b0 x28: 0000000000032c60 x27: 1fffffbff880400f
x26: 1fffffbff8804000 x25: 1fffffbff8804001 x24: dfff800000000000
x23: 0000000000032c60 x22: fffffdffc4020078 x21: 0000000000000040
x20: fffffdffc4020008 x19: fffffdffc4020000 x18: 0000000000000000
x17: 3030303030303020 x16: ffff80008b007230 x15: 0000000000000001
x14: 1fffffbff880400d x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000080000 x10: 000000000007ffff x9 : ffff8000a86b7000
x8 : 0000000000080000 x7 : 0000000000000001 x6 : ffff800080563af4
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080b65b10
x2 : 0000000000000029 x1 : 0000000000032c60 x0 : 0000000000000040
Call trace:
 __folio_large_mapcount_sanity_checks+0x3d4/0x5dc include/linux/rmap.h:214 (P)
 folio_add_return_large_mapcount include/linux/rmap.h:250 [inline]
 __folio_add_rmap mm/rmap.c:1279 [inline]
 __folio_add_file_rmap mm/rmap.c:1620 [inline]
 folio_add_file_rmap_ptes+0x344/0x8e8 mm/rmap.c:1642
 set_pte_range+0x2e4/0x49c mm/memory.c:5311
 filemap_map_folio_range mm/filemap.c:3673 [inline]
 filemap_map_pages+0xb54/0x155c mm/filemap.c:3783
 do_fault_around mm/memory.c:5531 [inline]
 do_read_fault mm/memory.c:5564 [inline]
 do_fault mm/memory.c:5707 [inline]
 do_pte_missing mm/memory.c:4234 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x2b64/0x4d34 mm/memory.c:6364
 faultin_page mm/gup.c:1144 [inline]
 __get_user_pages+0x1f40/0x2da0 mm/gup.c:1446
 populate_vma_page_range+0x258/0x348 mm/gup.c:1880
 __mm_populate+0x208/0x330 mm/gup.c:1983
 mm_populate include/linux/mm.h:3367 [inline]
 vm_mmap_pgoff+0x398/0x45c mm/util.c:585
 ksys_mmap_pgoff+0x394/0x5b8 mm/mmap.c:604
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
irq event stamp: 249
hardirqs last  enabled at (249): [<ffff80008b00487c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline]
hardirqs last  enabled at (249): [<ffff80008b00487c>] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96
hardirqs last disabled at (248): [<ffff80008b001cbc>] __el1_irq arch/arm64/kernel/entry-common.c:650 [inline]
hardirqs last disabled at (248): [<ffff80008b001cbc>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:668
softirqs last  enabled at (10): [<ffff800080201608>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (8): [<ffff8000802015d4>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---