==================================================================
BUG: KASAN: double-free in rcu_free_sheaf+0x31/0x200 mm/slub.c:6182
Free of addr ffff888077f2d300 by task syz.2.3335/21171

CPU: 1 UID: 0 PID: 21171 Comm: syz.2.3335 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report_invalid_free+0xea/0x110 mm/kasan/report.c:557
 check_slab_allocation mm/kasan/common.c:-1 [inline]
 __kasan_slab_pre_free+0x104/0x120 mm/kasan/common.c:272
 kasan_slab_pre_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:2725 [inline]
 __rcu_free_sheaf_prepare+0x10a/0x2a0 mm/slub.c:3041
 rcu_free_sheaf+0x31/0x200 mm/slub.c:6182
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:may_expand_vm+0xb0/0x390 mm/mmap.c:1351
Code: be 20 04 00 00 4c 03 33 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 f7 e8 53 df 16 00 4d 8b 36 <49> c1 ee 0c 48 89 ef 4c 89 f6 e8 01 29 a1 ff 4c 39 f5 76 0c e8 27
RSP: 0018:ffffc900058a7a98 EFLAGS: 00000246
RAX: 1ffff110067a2f04 RBX: ffff88802ede8990 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc900058a7be0 RDI: ffff888029166e40
RBP: 00000000000063fd R08: ffffc900058a7be7 R09: 1ffff92000b14f7c
R10: dffffc0000000000 R11: fffff52000b14f7d R12: 1ffff11005dbd132
R13: ffffc900058a7be0 R14: 0000000015000000 R15: ffff888029166e40
 mprotect_fixup+0x35e/0xda0 mm/mprotect.c:807
 do_mprotect_pkey+0x8e7/0xd10 mm/mprotect.c:1001
 __do_sys_mprotect mm/mprotect.c:1022 [inline]
 __se_sys_mprotect mm/mprotect.c:1019 [inline]
 __x64_sys_mprotect+0x80/0x90 mm/mprotect.c:1019
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f11d539e0d7
Code: 89 38 eb 84 0f 1f 80 00 00 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 7a ff ff ff b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe62268eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007f11d63236c0 RCX: 00007f11d539e0d7
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f11d6304000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007ffe62269010
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>

Allocated by task 4018:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x31c/0x600 mm/slub.c:5680
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 hwsim_update_pib+0x7e/0x400 drivers/net/ieee802154/mac802154_hwsim.c:103
 hwsim_set_promiscuous_mode+0x196/0x2e0 drivers/net/ieee802154/mac802154_hwsim.c:326
 drv_set_promiscuous_mode+0x154/0x2d0 net/mac802154/driver-ops.h:127
 drv_start+0x4db/0x1000 net/mac802154/driver-ops.h:167
 mac802154_scan_worker+0x8e6/0xe60 net/mac802154/scan.c:248
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 21171:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2780 [inline]
 __rcu_free_sheaf_prepare+0x12d/0x2a0 mm/slub.c:3041
 rcu_free_sheaf+0x31/0x200 mm/slub.c:6182
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

The buggy address belongs to the object at ffff888077f2d300
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff888077f2d300, ffff888077f2d340)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77f2d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801c0418c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5256, tgid 5256 (S35iptables), ts 44301420789
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1854
 prep_new_page mm/page_alloc.c:1862 [inline]
 get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3933
 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5480
 alloc_slab_page mm/slub.c:3384 [inline]
 allocate_slab+0x7d/0x5e0 mm/slub.c:3499
 new_slab mm/slub.c:3550 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7539
 refill_sheaf mm/slub.c:2917 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4811
 alloc_from_pcs mm/slub.c:4887 [inline]
 slab_alloc_node mm/slub.c:5021 [inline]
 __do_kmalloc_node mm/slub.c:5530 [inline]
 __kmalloc_noprof+0x476/0x710 mm/slub.c:5556
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 tomoyo_add_entry security/tomoyo/common.c:2166 [inline]
 tomoyo_supervisor+0xc4e/0x1550 security/tomoyo/common.c:2238
 tomoyo_audit_path_log security/tomoyo/file.c:169 [inline]
 tomoyo_path_permission+0x262/0x3b0 security/tomoyo/file.c:592
 tomoyo_check_open_permission+0x2b2/0x470 security/tomoyo/file.c:782
 security_file_open+0xa9/0x240 security/security.c:2785
 do_dentry_open+0x495/0x1360 fs/open.c:977
 vfs_open_consume+0x4a/0x350 fs/open.c:1131
 do_open fs/namei.c:4893 [inline]
 path_openat+0x16fc/0x20f0 fs/namei.c:5058
 do_file_open+0x258/0x570 fs/namei.c:5087
 do_sys_openat2+0x115/0x200 fs/open.c:1442
page last free pid 4981 tgid 4981 ts 43836281173 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1401 [inline]
 __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2952
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

Memory state around the buggy address:
 ffff888077f2d200: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
 ffff888077f2d280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff888077f2d300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff888077f2d380: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff888077f2d400: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	be 20 04 00 00       	mov    $0x420,%esi
   5:	4c 03 33             	add    (%rbx),%r14
   8:	4c 89 f0             	mov    %r14,%rax
   b:	48 c1 e8 03          	shr    $0x3,%rax
   f:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  16:	fc ff df
  19:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1)
  1d:	74 08                	je     0x27
  1f:	4c 89 f7             	mov    %r14,%rdi
  22:	e8 53 df 16 00       	call   0x16df7a
  27:	4d 8b 36             	mov    (%r14),%r14
* 2a:	49 c1 ee 0c          	shr    $0xc,%r14 <-- trapping instruction
  2e:	48 89 ef             	mov    %rbp,%rdi
  31:	4c 89 f6             	mov    %r14,%rsi
  34:	e8 01 29 a1 ff       	call   0xffa1293a
  39:	4c 39 f5             	cmp    %r14,%rbp
  3c:	76 0c                	jbe    0x4a
  3e:	e8                   	.byte 0xe8
  3f:	27                   	(bad)