md: recovery of RAID array md0
md: md0: recovery done.
==================================================================
BUG: KASAN: slab-use-after-free in r1buf_pool_alloc+0x8bc/0xc10 drivers/md/raid1.c:184
Read of size 4 at addr ffff88802d44d968 by task md0_resync/12489

CPU: 0 PID: 12489 Comm: md0_resync Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 r1buf_pool_alloc+0x8bc/0xc10 drivers/md/raid1.c:184
 mempool_init_node+0x1e9/0x480 mm/mempool.c:227
 mempool_init+0x3a/0x50 mm/mempool.c:256
 init_resync drivers/md/raid1.c:2615 [inline]
 raid1_sync_request+0x29b/0x3060 drivers/md/raid1.c:2665
 md_do_sync+0x3ae9/0x45d0 drivers/md/md.c:9175
 md_thread+0x27b/0x460 drivers/md/md.c:8017
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Allocated by task 12454:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:600 [inline]
 raid1_reshape+0x79f/0x15e0 drivers/md/raid1.c:3276
 chunk_size_store+0x2a5/0x430 drivers/md/md.c:4284
 md_attr_store+0x196/0x380 drivers/md/md.c:5637
 kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 12491:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 raid1_reshape+0x1133/0x15e0 drivers/md/raid1.c:3319
 chunk_size_store+0x2a5/0x430 drivers/md/md.c:4284
 md_attr_store+0x196/0x380 drivers/md/md.c:5637
 kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff88802d44d960
 which belongs to the cache kmalloc-16 of size 16
The buggy address is located 8 bytes inside of
 freed 16-byte region [ffff88802d44d960, ffff88802d44d970)

The buggy address belongs to the physical page:
page:ffffea0000b51340 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802d44dc40 pfn:0x2d44d
anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888017c413c0 0000000000000000 dead000000000001
raw: ffff88802d44dc40 000000008080007f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 24717494415, free_ts 24716992905
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2118
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc_node_track_caller+0xa4/0x230 mm/slab_common.c:1027
 __do_krealloc mm/slab_common.c:1402 [inline]
 krealloc+0x86/0x120 mm/slab_common.c:1435
 add_sysfs_param+0x169/0x940 kernel/params.c:655
 kernel_add_sysfs_param+0xaf/0x120 kernel/params.c:799
 param_sysfs_builtin+0x1fd/0x2b0 kernel/params.c:838
 param_sysfs_builtin_init+0x2d/0x30 kernel/params.c:974
 do_one_initcall+0x242/0x790 init/main.c:1210
 do_initcall_level+0x13d/0x1f0 init/main.c:1272
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1182 [inline]
 free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505
 release_pages+0x208a/0x2300 mm/swap.c:1022
 tlb_batch_pages_flush mm/mmu_gather.c:99 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:294 [inline]
 tlb_flush_mmu+0x379/0x510 mm/mmu_gather.c:301
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:425
 exit_mmap+0x428/0xb90 mm/mmap.c:3315
 __mmput+0x118/0x3a0 kernel/fork.c:1362
 free_bprm+0x144/0x390 fs/exec.c:1514
 kernel_execve+0x3e9/0x980 fs/exec.c:2060
 call_usermodehelper_exec_async+0x20b/0x350 kernel/umh.c:110
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Memory state around the buggy address:
 ffff88802d44d800: fa fb fc fc fa fb fc fc 00 02 fc fc 00 02 fc fc
 ffff88802d44d880: 00 00 fc fc 00 01 fc fc 00 01 fc fc fa fb fc fc
>ffff88802d44d900: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc
                                                          ^
 ffff88802d44d980: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc
 ffff88802d44da00: fa fb fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc
==================================================================