==================================================================
BUG: KASAN: global-out-of-bounds in f2fs_release_page+0xb15/0xb90 fs/f2fs/data.c:3775
Read of size 4 at addr ffffffff8579aa18 by task syz-executor.5/6124
CPU: 1 PID: 6124 Comm: syz-executor.5 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x81/0x3c0 mm/kasan/report.c:233
__kasan_report mm/kasan/report.c:419 [inline]
kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
f2fs_release_page+0xb15/0xb90 fs/f2fs/data.c:3775
try_to_release_page+0x1bd/0x210 mm/filemap.c:3664
shrink_page_list+0x240a/0x3c60 mm/vmscan.c:1453
shrink_inactive_list+0x38f/0xcd0 mm/vmscan.c:2016
shrink_list mm/vmscan.c:2240 [inline]
shrink_lruvec+0x499/0xa50 mm/vmscan.c:2558
shrink_node_memcgs+0x44f/0x9a0 mm/vmscan.c:2749
shrink_node+0xce1/0x1b30 mm/vmscan.c:2866
shrink_zones+0x48d/0x960 mm/vmscan.c:3069
do_try_to_free_pages+0x217/0xa50 mm/vmscan.c:3125
try_to_free_mem_cgroup_pages+0x3a2/0x840 mm/vmscan.c:3443
memory_high_write+0x220/0x390 mm/memcontrol.c:6389
cgroup_file_write+0x28e/0x590 kernel/cgroup/cgroup.c:3853
kernfs_fop_write_iter+0x2d0/0x410 fs/kernfs/file.c:296
do_iter_readv_writev+0x52a/0x720 fs/read_write.c:737
do_iter_write+0x182/0x660 fs/read_write.c:866
vfs_iter_write+0x7c/0xa0 fs/read_write.c:907
iter_file_splice_write+0x8a1/0x10c0 fs/splice.c:686
do_splice_from fs/splice.c:764 [inline]
direct_splice_actor+0xfe/0x130 fs/splice.c:933
splice_direct_to_actor+0x4f4/0xbd0 fs/splice.c:888
do_splice_direct+0x2a0/0x3f0 fs/splice.c:976
do_sendfile+0x9c7/0x1150 fs/read_write.c:1257
__do_sys_sendfile64 fs/read_write.c:1318 [inline]
__se_sys_sendfile64 fs/read_write.c:1304 [inline]
__x64_sys_sendfile64+0x1ce/0x230 fs/read_write.c:1304
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7f314d4f3169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f314c245168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f314d613050 RCX: 00007f314d4f3169
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000008
RBP: 00007f314d54eca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffe092a69f R14: 00007f314c245300 R15: 0000000000022000
The buggy address belongs to the variable:
neigh_valid_dump_req.__msg.56+0x38/0x60
Memory state around the buggy address:
ffffffff8579a900: f9 f9 f9 f9 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9
ffffffff8579a980: 00 00 00 00 00 00 03 f9 f9 f9 f9 f9 00 00 00 00
>ffffffff8579aa00: 00 00 02 f9 f9 f9 f9 f9 00 00 00 00 00 07 f9 f9
^
ffffffff8579aa80: f9 f9 f9 f9 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9
ffffffff8579ab00: 00 00 00 00 00 00 00 01 f9 f9 f9 f9 00 00 00 00
==================================================================