Warning: Permanently added '10.128.15.195' (ED25519) to the list of known hosts. executing program executing program executing program executing program executing program [ 42.978763][ T3981] loop1: detected capacity change from 0 to 40427 [ 43.029985][ T3981] ======================================================= [ 43.029985][ T3981] WARNING: The mand mount option has been deprecated and [ 43.029985][ T3981] and is ignored by this kernel. Remove the mand [ 43.029985][ T3981] option from the mount to silence this warning. [ 43.029985][ T3981] ======================================================= [ 43.055786][ T3979] loop4: detected capacity change from 0 to 40427 [ 43.075359][ T3972] loop0: detected capacity change from 0 to 40427 [ 43.089747][ T3981] F2FS-fs (loop1): Found nat_bits in checkpoint [ 43.103993][ T3973] loop2: detected capacity change from 0 to 40427 [ 43.119351][ T3972] F2FS-fs (loop0): Found nat_bits in checkpoint [ 43.124246][ T3980] loop3: detected capacity change from 0 to 40427 [ 43.126694][ T3981] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 43.132481][ T3981] F2FS-fs (loop1): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.133832][ T3972] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 43.134846][ T3981] CPU: 0 PID: 3981 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0 [ 43.138977][ T3981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.141626][ T3981] Call trace: [ 43.142526][ T3981] dump_backtrace+0x0/0x530 [ 43.143712][ T3981] show_stack+0x2c/0x3c [ 43.144801][ T3981] dump_stack_lvl+0x108/0x170 [ 43.146051][ T3981] dump_stack+0x1c/0x58 [ 43.147078][ T3981] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.148496][ T3981] f2fs_iget+0x1aa0/0x53b8 [ 43.149673][ T3981] f2fs_nfs_get_inode+0x80/0x118 [ 43.151013][ T3981] generic_fh_to_dentry+0x9c/0x104 [ 43.151671][ T3972] F2FS-fs (loop0): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.152349][ T3981] f2fs_fh_to_dentry+0x44/0x58 [ 43.152367][ T3981] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.152384][ T3981] exportfs_decode_fh+0x50/0x80 [ 43.158302][ T3981] do_handle_open+0x5b8/0x9fc [ 43.159521][ T3981] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.161098][ T3981] invoke_syscall+0x98/0x2b8 [ 43.162360][ T3981] el0_svc_common+0x138/0x258 [ 43.163542][ T3981] do_el0_svc+0x58/0x14c [ 43.164767][ T3981] el0_svc+0x7c/0x1f0 [ 43.165800][ T3981] el0t_64_sync_handler+0x84/0xe4 [ 43.167123][ T3981] el0t_64_sync+0x1a0/0x1a4 [ 43.169849][ T3972] CPU: 0 PID: 3972 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0 [ 43.172205][ T3972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.174838][ T3972] Call trace: [ 43.175736][ T3972] dump_backtrace+0x0/0x530 [ 43.176847][ T3972] show_stack+0x2c/0x3c [ 43.177950][ T3972] dump_stack_lvl+0x108/0x170 [ 43.179187][ T3972] dump_stack+0x1c/0x58 [ 43.180304][ T3972] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.181775][ T3972] f2fs_iget+0x1aa0/0x53b8 [ 43.182908][ T3972] f2fs_nfs_get_inode+0x80/0x118 [ 43.184152][ T3972] generic_fh_to_dentry+0x9c/0x104 [ 43.185539][ T3972] f2fs_fh_to_dentry+0x44/0x58 [ 43.186839][ T3972] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.188250][ T3972] exportfs_decode_fh+0x50/0x80 [ 43.189635][ T3972] do_handle_open+0x5b8/0x9fc [ 43.190863][ T3972] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.192369][ T3972] invoke_syscall+0x98/0x2b8 [ 43.193544][ T3972] el0_svc_common+0x138/0x258 [ 43.194772][ T3972] do_el0_svc+0x58/0x14c [ 43.195872][ T3972] el0_svc+0x7c/0x1f0 [ 43.196938][ T3972] el0t_64_sync_handler+0x84/0xe4 [ 43.198298][ T3972] el0t_64_sync+0x1a0/0x1a4 [ 43.200766][ T3981] F2FS-fs (loop1): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.204136][ T3979] F2FS-fs (loop4): Found nat_bits in checkpoint [ 43.205345][ T3972] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.209493][ T3997] F2FS-fs (loop0): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.212267][ T3997] CPU: 0 PID: 3997 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0 [ 43.214586][ T3997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.217274][ T3997] Call trace: [ 43.218145][ T3997] dump_backtrace+0x0/0x530 [ 43.219345][ T3997] show_stack+0x2c/0x3c [ 43.220496][ T3997] dump_stack_lvl+0x108/0x170 [ 43.221741][ T3997] dump_stack+0x1c/0x58 [ 43.222832][ T3997] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.224229][ T3997] f2fs_iget+0x1aa0/0x53b8 [ 43.225342][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.226648][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.227967][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.229172][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.230548][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.231814][ T3997] do_handle_open+0x5b8/0x9fc [ 43.232994][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.234554][ T3997] invoke_syscall+0x98/0x2b8 [ 43.235799][ T3997] el0_svc_common+0x138/0x258 [ 43.237044][ T3997] do_el0_svc+0x58/0x14c [ 43.238203][ T3997] el0_svc+0x7c/0x1f0 [ 43.239203][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.240540][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.242964][ T3997] ================================================================== [ 43.242993][ T3997] BUG: KASAN: use-after-free in f2fs_iget+0x3f0c/0x53b8 [ 43.247005][ T3997] Read of size 4 at addr ffff0000deced028 by task syz-executor491/3997 [ 43.249083][ T3997] [ 43.249711][ T3997] CPU: 0 PID: 3997 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0 [ 43.251393][ T3973] F2FS-fs (loop2): Found nat_bits in checkpoint [ 43.251933][ T3997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.251945][ T3997] Call trace: [ 43.257099][ T3997] dump_backtrace+0x0/0x530 [ 43.258437][ T3997] show_stack+0x2c/0x3c [ 43.259570][ T3997] dump_stack_lvl+0x108/0x170 [ 43.260905][ T3997] print_address_description+0x7c/0x3f0 [ 43.262334][ T3997] kasan_report+0x174/0x1e4 [ 43.263476][ T3997] __asan_report_load4_noabort+0x44/0x50 [ 43.264957][ T3997] f2fs_iget+0x3f0c/0x53b8 [ 43.266124][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.267407][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.268733][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.269954][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.271448][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.272759][ T3997] do_handle_open+0x5b8/0x9fc [ 43.273978][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.275547][ T3997] invoke_syscall+0x98/0x2b8 [ 43.276321][ T3995] F2FS-fs (loop1): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.276805][ T3997] el0_svc_common+0x138/0x258 [ 43.279972][ T3997] do_el0_svc+0x58/0x14c [ 43.281066][ T3997] el0_svc+0x7c/0x1f0 [ 43.282064][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.283419][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.284573][ T3997] [ 43.285209][ T3997] Allocated by task 3972: [ 43.286398][ T3997] __kasan_slab_alloc+0x8c/0xcc [ 43.287639][ T3997] slab_post_alloc_hook+0x74/0x3f4 [ 43.288998][ T3997] kmem_cache_alloc+0x1dc/0x45c [ 43.290275][ T3997] f2fs_init_extent_tree+0x4c8/0xb70 [ 43.291716][ T3997] f2fs_iget+0x1088/0x53b8 [ 43.292922][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.294286][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.295177][ T3995] CPU: 1 PID: 3995 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0 [ 43.295666][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.298058][ T3995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.299277][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.301930][ T3995] Call trace: [ 43.303449][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.304357][ T3995] dump_backtrace+0x0/0x530 [ 43.305626][ T3997] do_handle_open+0x5b8/0x9fc [ 43.306722][ T3995] show_stack+0x2c/0x3c [ 43.307899][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.308934][ T3995] dump_stack_lvl+0x108/0x170 [ 43.310474][ T3997] invoke_syscall+0x98/0x2b8 [ 43.311593][ T3995] dump_stack+0x1c/0x58 [ 43.312770][ T3997] el0_svc_common+0x138/0x258 [ 43.313805][ T3995] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.315022][ T3997] do_el0_svc+0x58/0x14c [ 43.316412][ T3995] f2fs_iget+0x1aa0/0x53b8 [ 43.317473][ T3997] el0_svc+0x7c/0x1f0 [ 43.318579][ T3995] f2fs_nfs_get_inode+0x80/0x118 [ 43.319627][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.320872][ T3995] generic_fh_to_dentry+0x9c/0x104 [ 43.322118][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.323407][ T3995] f2fs_fh_to_dentry+0x44/0x58 [ 43.324540][ T3997] [ 43.324548][ T3997] Freed by task 3972: [ 43.325777][ T3995] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.326375][ T3997] kasan_set_track+0x4c/0x84 [ 43.327336][ T3995] exportfs_decode_fh+0x50/0x80 [ 43.328675][ T3997] kasan_set_free_info+0x28/0x4c [ 43.329813][ T3995] do_handle_open+0x5b8/0x9fc [ 43.331124][ T3997] ____kasan_slab_free+0x118/0x164 [ 43.332394][ T3995] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.333642][ T3997] __kasan_slab_free+0x18/0x28 [ 43.334976][ T3995] invoke_syscall+0x98/0x2b8 [ 43.336544][ T3997] slab_free_freelist_hook+0x128/0x1ec [ 43.337918][ T3995] el0_svc_common+0x138/0x258 [ 43.339150][ T3997] kmem_cache_free+0xdc/0x3c4 [ 43.340597][ T3995] do_el0_svc+0x58/0x14c [ 43.341822][ T3997] f2fs_destroy_extent_tree+0x2e0/0x6e0 [ 43.343090][ T3995] el0_svc+0x7c/0x1f0 [ 43.344202][ T3997] f2fs_evict_inode+0x330/0x1564 [ 43.345606][ T3995] el0t_64_sync_handler+0x84/0xe4 [ 43.346640][ T3997] evict+0x260/0x68c [ 43.347960][ T3995] el0t_64_sync+0x1a0/0x1a4 [ 43.349316][ T3997] iput+0x744/0x824 [ 43.352334][ T3997] iget_failed+0x154/0x1a4 [ 43.353441][ T3997] f2fs_iget+0x588/0x53b8 [ 43.354599][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.355896][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.357193][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.358469][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.359918][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.361314][ T3997] do_handle_open+0x5b8/0x9fc [ 43.362577][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.364121][ T3997] invoke_syscall+0x98/0x2b8 [ 43.365304][ T3997] el0_svc_common+0x138/0x258 [ 43.366603][ T3997] do_el0_svc+0x58/0x14c [ 43.367739][ T3997] el0_svc+0x7c/0x1f0 [ 43.368812][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.370188][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.371480][ T3997] [ 43.372080][ T3997] The buggy address belongs to the object at ffff0000deced000 [ 43.372080][ T3997] which belongs to the cache f2fs_extent_tree of size 136 [ 43.375984][ T3997] The buggy address is located 40 bytes inside of [ 43.375984][ T3997] 136-byte region [ffff0000deced000, ffff0000deced088) [ 43.379523][ T3997] The buggy address belongs to the page: [ 43.381027][ T3997] page:00000000f4f3a067 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eced [ 43.383785][ T3997] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 43.385798][ T3997] raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6604d80 [ 43.388105][ T3997] raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000 [ 43.390289][ T3997] page dumped because: kasan: bad access detected [ 43.391975][ T3997] [ 43.392596][ T3997] Memory state around the buggy address: [ 43.394132][ T3997] ffff0000dececf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.396382][ T3997] ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.398583][ T3997] >ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.400722][ T3997] ^ [ 43.402148][ T3997] ffff0000deced080: fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 [ 43.404285][ T3997] ffff0000deced100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 43.406405][ T3997] ================================================================== [ 43.408602][ T3997] Disabling lock debugging due to kernel taint [ 43.412796][ T3997] F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.416117][ T3973] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 43.418318][ T3979] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 43.421558][ T3979] F2FS-fs (loop4): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.423747][ T3979] CPU: 1 PID: 3979 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.426540][ T3979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.429095][ T3979] Call trace: [ 43.429941][ T3979] dump_backtrace+0x0/0x530 [ 43.431169][ T3979] show_stack+0x2c/0x3c [ 43.432252][ T3979] dump_stack_lvl+0x108/0x170 [ 43.433492][ T3979] dump_stack+0x1c/0x58 [ 43.434582][ T3979] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.436005][ T3979] f2fs_iget+0x1aa0/0x53b8 [ 43.437234][ T3979] f2fs_nfs_get_inode+0x80/0x118 [ 43.438581][ T3979] generic_fh_to_dentry+0x9c/0x104 [ 43.439929][ T3979] f2fs_fh_to_dentry+0x44/0x58 [ 43.441231][ T3979] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.442686][ T3979] exportfs_decode_fh+0x50/0x80 [ 43.443979][ T3979] do_handle_open+0x5b8/0x9fc [ 43.445251][ T3979] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.446181][ T3995] F2FS-fs (loop1): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.446788][ T3979] invoke_syscall+0x98/0x2b8 [ 43.450648][ T3997] ================================================================== [ 43.451013][ T3979] el0_svc_common+0x138/0x258 [ 43.453180][ T3997] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 [ 43.454361][ T3979] do_el0_svc+0x58/0x14c [ 43.456524][ T3997] [ 43.457635][ T3979] el0_svc+0x7c/0x1f0 [ 43.459262][ T3979] el0t_64_sync_handler+0x84/0xe4 [ 43.460561][ T3979] el0t_64_sync+0x1a0/0x1a4 [ 43.461778][ T3997] CPU: 0 PID: 3997 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.464414][ T3997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.467009][ T3997] Call trace: [ 43.467774][ T3997] dump_backtrace+0x0/0x530 [ 43.468900][ T3997] show_stack+0x2c/0x3c [ 43.469960][ T3997] dump_stack_lvl+0x108/0x170 [ 43.471161][ T3997] print_address_description+0x7c/0x3f0 [ 43.472596][ T3997] kasan_report_invalid_free+0x64/0x94 [ 43.473929][ T3979] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.473957][ T3997] ____kasan_slab_free+0x134/0x164 [ 43.478263][ T3997] __kasan_slab_free+0x18/0x28 [ 43.479329][ T3980] F2FS-fs (loop3): Found nat_bits in checkpoint [ 43.479499][ T3997] slab_free_freelist_hook+0x128/0x1ec [ 43.482556][ T3997] kmem_cache_free+0xdc/0x3c4 [ 43.483796][ T3997] f2fs_destroy_extent_tree+0x2e0/0x6e0 [ 43.485205][ T3997] f2fs_evict_inode+0x330/0x1564 [ 43.486427][ T3997] evict+0x260/0x68c [ 43.487426][ T3997] iput+0x744/0x824 [ 43.488398][ T3997] iget_failed+0x154/0x1a4 [ 43.489497][ T3997] f2fs_iget+0x588/0x53b8 [ 43.490642][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.491891][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.492348][ T4006] F2FS-fs (loop4): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.493308][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.493328][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.498152][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.499425][ T3997] do_handle_open+0x5b8/0x9fc [ 43.500702][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.502233][ T3997] invoke_syscall+0x98/0x2b8 [ 43.503373][ T3997] el0_svc_common+0x138/0x258 [ 43.504606][ T3997] do_el0_svc+0x58/0x14c [ 43.505729][ T3997] el0_svc+0x7c/0x1f0 [ 43.506777][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.508104][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.509238][ T3997] [ 43.509241][ T4006] CPU: 1 PID: 4006 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.509853][ T3997] Allocated by task 3972: [ 43.512470][ T4006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.513579][ T3997] __kasan_slab_alloc+0x8c/0xcc [ 43.516155][ T4006] Call trace: [ 43.517425][ T3997] slab_post_alloc_hook+0x74/0x3f4 [ 43.518298][ T4006] dump_backtrace+0x0/0x530 [ 43.519583][ T3997] kmem_cache_alloc+0x1dc/0x45c [ 43.520739][ T4006] show_stack+0x2c/0x3c [ 43.521953][ T3997] f2fs_init_extent_tree+0x4c8/0xb70 [ 43.523042][ T4006] dump_stack_lvl+0x108/0x170 [ 43.524380][ T3997] f2fs_iget+0x1088/0x53b8 [ 43.525664][ T4006] dump_stack+0x1c/0x58 [ 43.526912][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.528014][ T4006] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.529359][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.530716][ T4006] f2fs_iget+0x1aa0/0x53b8 [ 43.532072][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.533203][ T4006] f2fs_nfs_get_inode+0x80/0x118 [ 43.534467][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.535681][ T4006] generic_fh_to_dentry+0x9c/0x104 [ 43.537089][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.538351][ T4006] f2fs_fh_to_dentry+0x44/0x58 [ 43.539726][ T3997] do_handle_open+0x5b8/0x9fc [ 43.540948][ T4006] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.542208][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.543575][ T4006] exportfs_decode_fh+0x50/0x80 [ 43.545172][ T3997] invoke_syscall+0x98/0x2b8 [ 43.546378][ T4006] do_handle_open+0x5b8/0x9fc [ 43.547614][ T3997] el0_svc_common+0x138/0x258 [ 43.548801][ T4006] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.550089][ T3997] do_el0_svc+0x58/0x14c [ 43.551537][ T4006] invoke_syscall+0x98/0x2b8 [ 43.552648][ T3997] el0_svc+0x7c/0x1f0 [ 43.553789][ T4006] el0_svc_common+0x138/0x258 [ 43.554857][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.556124][ T4006] do_el0_svc+0x58/0x14c [ 43.557419][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.558498][ T4006] el0_svc+0x7c/0x1f0 [ 43.559674][ T3997] [ 43.560697][ T4006] el0t_64_sync_handler+0x84/0xe4 [ 43.561305][ T3997] Freed by task 3972: [ 43.562561][ T4006] el0t_64_sync+0x1a0/0x1a4 [ 43.563574][ T3997] kasan_set_track+0x4c/0x84 [ 43.565959][ T3997] kasan_set_free_info+0x28/0x4c [ 43.567280][ T3997] ____kasan_slab_free+0x118/0x164 [ 43.568718][ T3997] __kasan_slab_free+0x18/0x28 [ 43.569424][ T3973] F2FS-fs (loop2): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.569976][ T3997] slab_free_freelist_hook+0x128/0x1ec [ 43.572116][ T3973] CPU: 1 PID: 3973 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.573429][ T3997] kmem_cache_free+0xdc/0x3c4 [ 43.575993][ T3973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.577223][ T3997] f2fs_destroy_extent_tree+0x2e0/0x6e0 [ 43.579834][ T3973] Call trace: [ 43.581297][ T3997] f2fs_evict_inode+0x330/0x1564 [ 43.582112][ T3973] dump_backtrace+0x0/0x530 [ 43.583437][ T3997] evict+0x260/0x68c [ 43.584579][ T3973] show_stack+0x2c/0x3c [ 43.585605][ T3997] iput+0x744/0x824 [ 43.586606][ T3973] dump_stack_lvl+0x108/0x170 [ 43.587614][ T3997] iget_failed+0x154/0x1a4 [ 43.588767][ T3973] dump_stack+0x1c/0x58 [ 43.589941][ T3997] f2fs_iget+0x588/0x53b8 [ 43.590980][ T3973] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.592231][ T3997] f2fs_nfs_get_inode+0x80/0x118 [ 43.593553][ T3973] f2fs_iget+0x1aa0/0x53b8 [ 43.594906][ T3997] generic_fh_to_dentry+0x9c/0x104 [ 43.596032][ T3973] f2fs_nfs_get_inode+0x80/0x118 [ 43.597411][ T3997] f2fs_fh_to_dentry+0x44/0x58 [ 43.598704][ T3973] generic_fh_to_dentry+0x9c/0x104 [ 43.600004][ T3997] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.601390][ T3973] f2fs_fh_to_dentry+0x44/0x58 [ 43.602795][ T3997] exportfs_decode_fh+0x50/0x80 [ 43.604071][ T3973] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.605310][ T3997] do_handle_open+0x5b8/0x9fc [ 43.606688][ T3973] exportfs_decode_fh+0x50/0x80 [ 43.607968][ T3997] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.609275][ T3973] do_handle_open+0x5b8/0x9fc [ 43.610913][ T3997] invoke_syscall+0x98/0x2b8 [ 43.612124][ T3973] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.613316][ T3997] el0_svc_common+0x138/0x258 [ 43.614803][ T3973] invoke_syscall+0x98/0x2b8 [ 43.616064][ T3997] do_el0_svc+0x58/0x14c [ 43.617201][ T3973] el0_svc_common+0x138/0x258 [ 43.618357][ T3997] el0_svc+0x7c/0x1f0 [ 43.619553][ T3973] do_el0_svc+0x58/0x14c [ 43.620588][ T3997] el0t_64_sync_handler+0x84/0xe4 [ 43.621696][ T3973] el0_svc+0x7c/0x1f0 [ 43.623048][ T3997] el0t_64_sync+0x1a0/0x1a4 [ 43.624133][ T3973] el0t_64_sync_handler+0x84/0xe4 [ 43.625309][ T3997] [ 43.626691][ T3973] el0t_64_sync+0x1a0/0x1a4 [ 43.627305][ T3997] The buggy address belongs to the object at ffff0000deced000 [ 43.627305][ T3997] which belongs to the cache f2fs_extent_tree of size 136 [ 43.632191][ T3997] The buggy address is located 0 bytes inside of [ 43.632191][ T3997] 136-byte region [ffff0000deced000, ffff0000deced088) [ 43.632242][ T4006] F2FS-fs (loop4): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.635791][ T3997] The buggy address belongs to the page: [ 43.635801][ T3997] page:00000000f4f3a067 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eced [ 43.635815][ T3997] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 43.639156][ T3973] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.640287][ T3997] raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6604d80 [ 43.640299][ T3997] raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000 [ 43.640304][ T3997] page dumped because: kasan: bad access detected [ 43.644642][ T4008] F2FS-fs (loop2): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.645104][ T3997] [ 43.645110][ T3997] Memory state around the buggy address: [ 43.649319][ T4008] CPU: 1 PID: 4008 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.650439][ T3997] ffff0000dececf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.652668][ T4008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.654419][ T3997] ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.656406][ T4008] Call trace: [ 43.657055][ T3997] >ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.658524][ T4008] dump_backtrace+0x0/0x530 [ 43.661194][ T3997] ^ [ 43.663293][ T4008] show_stack+0x2c/0x3c [ 43.666039][ T3997] ffff0000deced080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 43.668039][ T4008] dump_stack_lvl+0x108/0x170 [ 43.668850][ T3997] ffff0000deced100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 43.670809][ T4008] dump_stack+0x1c/0x58 [ 43.671698][ T3997] ================================================================== [ 43.672488][ T4008] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.679234][ T3980] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 43.680947][ T4008] f2fs_iget+0x1aa0/0x53b8 [ 43.680969][ T4008] f2fs_nfs_get_inode+0x80/0x118 [ 43.683476][ T3980] F2FS-fs (loop3): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.684264][ T4008] generic_fh_to_dentry+0x9c/0x104 [ 43.684283][ T4008] f2fs_fh_to_dentry+0x44/0x58 [ 43.684294][ T4008] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.692463][ T4008] exportfs_decode_fh+0x50/0x80 [ 43.693676][ T4008] do_handle_open+0x5b8/0x9fc [ 43.694907][ T4008] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.696379][ T4008] invoke_syscall+0x98/0x2b8 [ 43.697525][ T4008] el0_svc_common+0x138/0x258 [ 43.698752][ T4008] do_el0_svc+0x58/0x14c [ 43.699867][ T4008] el0_svc+0x7c/0x1f0 [ 43.700875][ T4008] el0t_64_sync_handler+0x84/0xe4 [ 43.702196][ T4008] el0t_64_sync+0x1a0/0x1a4 [ 43.703293][ T3980] CPU: 0 PID: 3980 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.706054][ T3980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.708804][ T3980] Call trace: [ 43.709702][ T3980] dump_backtrace+0x0/0x530 [ 43.710905][ T3980] show_stack+0x2c/0x3c [ 43.711982][ T3980] dump_stack_lvl+0x108/0x170 [ 43.713260][ T3980] dump_stack+0x1c/0x58 [ 43.714471][ T3980] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.715929][ T3980] f2fs_iget+0x1aa0/0x53b8 [ 43.717102][ T3980] f2fs_nfs_get_inode+0x80/0x118 [ 43.718419][ T3980] generic_fh_to_dentry+0x9c/0x104 [ 43.719787][ T3980] f2fs_fh_to_dentry+0x44/0x58 [ 43.721052][ T3980] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.722532][ T3980] exportfs_decode_fh+0x50/0x80 [ 43.723899][ T3980] do_handle_open+0x5b8/0x9fc [ 43.725186][ T3980] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.726759][ T3980] invoke_syscall+0x98/0x2b8 [ 43.728065][ T3980] el0_svc_common+0x138/0x258 [ 43.729248][ T3980] do_el0_svc+0x58/0x14c [ 43.730349][ T3980] el0_svc+0x7c/0x1f0 [ 43.731400][ T3980] el0t_64_sync_handler+0x84/0xe4 [ 43.732831][ T3980] el0t_64_sync+0x1a0/0x1a4 executing program executing program [ 43.749759][ T3980] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix executing program [ 43.755589][ T4013] F2FS-fs (loop3): Inconsistent error blkaddr:5634, sit bitmap:0 [ 43.758475][ T4013] CPU: 0 PID: 4013 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.761253][ T4013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.763917][ T4013] Call trace: [ 43.764768][ T4013] dump_backtrace+0x0/0x530 [ 43.765940][ T4013] show_stack+0x2c/0x3c [ 43.767034][ T4013] dump_stack_lvl+0x108/0x170 [ 43.768230][ T4013] dump_stack+0x1c/0x58 [ 43.769311][ T4013] f2fs_is_valid_blkaddr+0x9f8/0xf7c [ 43.770709][ T4013] f2fs_iget+0x1aa0/0x53b8 [ 43.771868][ T4013] f2fs_nfs_get_inode+0x80/0x118 [ 43.773168][ T4013] generic_fh_to_dentry+0x9c/0x104 [ 43.774539][ T4013] f2fs_fh_to_dentry+0x44/0x58 [ 43.775780][ T4013] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.777199][ T4013] exportfs_decode_fh+0x50/0x80 [ 43.778463][ T4013] do_handle_open+0x5b8/0x9fc [ 43.779753][ T4013] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.781309][ T4013] invoke_syscall+0x98/0x2b8 [ 43.782541][ T4013] el0_svc_common+0x138/0x258 [ 43.783795][ T4013] do_el0_svc+0x58/0x14c [ 43.784888][ T4013] el0_svc+0x7c/0x1f0 [ 43.785953][ T4013] el0t_64_sync_handler+0x84/0xe4 [ 43.787166][ T4013] el0t_64_sync+0x1a0/0x1a4 [ 43.829166][ T4013] F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix executing program [ 43.870630][ T4008] F2FS-fs (loop2): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix [ 43.880486][ T4008] ================================================================== [ 43.882685][ T4008] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 [ 43.885051][ T4008] [ 43.885632][ T4008] CPU: 1 PID: 4008 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0 [ 43.888174][ T4008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 43.890859][ T4008] Call trace: [ 43.891746][ T4008] dump_backtrace+0x0/0x530 [ 43.892955][ T4008] show_stack+0x2c/0x3c [ 43.894084][ T4008] dump_stack_lvl+0x108/0x170 [ 43.895354][ T4008] print_address_description+0x7c/0x3f0 [ 43.896880][ T4008] kasan_report_invalid_free+0x64/0x94 [ 43.898353][ T4008] ____kasan_slab_free+0x134/0x164 [ 43.899740][ T4008] __kasan_slab_free+0x18/0x28 [ 43.901052][ T4008] slab_free_freelist_hook+0x128/0x1ec [ 43.902549][ T4008] kmem_cache_free+0xdc/0x3c4 [ 43.903803][ T4008] f2fs_destroy_extent_tree+0x2e0/0x6e0 [ 43.905230][ T4008] f2fs_evict_inode+0x330/0x1564 [ 43.906553][ T4008] evict+0x260/0x68c [ 43.907593][ T4008] iput+0x744/0x824 [ 43.908612][ T4008] iget_failed+0x154/0x1a4 [ 43.909744][ T4008] f2fs_iget+0x588/0x53b8 [ 43.910935][ T4008] f2fs_nfs_get_inode+0x80/0x118 [ 43.912342][ T4008] generic_fh_to_dentry+0x9c/0x104 [ 43.913666][ T4008] f2fs_fh_to_dentry+0x44/0x58 [ 43.914947][ T4008] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.916359][ T4008] exportfs_decode_fh+0x50/0x80 [ 43.917640][ T4008] do_handle_open+0x5b8/0x9fc [ 43.918907][ T4008] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.920420][ T4008] invoke_syscall+0x98/0x2b8 [ 43.921663][ T4008] el0_svc_common+0x138/0x258 [ 43.922957][ T4008] do_el0_svc+0x58/0x14c [ 43.924105][ T4008] el0_svc+0x7c/0x1f0 [ 43.925137][ T4008] el0t_64_sync_handler+0x84/0xe4 [ 43.926450][ T4008] el0t_64_sync+0x1a0/0x1a4 [ 43.927624][ T4008] [ 43.928276][ T4008] Allocated by task 3973: [ 43.929417][ T4008] __kasan_slab_alloc+0x8c/0xcc [ 43.930694][ T4008] slab_post_alloc_hook+0x74/0x3f4 [ 43.932080][ T4008] kmem_cache_alloc+0x1dc/0x45c [ 43.933328][ T4008] f2fs_init_extent_tree+0x4c8/0xb70 [ 43.934761][ T4008] f2fs_iget+0x1088/0x53b8 [ 43.935970][ T4008] f2fs_nfs_get_inode+0x80/0x118 [ 43.937350][ T4008] generic_fh_to_dentry+0x9c/0x104 [ 43.938812][ T4008] f2fs_fh_to_dentry+0x44/0x58 [ 43.940156][ T4008] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.941528][ T4008] exportfs_decode_fh+0x50/0x80 [ 43.942849][ T4008] do_handle_open+0x5b8/0x9fc [ 43.944133][ T4008] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.945770][ T4008] invoke_syscall+0x98/0x2b8 [ 43.947015][ T4008] el0_svc_common+0x138/0x258 [ 43.948210][ T4008] do_el0_svc+0x58/0x14c [ 43.949405][ T4008] el0_svc+0x7c/0x1f0 [ 43.950425][ T4008] el0t_64_sync_handler+0x84/0xe4 [ 43.951732][ T4008] el0t_64_sync+0x1a0/0x1a4 [ 43.952930][ T4008] [ 43.953565][ T4008] Freed by task 3973: [ 43.954617][ T4008] kasan_set_track+0x4c/0x84 [ 43.955857][ T4008] kasan_set_free_info+0x28/0x4c [ 43.957148][ T4008] ____kasan_slab_free+0x118/0x164 [ 43.958573][ T4008] __kasan_slab_free+0x18/0x28 [ 43.959838][ T4008] slab_free_freelist_hook+0x128/0x1ec [ 43.961298][ T4008] kmem_cache_free+0xdc/0x3c4 [ 43.962570][ T4008] f2fs_destroy_extent_tree+0x2e0/0x6e0 [ 43.964031][ T4008] f2fs_evict_inode+0x330/0x1564 [ 43.965327][ T4008] evict+0x260/0x68c [ 43.966360][ T4008] iput+0x744/0x824 [ 43.967360][ T4008] iget_failed+0x154/0x1a4 [ 43.968523][ T4008] f2fs_iget+0x588/0x53b8 [ 43.969803][ T4008] f2fs_nfs_get_inode+0x80/0x118 [ 43.971102][ T4008] generic_fh_to_dentry+0x9c/0x104 [ 43.972411][ T4008] f2fs_fh_to_dentry+0x44/0x58 [ 43.973679][ T4008] exportfs_decode_fh_raw+0x114/0x4b4 [ 43.975088][ T4008] exportfs_decode_fh+0x50/0x80 [ 43.976336][ T4008] do_handle_open+0x5b8/0x9fc [ 43.977553][ T4008] __arm64_sys_open_by_handle_at+0x80/0x94 [ 43.979103][ T4008] invoke_syscall+0x98/0x2b8 [ 43.980281][ T4008] el0_svc_common+0x138/0x258 [ 43.981453][ T4008] do_el0_svc+0x58/0x14c [ 43.982564][ T4008] el0_svc+0x7c/0x1f0 [ 43.983642][ T4008] el0t_64_sync_handler+0x84/0xe4 [ 43.984948][ T4008] el0t_64_sync+0x1a0/0x1a4 [ 43.986136][ T4008] [ 43.986738][ T4008] The buggy address belongs to the object at ffff0000deced320 [ 43.986738][ T4008] which belongs to the cache f2fs_extent_tree of size 136 [ 43.990585][ T4008] The buggy address is located 0 bytes inside of [ 43.990585][ T4008] 136-byte region [ffff0000deced320, ffff0000deced3a8) [ 43.994131][ T4008] The buggy address belongs to the page: [ 43.995613][ T4008] page:00000000f4f3a067 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eced [ 43.998318][ T4008] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 44.000288][ T4008] raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6604d80 [ 44.002578][ T4008] raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000 [ 44.004859][ T4008] page dumped because: kasan: bad access detected [ 44.006553][ T4008] [ 44.007233][ T4008] Memory state around the buggy address: [ 44.008659][ T4008] ffff0000deced200: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb [ 44.010790][ T4008] ffff0000deced280: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 44.012941][ T4008] >ffff0000deced300: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb [ 44.015047][ T4008] ^ [ 44.016410][ T4008] ffff0000deced380: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 44.018573][ T4008] ffff0000deced400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.020677][ T4008] ================================================================== executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program