Warning: Permanently added '10.128.0.60' (ED25519) to the list of known hosts. executing program [ 43.478118][ T3487] loop0: detected capacity change from 0 to 8192 [ 43.487744][ T3487] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 43.504164][ T3487] REISERFS (device loop0): using ordered data mode [ 43.510888][ T3487] reiserfs: using flush barriers [ 43.516965][ T3487] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 43.533655][ T3487] REISERFS (device loop0): checking transaction log (loop0) [ 43.580278][ T3487] REISERFS (device loop0): Using r5 hash to sort names [ 43.587319][ T3487] REISERFS (device loop0): using 3.5.x disk format [ 43.594738][ T3487] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 43.617515][ T25] audit: type=1800 audit(1692624155.878:2): pid=3487 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor276" name="bus" dev="loop0" ino=3 res=0 errno=0 [ 43.618232][ T3487] ================================================================== [ 43.646265][ T3487] BUG: KASAN: out-of-bounds in leaf_paste_in_buffer+0x1b8/0xab0 [ 43.653933][ T3487] Read of size 18446744073709551233 at addr ffff888071d7c000 by task syz-executor276/3487 [ 43.663984][ T3487] [ 43.666298][ T3487] CPU: 0 PID: 3487 Comm: syz-executor276 Not tainted 5.15.127-syzkaller #0 [ 43.674862][ T3487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 43.684899][ T3487] Call Trace: [ 43.688257][ T3487] [ 43.691428][ T3487] dump_stack_lvl+0x1e3/0x2cb [ 43.696093][ T3487] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 43.701702][ T3487] ? _printk+0xd1/0x111 [ 43.705838][ T3487] ? __wake_up_klogd+0xcc/0x100 [ 43.710669][ T3487] ? panic+0x84d/0x84d [ 43.714738][ T3487] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 43.720186][ T3487] ? leaf_move_items+0x1c4c/0x28a0 [ 43.725308][ T3487] print_address_description+0x63/0x3b0 [ 43.730922][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.736277][ T3487] kasan_report+0x16b/0x1c0 [ 43.740770][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.746188][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.751636][ T3487] kasan_check_range+0x27e/0x290 [ 43.756572][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.761930][ T3487] memmove+0x25/0x60 [ 43.765802][ T3487] leaf_paste_in_buffer+0x1b8/0xab0 [ 43.771008][ T3487] balance_leaf+0x667c/0x12510 [ 43.775772][ T3487] ? do_balance+0x8f0/0x8f0 [ 43.780260][ T3487] ? do_raw_spin_lock+0x14a/0x370 [ 43.785531][ T3487] ? __lock_acquire+0x1ff0/0x1ff0 [ 43.790543][ T3487] ? do_raw_spin_unlock+0x137/0x8b0 [ 43.795733][ T3487] ? unlock_page+0x188/0x200 [ 43.800328][ T3487] ? __getblk_gfp+0x9b0/0xaf0 [ 43.804989][ T3487] ? get_empty_nodes+0xad9/0xd70 [ 43.809906][ T3487] ? direntry_part_size+0xb0/0x1a0 [ 43.815001][ T3487] ? get_neighbors+0x1010/0x1010 [ 43.820188][ T3487] ? __wake_up_bit+0x190/0x190 [ 43.824978][ T3487] ? is_leaf_removable+0x8c0/0x8c0 [ 43.830073][ T3487] ? get_neighbors+0x631/0x1010 [ 43.834907][ T3487] ? reiserfs_prepare_for_journal+0x26b/0x280 [ 43.840980][ T3487] ? fix_nodes+0x7abc/0x8c70 [ 43.845552][ T3487] ? __might_sleep+0xc0/0xc0 [ 43.850134][ T3487] do_balance+0x309/0x8f0 [ 43.854444][ T3487] ? get_right_neighbor_position+0x210/0x210 [ 43.860405][ T3487] ? reiserfs_paste_into_item+0x3ef/0x880 [ 43.866217][ T3487] reiserfs_paste_into_item+0x73b/0x880 [ 43.871751][ T3487] ? reiserfs_cut_from_item+0x2560/0x2560 [ 43.877675][ T3487] ? __kmalloc+0x168/0x300 [ 43.882076][ T3487] reiserfs_get_block+0x226a/0x5390 [ 43.887367][ T3487] ? make_le_item_head+0x5c0/0x5c0 [ 43.892457][ T3487] ? register_lock_class+0x100/0x9a0 [ 43.897720][ T3487] ? alloc_page_buffers+0x3a3/0x660 [ 43.902904][ T3487] ? create_empty_buffers+0x3a/0x6d0 [ 43.908181][ T3487] ? create_page_buffers+0x1d4/0x330 [ 43.913529][ T3487] ? __block_write_begin_int+0x24c/0x1650 [ 43.919226][ T3487] ? reiserfs_write_begin+0x346/0x810 [ 43.924572][ T3487] ? generic_cont_expand_simple+0x144/0x230 [ 43.930452][ T3487] ? reiserfs_setattr+0x3ff/0xf90 [ 43.935476][ T3487] ? notify_change+0xd4d/0x1000 [ 43.940326][ T3487] ? is_dynamic_key+0x1f0/0x1f0 [ 43.945286][ T3487] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.951432][ T3487] ? mark_lock+0x98/0x340 [ 43.955746][ T3487] ? __lock_acquire+0x1295/0x1ff0 [ 43.960859][ T3487] ? __lock_acquire+0x1ff0/0x1ff0 [ 43.965949][ T3487] ? alloc_buffer_head+0xd3/0xf0 [ 43.970869][ T3487] ? alloc_page_buffers+0x54a/0x660 [ 43.976056][ T3487] ? create_page_buffers+0x24b/0x330 [ 43.981325][ T3487] __block_write_begin_int+0x60b/0x1650 [ 43.986900][ T3487] ? make_le_item_head+0x5c0/0x5c0 [ 43.992015][ T3487] ? page_zero_new_buffers+0x510/0x510 [ 43.997471][ T3487] ? __mutex_lock_common+0x444/0x25a0 [ 44.002830][ T3487] ? fix_tail_page_for_writing+0x97/0x220 [ 44.008536][ T3487] reiserfs_write_begin+0x346/0x810 [ 44.013728][ T3487] ? pagecache_write_begin+0x33/0xa0 [ 44.019009][ T3487] generic_cont_expand_simple+0x144/0x230 [ 44.024722][ T3487] ? submit_bh+0x30/0x30 [ 44.028946][ T3487] ? setattr_prepare+0x1f7/0xe30 [ 44.033864][ T3487] ? mutex_lock_nested+0x17/0x20 [ 44.039014][ T3487] reiserfs_setattr+0x3ff/0xf90 [ 44.043862][ T3487] ? reiserfs_commit_write+0x5a0/0x5a0 [ 44.049405][ T3487] ? ktime_get_coarse_real_ts64+0x107/0x120 [ 44.055310][ T3487] ? current_time+0x1d1/0x2f0 [ 44.059994][ T3487] ? atime_needs_update+0x7b0/0x7b0 [ 44.065179][ T3487] ? evm_inode_setattr+0xf7/0x5b0 [ 44.070209][ T3487] ? bpf_lsm_inode_setattr+0x5/0x10 [ 44.075480][ T3487] ? security_inode_setattr+0xce/0x120 [ 44.081015][ T3487] ? reiserfs_commit_write+0x5a0/0x5a0 [ 44.086482][ T3487] notify_change+0xd4d/0x1000 [ 44.091170][ T3487] do_truncate+0x21c/0x300 [ 44.095601][ T3487] ? put_page_bootmem+0x280/0x280 [ 44.100625][ T3487] ? print_irqtrace_events+0x210/0x210 [ 44.106395][ T3487] ? vtime_user_exit+0x2d1/0x400 [ 44.111347][ T3487] ? bpf_lsm_path_truncate+0x5/0x10 [ 44.117317][ T3487] do_sys_ftruncate+0x2eb/0x390 [ 44.122254][ T3487] do_syscall_64+0x3d/0xb0 [ 44.126819][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.132702][ T3487] RIP: 0033:0x7faceec21679 [ 44.137107][ T3487] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 44.157182][ T3487] RSP: 002b:00007ffd65fcc258 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 44.166139][ T3487] RAX: ffffffffffffffda RBX: 00007ffd65fcc428 RCX: 00007faceec21679 [ 44.174220][ T3487] RDX: 00007faceec21679 RSI: 0000000002007fff RDI: 0000000000000005 [ 44.184296][ T3487] RBP: 00007faceec95610 R08: 00007ffd65fcc428 R09: 00007ffd65fcc428 [ 44.192612][ T3487] R10: 00007ffd65fcc428 R11: 0000000000000246 R12: 0000000000000001 [ 44.208364][ T3487] R13: 00007ffd65fcc418 R14: 0000000000000001 R15: 0000000000000001 [ 44.216775][ T3487] [ 44.219775][ T3487] [ 44.222078][ T3487] The buggy address belongs to the page: [ 44.227703][ T3487] page:ffffea0001c75f00 refcount:1 mapcount:1 mapping:0000000000000000 index:0x7f2dda967 pfn:0x71d7c [ 44.239439][ T3487] memcg:ffff888011e34000 [ 44.243663][ T3487] anon flags: 0xfff00000080014(uptodate|lru|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 44.253277][ T3487] raw: 00fff00000080014 ffffea0001c8e548 ffffea0001c75f48 ffff8880750f7bb1 [ 44.261837][ T3487] raw: 00000007f2dda967 0000000000000000 0000000100000000 ffff888011e34000 [ 44.270393][ T3487] page dumped because: kasan: bad access detected [ 44.276799][ T3487] page_owner tracks the page as allocated [ 44.282491][ T3487] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100cca(GFP_HIGHUSER_MOVABLE), pid 3489, ts 43614841587, free_ts 11547083785 [ 44.297141][ T3487] get_page_from_freelist+0x322a/0x33c0 [ 44.302761][ T3487] __alloc_pages+0x272/0x700 [ 44.307331][ T3487] alloc_pages_vma+0x39a/0x800 [ 44.312171][ T3487] wp_page_copy+0x24e/0x2070 [ 44.316739][ T3487] handle_mm_fault+0x2a3d/0x5950 [ 44.321753][ T3487] exc_page_fault+0x271/0x740 [ 44.326411][ T3487] asm_exc_page_fault+0x22/0x30 [ 44.331263][ T3487] __put_user_nocheck_4+0x3/0x11 [ 44.336180][ T3487] schedule_tail+0x92/0xb0 [ 44.340573][ T3487] ret_from_fork+0x8/0x30 [ 44.344879][ T3487] page last free stack trace: [ 44.349702][ T3487] free_unref_page_prepare+0xc34/0xcf0 [ 44.355264][ T3487] free_unref_page+0x95/0x2d0 [ 44.359938][ T3487] free_contig_range+0x95/0xf0 [ 44.364695][ T3487] destroy_args+0xfe/0x97f [ 44.369102][ T3487] debug_vm_pgtable+0x40d/0x462 [ 44.373937][ T3487] do_one_initcall+0x22b/0x7a0 [ 44.378779][ T3487] do_initcall_level+0x157/0x207 [ 44.383700][ T3487] do_initcalls+0x49/0x86 [ 44.388012][ T3487] kernel_init_freeable+0x43c/0x5c5 [ 44.393196][ T3487] kernel_init+0x19/0x290 [ 44.397508][ T3487] ret_from_fork+0x1f/0x30 [ 44.401911][ T3487] [ 44.404385][ T3487] Memory state around the buggy address: [ 44.410167][ T3487] ffff888071d7bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.418353][ T3487] ffff888071d7bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.426401][ T3487] >ffff888071d7c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.434648][ T3487] ^ [ 44.438707][ T3487] ffff888071d7c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.446935][ T3487] ffff888071d7c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.455072][ T3487] ================================================================== [ 44.463116][ T3487] Disabling lock debugging due to kernel taint [ 44.469792][ T3487] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 44.476990][ T3487] CPU: 0 PID: 3487 Comm: syz-executor276 Tainted: G B 5.15.127-syzkaller #0 [ 44.486975][ T3487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 44.497016][ T3487] Call Trace: [ 44.500289][ T3487] [ 44.503300][ T3487] dump_stack_lvl+0x1e3/0x2cb [ 44.508006][ T3487] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 44.513671][ T3487] ? panic+0x84d/0x84d [ 44.517830][ T3487] ? preempt_schedule_common+0xa6/0xd0 [ 44.523529][ T3487] ? preempt_schedule+0xd9/0xe0 [ 44.528413][ T3487] panic+0x318/0x84d [ 44.532375][ T3487] ? check_panic_on_warn+0x1d/0xa0 [ 44.537635][ T3487] ? fb_is_primary_device+0xcc/0xcc [ 44.542808][ T3487] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 44.548763][ T3487] ? _raw_spin_unlock+0x40/0x40 [ 44.553587][ T3487] check_panic_on_warn+0x7e/0xa0 [ 44.559111][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 44.564457][ T3487] end_report+0x6d/0xf0 [ 44.568596][ T3487] kasan_report+0x18e/0x1c0 [ 44.573079][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 44.578427][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 44.583772][ T3487] kasan_check_range+0x27e/0x290 [ 44.588682][ T3487] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 44.594025][ T3487] memmove+0x25/0x60 [ 44.597895][ T3487] leaf_paste_in_buffer+0x1b8/0xab0 [ 44.603067][ T3487] balance_leaf+0x667c/0x12510 [ 44.607813][ T3487] ? do_balance+0x8f0/0x8f0 [ 44.612289][ T3487] ? do_raw_spin_lock+0x14a/0x370 [ 44.617288][ T3487] ? __lock_acquire+0x1ff0/0x1ff0 [ 44.622378][ T3487] ? do_raw_spin_unlock+0x137/0x8b0 [ 44.627562][ T3487] ? unlock_page+0x188/0x200 [ 44.632126][ T3487] ? __getblk_gfp+0x9b0/0xaf0 [ 44.636783][ T3487] ? get_empty_nodes+0xad9/0xd70 [ 44.641784][ T3487] ? direntry_part_size+0xb0/0x1a0 [ 44.646965][ T3487] ? get_neighbors+0x1010/0x1010 [ 44.651875][ T3487] ? __wake_up_bit+0x190/0x190 [ 44.656613][ T3487] ? is_leaf_removable+0x8c0/0x8c0 [ 44.661727][ T3487] ? get_neighbors+0x631/0x1010 [ 44.666587][ T3487] ? reiserfs_prepare_for_journal+0x26b/0x280 [ 44.672828][ T3487] ? fix_nodes+0x7abc/0x8c70 [ 44.677567][ T3487] ? __might_sleep+0xc0/0xc0 [ 44.682137][ T3487] do_balance+0x309/0x8f0 [ 44.686650][ T3487] ? get_right_neighbor_position+0x210/0x210 [ 44.692794][ T3487] ? reiserfs_paste_into_item+0x3ef/0x880 [ 44.698492][ T3487] reiserfs_paste_into_item+0x73b/0x880 [ 44.704139][ T3487] ? reiserfs_cut_from_item+0x2560/0x2560 [ 44.709860][ T3487] ? __kmalloc+0x168/0x300 [ 44.714254][ T3487] reiserfs_get_block+0x226a/0x5390 [ 44.719433][ T3487] ? make_le_item_head+0x5c0/0x5c0 [ 44.724690][ T3487] ? register_lock_class+0x100/0x9a0 [ 44.729956][ T3487] ? alloc_page_buffers+0x3a3/0x660 [ 44.735138][ T3487] ? create_empty_buffers+0x3a/0x6d0 [ 44.740393][ T3487] ? create_page_buffers+0x1d4/0x330 [ 44.746086][ T3487] ? __block_write_begin_int+0x24c/0x1650 [ 44.751805][ T3487] ? reiserfs_write_begin+0x346/0x810 [ 44.757325][ T3487] ? generic_cont_expand_simple+0x144/0x230 [ 44.763539][ T3487] ? reiserfs_setattr+0x3ff/0xf90 [ 44.768533][ T3487] ? notify_change+0xd4d/0x1000 [ 44.773357][ T3487] ? is_dynamic_key+0x1f0/0x1f0 [ 44.778181][ T3487] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.784220][ T3487] ? mark_lock+0x98/0x340 [ 44.788572][ T3487] ? __lock_acquire+0x1295/0x1ff0 [ 44.793586][ T3487] ? __lock_acquire+0x1ff0/0x1ff0 [ 44.798600][ T3487] ? alloc_buffer_head+0xd3/0xf0 [ 44.803511][ T3487] ? alloc_page_buffers+0x54a/0x660 [ 44.808694][ T3487] ? create_page_buffers+0x24b/0x330 [ 44.813958][ T3487] __block_write_begin_int+0x60b/0x1650 [ 44.819481][ T3487] ? make_le_item_head+0x5c0/0x5c0 [ 44.824607][ T3487] ? page_zero_new_buffers+0x510/0x510 [ 44.830040][ T3487] ? __mutex_lock_common+0x444/0x25a0 [ 44.835387][ T3487] ? fix_tail_page_for_writing+0x97/0x220 [ 44.841269][ T3487] reiserfs_write_begin+0x346/0x810 [ 44.846785][ T3487] ? pagecache_write_begin+0x33/0xa0 [ 44.852766][ T3487] generic_cont_expand_simple+0x144/0x230 [ 44.858630][ T3487] ? submit_bh+0x30/0x30 [ 44.862863][ T3487] ? setattr_prepare+0x1f7/0xe30 [ 44.867780][ T3487] ? mutex_lock_nested+0x17/0x20 [ 44.872693][ T3487] reiserfs_setattr+0x3ff/0xf90 [ 44.877542][ T3487] ? reiserfs_commit_write+0x5a0/0x5a0 [ 44.883095][ T3487] ? ktime_get_coarse_real_ts64+0x107/0x120 [ 44.888970][ T3487] ? current_time+0x1d1/0x2f0 [ 44.893633][ T3487] ? atime_needs_update+0x7b0/0x7b0 [ 44.898816][ T3487] ? evm_inode_setattr+0xf7/0x5b0 [ 44.903960][ T3487] ? bpf_lsm_inode_setattr+0x5/0x10 [ 44.909275][ T3487] ? security_inode_setattr+0xce/0x120 [ 44.914721][ T3487] ? reiserfs_commit_write+0x5a0/0x5a0 [ 44.920164][ T3487] notify_change+0xd4d/0x1000 [ 44.924826][ T3487] do_truncate+0x21c/0x300 [ 44.929219][ T3487] ? put_page_bootmem+0x280/0x280 [ 44.934221][ T3487] ? print_irqtrace_events+0x210/0x210 [ 44.939771][ T3487] ? vtime_user_exit+0x2d1/0x400 [ 44.944735][ T3487] ? bpf_lsm_path_truncate+0x5/0x10 [ 44.950035][ T3487] do_sys_ftruncate+0x2eb/0x390 [ 44.955013][ T3487] do_syscall_64+0x3d/0xb0 [ 44.959552][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.965439][ T3487] RIP: 0033:0x7faceec21679 [ 44.969845][ T3487] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 44.989627][ T3487] RSP: 002b:00007ffd65fcc258 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 44.998111][ T3487] RAX: ffffffffffffffda RBX: 00007ffd65fcc428 RCX: 00007faceec21679 [ 45.006061][ T3487] RDX: 00007faceec21679 RSI: 0000000002007fff RDI: 0000000000000005 [ 45.014096][ T3487] RBP: 00007faceec95610 R08: 00007ffd65fcc428 R09: 00007ffd65fcc428 [ 45.022047][ T3487] R10: 00007ffd65fcc428 R11: 0000000000000246 R12: 0000000000000001 [ 45.029995][ T3487] R13: 00007ffd65fcc418 R14: 0000000000000001 R15: 0000000000000001 [ 45.039267][ T3487] [ 45.042456][ T3487] Kernel Offset: disabled [ 45.046766][ T3487] Rebooting in 86400 seconds..