Warning: Permanently added '10.128.10.56' (ECDSA) to the list of known hosts. executing program [ 42.441543][ T3498] loop0: detected capacity change from 0 to 8192 [ 42.451052][ T3498] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 42.460943][ T3498] REISERFS (device loop0): using ordered data mode [ 42.467566][ T3498] reiserfs: using flush barriers [ 42.473480][ T3498] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 42.489899][ T3498] REISERFS (device loop0): checking transaction log (loop0) [ 42.534328][ T3498] REISERFS (device loop0): Using r5 hash to sort names [ 42.541349][ T3498] REISERFS (device loop0): using 3.5.x disk format [ 42.548743][ T3498] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 42.564273][ T26] audit: type=1800 audit(1687097232.487:2): pid=3498 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor266" name="bus" dev="loop0" ino=2 res=0 errno=0 [ 42.588385][ T3498] ================================================================== [ 42.596503][ T3498] BUG: KASAN: out-of-bounds in leaf_paste_in_buffer+0x1b8/0xab0 [ 42.604134][ T3498] Read of size 18446744073709551305 at addr ffff8880700dd000 by task syz-executor266/3498 [ 42.614002][ T3498] [ 42.616323][ T3498] CPU: 1 PID: 3498 Comm: syz-executor266 Not tainted 5.15.117-syzkaller #0 [ 42.624976][ T3498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 42.635190][ T3498] Call Trace: [ 42.638453][ T3498] [ 42.641364][ T3498] dump_stack_lvl+0x1e3/0x2cb [ 42.646027][ T3498] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 42.651639][ T3498] ? _printk+0xd1/0x111 [ 42.655777][ T3498] ? __wake_up_klogd+0xcc/0x100 [ 42.660605][ T3498] ? panic+0x84d/0x84d [ 42.664651][ T3498] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 42.670105][ T3498] ? leaf_move_items+0x1c4c/0x28a0 [ 42.675202][ T3498] print_address_description+0x63/0x3b0 [ 42.680730][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 42.686165][ T3498] kasan_report+0x16b/0x1c0 [ 42.690650][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 42.696100][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 42.701472][ T3498] kasan_check_range+0x27e/0x290 [ 42.706410][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 42.712028][ T3498] memmove+0x25/0x60 [ 42.715916][ T3498] leaf_paste_in_buffer+0x1b8/0xab0 [ 42.721205][ T3498] balance_leaf+0x667c/0x12510 [ 42.725977][ T3498] ? do_balance+0x8f0/0x8f0 [ 42.730460][ T3498] ? do_raw_spin_lock+0x14a/0x370 [ 42.735461][ T3498] ? __lock_acquire+0x1ff0/0x1ff0 [ 42.740558][ T3498] ? do_raw_spin_unlock+0x137/0x8b0 [ 42.745736][ T3498] ? unlock_page+0x188/0x200 [ 42.750335][ T3498] ? __getblk_gfp+0x9b0/0xaf0 [ 42.755344][ T3498] ? get_empty_nodes+0xad9/0xd70 [ 42.760273][ T3498] ? direntry_part_size+0xb0/0x1a0 [ 42.765369][ T3498] ? get_neighbors+0x1010/0x1010 [ 42.770288][ T3498] ? __wake_up_bit+0x190/0x190 [ 42.775033][ T3498] ? is_leaf_removable+0x8c0/0x8c0 [ 42.780385][ T3498] ? get_neighbors+0x631/0x1010 [ 42.785217][ T3498] ? reiserfs_prepare_for_journal+0x26b/0x280 [ 42.791269][ T3498] ? fix_nodes+0x7abc/0x8c70 [ 42.795835][ T3498] ? __might_sleep+0xc0/0xc0 [ 42.800423][ T3498] do_balance+0x309/0x8f0 [ 42.804735][ T3498] ? get_right_neighbor_position+0x210/0x210 [ 42.810700][ T3498] ? reiserfs_paste_into_item+0x3ef/0x880 [ 42.816398][ T3498] reiserfs_paste_into_item+0x73b/0x880 [ 42.821934][ T3498] ? reiserfs_cut_from_item+0x2560/0x2560 [ 42.827666][ T3498] ? __kmalloc+0x168/0x300 [ 42.832064][ T3498] reiserfs_get_block+0x226a/0x5390 [ 42.837262][ T3498] ? make_le_item_head+0x5c0/0x5c0 [ 42.842352][ T3498] ? register_lock_class+0x100/0x9a0 [ 42.847795][ T3498] ? alloc_page_buffers+0x3a3/0x660 [ 42.852970][ T3498] ? create_empty_buffers+0x3a/0x6d0 [ 42.858232][ T3498] ? create_page_buffers+0x1d4/0x330 [ 42.863489][ T3498] ? __block_write_begin_int+0x24c/0x1650 [ 42.869182][ T3498] ? reiserfs_write_begin+0x346/0x810 [ 42.874528][ T3498] ? generic_cont_expand_simple+0x144/0x230 [ 42.880410][ T3498] ? reiserfs_setattr+0x3ff/0xf90 [ 42.885409][ T3498] ? notify_change+0xd4d/0x1000 [ 42.890246][ T3498] ? is_dynamic_key+0x1f0/0x1f0 [ 42.895074][ T3498] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.901120][ T3498] ? mark_lock+0x98/0x340 [ 42.905430][ T3498] ? __lock_acquire+0x1295/0x1ff0 [ 42.910557][ T3498] ? __lock_acquire+0x1ff0/0x1ff0 [ 42.915556][ T3498] ? alloc_buffer_head+0xd3/0xf0 [ 42.920469][ T3498] ? alloc_page_buffers+0x54a/0x660 [ 42.925650][ T3498] ? create_page_buffers+0x24b/0x330 [ 42.930916][ T3498] __block_write_begin_int+0x60b/0x1650 [ 42.936448][ T3498] ? make_le_item_head+0x5c0/0x5c0 [ 42.941538][ T3498] ? page_zero_new_buffers+0x510/0x510 [ 42.946976][ T3498] ? __mutex_lock_common+0x444/0x25a0 [ 42.952327][ T3498] ? fix_tail_page_for_writing+0x97/0x220 [ 42.958024][ T3498] reiserfs_write_begin+0x346/0x810 [ 42.963206][ T3498] ? pagecache_write_begin+0x33/0xa0 [ 42.968603][ T3498] generic_cont_expand_simple+0x144/0x230 [ 42.974323][ T3498] ? submit_bh+0x30/0x30 [ 42.978665][ T3498] ? setattr_prepare+0x1f7/0xe30 [ 42.983613][ T3498] ? mutex_lock_nested+0x17/0x20 [ 42.988538][ T3498] reiserfs_setattr+0x3ff/0xf90 [ 42.993369][ T3498] ? reiserfs_commit_write+0x5a0/0x5a0 [ 42.998817][ T3498] ? ktime_get_coarse_real_ts64+0x107/0x120 [ 43.004713][ T3498] ? current_time+0x1d1/0x2f0 [ 43.009379][ T3498] ? atime_needs_update+0x7b0/0x7b0 [ 43.014559][ T3498] ? evm_inode_setattr+0xf7/0x5b0 [ 43.019567][ T3498] ? bpf_lsm_inode_setattr+0x5/0x10 [ 43.024748][ T3498] ? security_inode_setattr+0xce/0x120 [ 43.030276][ T3498] ? reiserfs_commit_write+0x5a0/0x5a0 [ 43.035716][ T3498] notify_change+0xd4d/0x1000 [ 43.040376][ T3498] do_truncate+0x21c/0x300 [ 43.044776][ T3498] ? put_page_bootmem+0x280/0x280 [ 43.049780][ T3498] ? print_irqtrace_events+0x210/0x210 [ 43.055214][ T3498] ? vtime_user_exit+0x2d1/0x400 [ 43.060138][ T3498] ? bpf_lsm_path_truncate+0x5/0x10 [ 43.065324][ T3498] do_sys_ftruncate+0x2eb/0x390 [ 43.070161][ T3498] do_syscall_64+0x3d/0xb0 [ 43.074820][ T3498] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.080704][ T3498] RIP: 0033:0x7fd9a7bb6859 [ 43.085106][ T3498] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.104694][ T3498] RSP: 002b:00007fff910af1e8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 43.113097][ T3498] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd9a7bb6859 [ 43.121058][ T3498] RDX: 00007fd9a7bb6859 RSI: 0000000002007fff RDI: 0000000000000004 [ 43.129014][ T3498] RBP: 00007fd9a7b760f0 R08: 0000000000000000 R09: 0000000000000000 [ 43.136971][ T3498] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd9a7b76180 [ 43.145273][ T3498] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.153320][ T3498] [ 43.156317][ T3498] [ 43.158618][ T3498] The buggy address belongs to the page: [ 43.164219][ T3498] page:ffffea0001c03740 refcount:1 mapcount:1 mapping:0000000000000000 index:0x559aa6a16 pfn:0x700dd [ 43.175035][ T3498] memcg:ffff888011e5c000 [ 43.179245][ T3498] anon flags: 0xfff00000080014(uptodate|lru|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 43.188853][ T3498] raw: 00fff00000080014 ffffea0001feec48 ffffea0001c03788 ffff888023561991 [ 43.197410][ T3498] raw: 0000000559aa6a16 0000000000000000 0000000100000000 ffff888011e5c000 [ 43.205961][ T3498] page dumped because: kasan: bad access detected [ 43.212345][ T3498] page_owner tracks the page as allocated [ 43.218030][ T3498] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100cca(GFP_HIGHUSER_MOVABLE), pid 2962, ts 42575016984, free_ts 10622954667 [ 43.232582][ T3498] get_page_from_freelist+0x322a/0x33c0 [ 43.238110][ T3498] __alloc_pages+0x272/0x700 [ 43.242677][ T3498] alloc_pages_vma+0x39a/0x800 [ 43.247420][ T3498] wp_page_copy+0x26c/0x2000 [ 43.251984][ T3498] handle_mm_fault+0x2a3d/0x5950 [ 43.256898][ T3498] exc_page_fault+0x271/0x740 [ 43.261557][ T3498] asm_exc_page_fault+0x22/0x30 [ 43.266419][ T3498] page last free stack trace: [ 43.271066][ T3498] free_unref_page_prepare+0xc34/0xcf0 [ 43.276501][ T3498] free_unref_page+0x95/0x2d0 [ 43.281150][ T3498] free_contig_range+0x95/0xf0 [ 43.285888][ T3498] destroy_args+0xfe/0x97f [ 43.290281][ T3498] debug_vm_pgtable+0x40d/0x462 [ 43.295104][ T3498] do_one_initcall+0x22b/0x7a0 [ 43.299843][ T3498] do_initcall_level+0x157/0x207 [ 43.304751][ T3498] do_initcalls+0x49/0x86 [ 43.309052][ T3498] kernel_init_freeable+0x43c/0x5c5 [ 43.314225][ T3498] kernel_init+0x19/0x290 [ 43.318533][ T3498] ret_from_fork+0x1f/0x30 [ 43.322924][ T3498] [ 43.325658][ T3498] Memory state around the buggy address: [ 43.331256][ T3498] ffff8880700dcf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.339291][ T3498] ffff8880700dcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.347325][ T3498] >ffff8880700dd000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.355356][ T3498] ^ [ 43.359399][ T3498] ffff8880700dd080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.367437][ T3498] ffff8880700dd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.375468][ T3498] ================================================================== [ 43.383597][ T3498] Disabling lock debugging due to kernel taint [ 43.390031][ T3498] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 43.397229][ T3498] CPU: 1 PID: 3498 Comm: syz-executor266 Tainted: G B 5.15.117-syzkaller #0 [ 43.407202][ T3498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 43.417243][ T3498] Call Trace: [ 43.420623][ T3498] [ 43.423541][ T3498] dump_stack_lvl+0x1e3/0x2cb [ 43.428207][ T3498] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 43.433823][ T3498] ? panic+0x84d/0x84d [ 43.437880][ T3498] ? preempt_schedule_common+0xa6/0xd0 [ 43.443322][ T3498] ? preempt_schedule+0xd9/0xe0 [ 43.448155][ T3498] panic+0x318/0x84d [ 43.452036][ T3498] ? check_panic_on_warn+0x1d/0xa0 [ 43.457133][ T3498] ? fb_is_primary_device+0xcc/0xcc [ 43.462309][ T3498] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 43.468267][ T3498] ? _raw_spin_unlock+0x40/0x40 [ 43.473095][ T3498] check_panic_on_warn+0x7e/0xa0 [ 43.478008][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.483354][ T3498] end_report+0x6d/0xf0 [ 43.487486][ T3498] kasan_report+0x18e/0x1c0 [ 43.491962][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.497307][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.502650][ T3498] kasan_check_range+0x27e/0x290 [ 43.507562][ T3498] ? leaf_paste_in_buffer+0x1b8/0xab0 [ 43.512903][ T3498] memmove+0x25/0x60 [ 43.516774][ T3498] leaf_paste_in_buffer+0x1b8/0xab0 [ 43.521946][ T3498] balance_leaf+0x667c/0x12510 [ 43.526689][ T3498] ? do_balance+0x8f0/0x8f0 [ 43.531168][ T3498] ? do_raw_spin_lock+0x14a/0x370 [ 43.536164][ T3498] ? __lock_acquire+0x1ff0/0x1ff0 [ 43.541163][ T3498] ? do_raw_spin_unlock+0x137/0x8b0 [ 43.546331][ T3498] ? unlock_page+0x188/0x200 [ 43.550892][ T3498] ? __getblk_gfp+0x9b0/0xaf0 [ 43.555544][ T3498] ? get_empty_nodes+0xad9/0xd70 [ 43.560454][ T3498] ? direntry_part_size+0xb0/0x1a0 [ 43.565538][ T3498] ? get_neighbors+0x1010/0x1010 [ 43.570445][ T3498] ? __wake_up_bit+0x190/0x190 [ 43.575181][ T3498] ? is_leaf_removable+0x8c0/0x8c0 [ 43.580265][ T3498] ? get_neighbors+0x631/0x1010 [ 43.585089][ T3498] ? reiserfs_prepare_for_journal+0x26b/0x280 [ 43.591129][ T3498] ? fix_nodes+0x7abc/0x8c70 [ 43.595688][ T3498] ? __might_sleep+0xc0/0xc0 [ 43.600253][ T3498] do_balance+0x309/0x8f0 [ 43.604555][ T3498] ? get_right_neighbor_position+0x210/0x210 [ 43.610509][ T3498] ? reiserfs_paste_into_item+0x3ef/0x880 [ 43.616200][ T3498] reiserfs_paste_into_item+0x73b/0x880 [ 43.621720][ T3498] ? reiserfs_cut_from_item+0x2560/0x2560 [ 43.627424][ T3498] ? __kmalloc+0x168/0x300 [ 43.631811][ T3498] reiserfs_get_block+0x226a/0x5390 [ 43.636998][ T3498] ? make_le_item_head+0x5c0/0x5c0 [ 43.642094][ T3498] ? register_lock_class+0x100/0x9a0 [ 43.647357][ T3498] ? alloc_page_buffers+0x3a3/0x660 [ 43.652532][ T3498] ? create_empty_buffers+0x3a/0x6d0 [ 43.657805][ T3498] ? create_page_buffers+0x1d4/0x330 [ 43.663066][ T3498] ? __block_write_begin_int+0x24c/0x1650 [ 43.668761][ T3498] ? reiserfs_write_begin+0x346/0x810 [ 43.674115][ T3498] ? generic_cont_expand_simple+0x144/0x230 [ 43.679994][ T3498] ? reiserfs_setattr+0x3ff/0xf90 [ 43.684997][ T3498] ? notify_change+0xd4d/0x1000 [ 43.689826][ T3498] ? is_dynamic_key+0x1f0/0x1f0 [ 43.694655][ T3498] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.700786][ T3498] ? mark_lock+0x98/0x340 [ 43.705101][ T3498] ? __lock_acquire+0x1295/0x1ff0 [ 43.710126][ T3498] ? __lock_acquire+0x1ff0/0x1ff0 [ 43.715135][ T3498] ? alloc_buffer_head+0xd3/0xf0 [ 43.720053][ T3498] ? alloc_page_buffers+0x54a/0x660 [ 43.725227][ T3498] ? create_page_buffers+0x24b/0x330 [ 43.730486][ T3498] __block_write_begin_int+0x60b/0x1650 [ 43.736011][ T3498] ? make_le_item_head+0x5c0/0x5c0 [ 43.741097][ T3498] ? page_zero_new_buffers+0x510/0x510 [ 43.746615][ T3498] ? __mutex_lock_common+0x444/0x25a0 [ 43.752049][ T3498] ? fix_tail_page_for_writing+0x97/0x220 [ 43.757742][ T3498] reiserfs_write_begin+0x346/0x810 [ 43.762913][ T3498] ? pagecache_write_begin+0x33/0xa0 [ 43.768170][ T3498] generic_cont_expand_simple+0x144/0x230 [ 43.773864][ T3498] ? submit_bh+0x30/0x30 [ 43.778552][ T3498] ? setattr_prepare+0x1f7/0xe30 [ 43.783464][ T3498] ? mutex_lock_nested+0x17/0x20 [ 43.788375][ T3498] reiserfs_setattr+0x3ff/0xf90 [ 43.793202][ T3498] ? reiserfs_commit_write+0x5a0/0x5a0 [ 43.798631][ T3498] ? ktime_get_coarse_real_ts64+0x107/0x120 [ 43.804495][ T3498] ? current_time+0x1d1/0x2f0 [ 43.809147][ T3498] ? atime_needs_update+0x7b0/0x7b0 [ 43.814319][ T3498] ? evm_inode_setattr+0xf7/0x5b0 [ 43.819317][ T3498] ? bpf_lsm_inode_setattr+0x5/0x10 [ 43.824486][ T3498] ? security_inode_setattr+0xce/0x120 [ 43.829924][ T3498] ? reiserfs_commit_write+0x5a0/0x5a0 [ 43.835356][ T3498] notify_change+0xd4d/0x1000 [ 43.840033][ T3498] do_truncate+0x21c/0x300 [ 43.844422][ T3498] ? put_page_bootmem+0x280/0x280 [ 43.849420][ T3498] ? print_irqtrace_events+0x210/0x210 [ 43.854852][ T3498] ? vtime_user_exit+0x2d1/0x400 [ 43.859768][ T3498] ? bpf_lsm_path_truncate+0x5/0x10 [ 43.864939][ T3498] do_sys_ftruncate+0x2eb/0x390 [ 43.869765][ T3498] do_syscall_64+0x3d/0xb0 [ 43.874155][ T3498] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.880491][ T3498] RIP: 0033:0x7fd9a7bb6859 [ 43.884880][ T3498] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.904455][ T3498] RSP: 002b:00007fff910af1e8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 43.912843][ T3498] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd9a7bb6859 [ 43.920789][ T3498] RDX: 00007fd9a7bb6859 RSI: 0000000002007fff RDI: 0000000000000004 [ 43.928733][ T3498] RBP: 00007fd9a7b760f0 R08: 0000000000000000 R09: 0000000000000000 [ 43.936688][ T3498] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd9a7b76180 [ 43.944646][ T3498] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.952604][ T3498] [ 43.955674][ T3498] Kernel Offset: disabled [ 43.959979][ T3498] Rebooting in 86400 seconds..