Warning: Permanently added '10.128.1.112' (ECDSA) to the list of known hosts. executing program [ 29.028462] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 29.037196] REISERFS (device loop0): using ordered data mode [ 29.043893] reiserfs: using flush barriers [ 29.049073] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 29.065387] REISERFS (device loop0): checking transaction log (loop0) [ 29.111241] REISERFS (device loop0): Using r5 hash to sort names [ 29.119071] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 29.130754] ================================================================== [ 29.138245] BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x637/0xb80 [ 29.145259] Write of size 408 at addr ffff88808a8f5e68 by task syz-executor226/7948 [ 29.153047] [ 29.154689] CPU: 0 PID: 7948 Comm: syz-executor226 Not tainted 4.14.302-syzkaller #0 [ 29.162559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 29.172024] Call Trace: [ 29.174595] dump_stack+0x1b2/0x281 [ 29.178216] print_address_description.cold+0x54/0x1d3 [ 29.183489] kasan_report_error.cold+0x8a/0x191 [ 29.188592] ? leaf_paste_in_buffer+0x637/0xb80 [ 29.193243] kasan_report+0x6f/0x80 [ 29.196854] ? depot_save_stack+0xe1/0x3f0 [ 29.201155] ? leaf_paste_in_buffer+0x637/0xb80 [ 29.205803] memcpy+0x35/0x50 [ 29.208886] leaf_paste_in_buffer+0x637/0xb80 [ 29.213362] leaf_move_items+0xf26/0x3440 [ 29.217489] ? do_journal_end+0x2f1/0x4310 [ 29.221788] ? reiserfs_write_unlock_nested+0xb2/0xf0 [ 29.227126] ? leaf_copy_dir_entries.isra.0+0x8f0/0x8f0 [ 29.232463] ? reiserfs_write_lock_nested+0x59/0xd0 [ 29.237459] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 29.242884] ? get_empty_nodes+0x1fc/0x650 [ 29.247101] ? is_left_neighbor_in_cache+0x2f0/0x2f0 [ 29.252191] leaf_shift_left+0x9f/0x360 [ 29.256154] balance_leaf+0x5c85/0xba30 [ 29.260144] ? replace_key+0x150/0x150 [ 29.264108] do_balance+0x282/0x630 [ 29.267733] ? get_right_neighbor_position+0x160/0x160 [ 29.272999] ? __mutex_unlock_slowpath+0x75/0x770 [ 29.277917] ? memset+0x20/0x40 [ 29.281177] reiserfs_paste_into_item+0x569/0x6f0 [ 29.286123] ? reiserfs_delete_object+0x1e0/0x1e0 [ 29.290967] ? is_bpf_text_address+0xb8/0x150 [ 29.295471] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.300916] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 29.305919] ? __kmalloc+0x3a4/0x400 [ 29.309617] ? reiserfs_get_block+0x1556/0x36b0 [ 29.314263] reiserfs_get_block+0x1691/0x36b0 [ 29.318741] ? reiserfs_commit_write+0x650/0x650 [ 29.323474] ? radix_tree_node_alloc.constprop.0+0x1b0/0x2f0 [ 29.330142] ? kmem_cache_alloc+0x35f/0x3c0 [ 29.334489] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.339926] ? _raw_spin_unlock+0x29/0x40 [ 29.344051] ? create_page_buffers+0xce/0x1c0 [ 29.348541] __block_write_begin_int+0x35c/0x11d0 [ 29.353365] ? reiserfs_commit_write+0x650/0x650 [ 29.358099] ? __breadahead_gfp+0x150/0x150 [ 29.362398] ? wait_for_stable_page+0xe3/0x260 [ 29.366979] reiserfs_write_begin+0x2e3/0x8a0 [ 29.371457] ? pagecache_write_begin+0x2b/0xc0 [ 29.376023] generic_cont_expand_simple+0xe1/0x130 [ 29.380946] ? page_zero_new_buffers+0x420/0x420 [ 29.385702] ? inode_newsize_ok+0x145/0x1c0 [ 29.390003] reiserfs_setattr+0xa1c/0xe00 [ 29.394140] ? current_kernel_time64+0x17c/0x230 [ 29.398871] ? reiserfs_new_inode+0x2150/0x2150 [ 29.403514] ? timespec_trunc+0xb7/0x120 [ 29.407549] ? put_timespec64+0xf0/0xf0 [ 29.411496] ? current_kernel_time64+0x154/0x230 [ 29.416229] ? evm_inode_setattr+0x41/0x1e0 [ 29.420525] ? reiserfs_new_inode+0x2150/0x2150 [ 29.425256] notify_change+0x56b/0xd10 [ 29.429127] do_truncate+0xff/0x1a0 [ 29.432731] ? finish_open+0x170/0x170 [ 29.436681] ? apparmor_path_truncate+0x163/0x1d0 [ 29.441500] do_sys_ftruncate.constprop.0+0x3a3/0x480 [ 29.446664] ? compat_SyS_truncate+0x40/0x40 [ 29.451054] do_syscall_64+0x1d5/0x640 [ 29.454938] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 29.460113] RIP: 0033:0x7f958ee327b9 [ 29.463825] RSP: 002b:00007ffdf78655e8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 29.471513] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f958ee327b9 [ 29.478792] RDX: 0000000000000000 RSI: 0000000002007ffb RDI: 0000000000000004 [ 29.486037] RBP: 00007f958edf2050 R08: 0000000000000000 R09: 0000000000000000 [ 29.493280] R10: 00000000000010f8 R11: 0000000000000246 R12: 00007f958edf20e0 [ 29.500523] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 29.507771] [ 29.509376] The buggy address belongs to the page: [ 29.514277] page:ffffea00022a3d40 count:0 mapcount:0 mapping: (null) index:0x1 [ 29.522392] flags: 0xfff00000000000() [ 29.526166] raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff [ 29.534023] raw: ffffea00022a3da0 ffffea00022a3d20 0000000000000000 0000000000000000 [ 29.541874] page dumped because: kasan: bad access detected [ 29.547556] [ 29.549157] Memory state around the buggy address: [ 29.554060] ffff88808a8f5d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.561393] ffff88808a8f5d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.569268] >ffff88808a8f5e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.576637] ^ [ 29.583364] ffff88808a8f5e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.590698] ffff88808a8f5f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.598030] ================================================================== [ 29.605362] Disabling lock debugging due to kernel taint [ 29.613309] Kernel panic - not syncing: panic_on_warn set ... [ 29.613309] [ 29.620688] CPU: 1 PID: 7948 Comm: syz-executor226 Tainted: G B 4.14.302-syzkaller #0 [ 29.629776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 29.639227] Call Trace: [ 29.641806] dump_stack+0x1b2/0x281 [ 29.645406] panic+0x1f9/0x42d [ 29.648571] ? add_taint.cold+0x16/0x16 [ 29.652519] ? ___preempt_schedule+0x16/0x18 [ 29.656901] kasan_end_report+0x43/0x49 [ 29.660849] kasan_report_error.cold+0xa7/0x191 [ 29.665490] ? leaf_paste_in_buffer+0x637/0xb80 [ 29.670131] kasan_report+0x6f/0x80 [ 29.673735] ? depot_save_stack+0xe1/0x3f0 [ 29.677941] ? leaf_paste_in_buffer+0x637/0xb80 [ 29.682582] memcpy+0x35/0x50 [ 29.685663] leaf_paste_in_buffer+0x637/0xb80 [ 29.690131] leaf_move_items+0xf26/0x3440 [ 29.694254] ? do_journal_end+0x2f1/0x4310 [ 29.698464] ? reiserfs_write_unlock_nested+0xb2/0xf0 [ 29.703630] ? leaf_copy_dir_entries.isra.0+0x8f0/0x8f0 [ 29.708982] ? reiserfs_write_lock_nested+0x59/0xd0 [ 29.713972] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 29.719394] ? get_empty_nodes+0x1fc/0x650 [ 29.723604] ? is_left_neighbor_in_cache+0x2f0/0x2f0 [ 29.728678] leaf_shift_left+0x9f/0x360 [ 29.732893] balance_leaf+0x5c85/0xba30 [ 29.736855] ? replace_key+0x150/0x150 [ 29.740743] do_balance+0x282/0x630 [ 29.744348] ? get_right_neighbor_position+0x160/0x160 [ 29.749599] ? __mutex_unlock_slowpath+0x75/0x770 [ 29.754417] ? memset+0x20/0x40 [ 29.757670] reiserfs_paste_into_item+0x569/0x6f0 [ 29.762489] ? reiserfs_delete_object+0x1e0/0x1e0 [ 29.767304] ? is_bpf_text_address+0xb8/0x150 [ 29.771783] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.777210] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 29.782206] ? __kmalloc+0x3a4/0x400 [ 29.785894] ? reiserfs_get_block+0x1556/0x36b0 [ 29.790537] reiserfs_get_block+0x1691/0x36b0 [ 29.795008] ? reiserfs_commit_write+0x650/0x650 [ 29.799741] ? radix_tree_node_alloc.constprop.0+0x1b0/0x2f0 [ 29.805511] ? kmem_cache_alloc+0x35f/0x3c0 [ 29.809815] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 29.815242] ? _raw_spin_unlock+0x29/0x40 [ 29.819363] ? create_page_buffers+0xce/0x1c0 [ 29.823832] __block_write_begin_int+0x35c/0x11d0 [ 29.828652] ? reiserfs_commit_write+0x650/0x650 [ 29.833384] ? __breadahead_gfp+0x150/0x150 [ 29.837688] ? wait_for_stable_page+0xe3/0x260 [ 29.842245] reiserfs_write_begin+0x2e3/0x8a0 [ 29.847323] ? pagecache_write_begin+0x2b/0xc0 [ 29.851967] generic_cont_expand_simple+0xe1/0x130 [ 29.856984] ? page_zero_new_buffers+0x420/0x420 [ 29.861805] ? inode_newsize_ok+0x145/0x1c0 [ 29.866102] reiserfs_setattr+0xa1c/0xe00 [ 29.870222] ? current_kernel_time64+0x17c/0x230 [ 29.874955] ? reiserfs_new_inode+0x2150/0x2150 [ 29.879600] ? timespec_trunc+0xb7/0x120 [ 29.883813] ? put_timespec64+0xf0/0xf0 [ 29.887759] ? current_kernel_time64+0x154/0x230 [ 29.892513] ? evm_inode_setattr+0x41/0x1e0 [ 29.896897] ? reiserfs_new_inode+0x2150/0x2150 [ 29.901542] notify_change+0x56b/0xd10 [ 29.905405] do_truncate+0xff/0x1a0 [ 29.909003] ? finish_open+0x170/0x170 [ 29.912864] ? apparmor_path_truncate+0x163/0x1d0 [ 29.917706] do_sys_ftruncate.constprop.0+0x3a3/0x480 [ 29.922877] ? compat_SyS_truncate+0x40/0x40 [ 29.927277] do_syscall_64+0x1d5/0x640 [ 29.931143] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 29.937530] RIP: 0033:0x7f958ee327b9 [ 29.941225] RSP: 002b:00007ffdf78655e8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 29.948907] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f958ee327b9 [ 29.956149] RDX: 0000000000000000 RSI: 0000000002007ffb RDI: 0000000000000004 [ 29.963390] RBP: 00007f958edf2050 R08: 0000000000000000 R09: 0000000000000000 [ 29.970634] R10: 00000000000010f8 R11: 0000000000000246 R12: 00007f958edf20e0 [ 29.977875] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 29.985227] Kernel Offset: disabled [ 29.988840] Rebooting in 86400 seconds..