REISERFS (device loop1): using ordered data mode reiserfs: using flush barriers reiserfs: using flush barriers REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 ================================================================== BUG: KASAN: slab-out-of-bounds in _decode_session6+0xf56/0x1370 net/ipv6/xfrm6_policy.c:137 Read of size 1 at addr ffff888094f8b4e5 by task syz-executor.1/20009 CPU: 1 PID: 20009 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354 kasan_report mm/kasan/report.c:412 [inline] __asan_report_load1_noabort+0x88/0x90 mm/kasan/report.c:430 _decode_session6+0xf56/0x1370 net/ipv6/xfrm6_policy.c:137 __xfrm_decode_session+0x5a/0x130 net/xfrm/xfrm_policy.c:2299 xfrm_decode_session include/net/xfrm.h:1238 [inline] xfrmi_xmit+0x177/0x1480 net/xfrm/xfrm_interface.c:354 __netdev_start_xmit include/linux/netdevice.h:4349 [inline] netdev_start_xmit include/linux/netdevice.h:4363 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272 sch_direct_xmit+0x2d6/0xf70 net/sched/sch_generic.c:332 qdisc_restart net/sched/sch_generic.c:395 [inline] __qdisc_run+0x4d0/0x1640 net/sched/sch_generic.c:403 __dev_xmit_skb net/core/dev.c:3500 [inline] __dev_queue_xmit+0x1518/0x2e00 net/core/dev.c:3807 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0x113d/0x2290 net/ipv6/ip6_output.c:120 ip6_finish_output+0x89b/0x10f0 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x205/0x770 net/ipv6/ip6_output.c:209 dst_output include/net/dst.h:455 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ndisc_send_skb+0xa24/0x1720 net/ipv6/ndisc.c:491 ndisc_send_rs+0x131/0x690 net/ipv6/ndisc.c:685 addrconf_rs_timer+0x384/0x6a0 net/ipv6/addrconf.c:3835 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:console_unlock+0xe7b/0x1110 kernel/printk/printk.c:2468 Code: ff df 48 c1 e8 03 80 3c 08 00 0f 85 66 02 00 00 48 83 3d cf c3 a3 08 00 0f 84 9e 00 00 00 e8 ac c6 14 00 48 8b 7c 24 30 57 9d <0f> 1f 44 00 00 e9 9b fc ff ff e8 96 c6 14 00 0f 0b e8 8f c6 14 00 RSP: 0018:ffff88809136f630 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 RAX: 0000000000040000 RBX: 0000000000000200 RCX: ffffc9000884c000 RDX: 0000000000040000 RSI: ffffffff814dbec4 RDI: 0000000000000212 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8446efa0 R13: 00000000000000ae R14: 0000000000000000 R15: ffffffff8a6dd090 vprintk_emit+0x2d1/0x740 kernel/printk/printk.c:1965 vprintk_func+0x79/0x180 kernel/printk/printk_safe.c:405 printk+0xba/0xed kernel/printk/printk.c:2040 reiserfs_info.cold+0x75/0x7c fs/reiserfs/prints.c:303 journal_init+0x1571/0x60d0 fs/reiserfs/journal.c:2837 reiserfs_fill_super+0xac5/0x2d80 fs/reiserfs/super.c:2035 mount_bdev+0x2fc/0x3b0 fs/super.c:1158 mount_fs+0xa3/0x310 fs/super.c:1261 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2492 [inline] do_mount+0x115c/0x2f50 fs/namespace.c:2822 ksys_mount+0xcf/0x130 fs/namespace.c:3038 __do_sys_mount fs/namespace.c:3052 [inline] __se_sys_mount fs/namespace.c:3049 [inline] __x64_sys_mount+0xba/0x150 fs/namespace.c:3049 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f90a82ba5fa Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f90a682af88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00000000000010f4 RCX: 00007f90a82ba5fa RDX: 0000000020000080 RSI: 0000000020000040 RDI: 00007f90a682afe0 RBP: 00007f90a682b020 R08: 00007f90a682b020 R09: 0000000000800008 R10: 0000000000800008 R11: 0000000000000202 R12: 0000000020000080 R13: 0000000020000040 R14: 00007f90a682afe0 R15: 0000000020000100 Allocated by task 19659: kmem_cache_alloc+0x122/0x370 mm/slab.c:3559 getname_flags+0xce/0x590 fs/namei.c:140 user_path_at_empty+0x2a/0x50 fs/namei.c:2609 user_path_at include/linux/namei.h:57 [inline] do_faccessat+0x248/0x7a0 fs/open.c:397 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 19659: __cache_free mm/slab.c:3503 [inline] kmem_cache_free+0x7f/0x260 mm/slab.c:3765 putname+0xe1/0x120 fs/namei.c:261 filename_lookup+0x3d0/0x5a0 fs/namei.c:2358 user_path_at include/linux/namei.h:57 [inline] do_faccessat+0x248/0x7a0 fs/open.c:397 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888094f8a300 which belongs to the cache names_cache of size 4096 The buggy address is located 485 bytes to the right of 4096-byte region [ffff888094f8a300, ffff888094f8b300) The buggy address belongs to the page: page:ffffea000253e280 count:1 mapcount:0 mapping:ffff88823b843380 index:0x0 compound_mapcount: 0 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 ffffea0001008a08 ffffea00012ed588 ffff88823b843380 raw: 0000000000000000 ffff888094f8a300 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888094f8b380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888094f8b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888094f8b480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888094f8b500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888094f8b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess), 1 bytes skipped: 0: df 48 c1 fisttps -0x3f(%rax) 3: e8 03 80 3c 08 callq 0x83c800b 8: 00 0f add %cl,(%rdi) a: 85 66 02 test %esp,0x2(%rsi) d: 00 00 add %al,(%rax) f: 48 83 3d cf c3 a3 08 cmpq $0x0,0x8a3c3cf(%rip) # 0x8a3c3e6 16: 00 17: 0f 84 9e 00 00 00 je 0xbb 1d: e8 ac c6 14 00 callq 0x14c6ce 22: 48 8b 7c 24 30 mov 0x30(%rsp),%rdi 27: 57 push %rdi 28: 9d popfq * 29: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 2e: e9 9b fc ff ff jmpq 0xfffffcce 33: e8 96 c6 14 00 callq 0x14c6ce 38: 0f 0b ud2 3a: e8 8f c6 14 00 callq 0x14c6ce