loop3: detected capacity change from 0 to 32768 ================================================================== BUG: KASAN: use-after-free in __ocfs2_find_path+0x588/0x600 fs/ocfs2/alloc.c:1824 Read of size 4 at addr ffff88805818a000 by task syz.3.8/5957 CPU: 0 UID: 0 PID: 5957 Comm: syz.3.8 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 __ocfs2_find_path+0x588/0x600 fs/ocfs2/alloc.c:1824 ocfs2_find_leaf+0x99/0x1e0 fs/ocfs2/alloc.c:1938 ocfs2_get_clusters_nocache+0x39b/0xf80 fs/ocfs2/extent_map.c:418 ocfs2_get_clusters+0x337/0xc40 fs/ocfs2/extent_map.c:621 ocfs2_extent_map_get_blocks+0x1ac/0x640 fs/ocfs2/extent_map.c:668 ocfs2_read_virt_blocks+0x285/0x9c0 fs/ocfs2/extent_map.c:983 ocfs2_read_dir_block+0xb6/0x520 fs/ocfs2/dir.c:508 ocfs2_find_entry_el fs/ocfs2/dir.c:715 [inline] ocfs2_find_entry+0xc3b/0x17b0 fs/ocfs2/dir.c:1080 ocfs2_find_files_on_disk fs/ocfs2/dir.c:1981 [inline] ocfs2_lookup_ino_from_name+0xd5/0x1e0 fs/ocfs2/dir.c:2003 _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:136 [inline] ocfs2_get_system_file_inode+0x443/0x940 fs/ocfs2/sysfile.c:112 ocfs2_init_global_system_inodes fs/ocfs2/super.c:457 [inline] ocfs2_initialize_super.isra.0+0x1f48/0x32f0 fs/ocfs2/super.c:2248 ocfs2_fill_super+0x1023/0x4340 fs/ocfs2/super.c:994 mount_bdev+0x1e6/0x2d0 fs/super.c:1693 legacy_get_tree+0x10c/0x220 fs/fs_context.c:662 vfs_get_tree+0x92/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3507 [inline] path_mount+0x14e6/0x1f20 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __x64_sys_mount+0x294/0x320 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f202657feba Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f20272cbe68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f20272cbef0 RCX: 00007f202657feba RDX: 0000000020004440 RSI: 0000000020000780 RDI: 00007f20272cbeb0 RBP: 0000000020004440 R08: 00007f20272cbef0 R09: 0000000001000000 R10: 0000000001000000 R11: 0000000000000246 R12: 0000000020000780 R13: 00007f20272cbeb0 R14: 000000000000444a R15: 00000000200005c0 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5818a flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea00016062c8 ffff8880b8644f30 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 30238891029, free_ts 31064705766 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1541 split_free_pages mm/page_alloc.c:6480 [inline] alloc_contig_range_noprof+0x42d/0xa40 mm/page_alloc.c:6607 __alloc_contig_pages mm/page_alloc.c:6636 [inline] alloc_contig_pages_noprof+0x35d/0x710 mm/page_alloc.c:6716 debug_vm_pgtable_alloc_huge_page mm/debug_vm_pgtable.c:1084 [inline] init_args mm/debug_vm_pgtable.c:1266 [inline] debug_vm_pgtable+0x5d6/0x31a0 mm/debug_vm_pgtable.c:1304 do_one_initcall+0x12b/0x700 init/main.c:1269 do_initcall_level init/main.c:1331 [inline] do_initcalls init/main.c:1347 [inline] do_basic_setup init/main.c:1366 [inline] kernel_init_freeable+0x5c7/0x900 init/main.c:1580 kernel_init+0x1c/0x2b0 init/main.c:1469 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 page last free pid 1 tgid 1 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2642 free_contig_range+0x133/0x3f0 mm/page_alloc.c:6750 destroy_args+0xa87/0xe60 mm/debug_vm_pgtable.c:1017 debug_vm_pgtable+0x168e/0x31a0 mm/debug_vm_pgtable.c:1397 do_one_initcall+0x12b/0x700 init/main.c:1269 do_initcall_level init/main.c:1331 [inline] do_initcalls init/main.c:1347 [inline] do_basic_setup init/main.c:1366 [inline] kernel_init_freeable+0x5c7/0x900 init/main.c:1580 kernel_init+0x1c/0x2b0 init/main.c:1469 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff888058189f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888058189f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88805818a000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805818a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805818a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== grow_buffers: requested out-of-range block 9218516168304689152 for device loop3 (syz.3.8,5957,1):ocfs2_read_blocks:239 ERROR: status = -12 (syz.3.8,5957,1):__ocfs2_find_path:1844 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_find_leaf:1940 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_get_clusters_nocache:421 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_get_clusters:624 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_extent_map_get_blocks:671 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_read_virt_blocks:987 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_read_dir_block:511 ERROR: status = -12 (syz.3.8,5957,1):ocfs2_init_global_system_inodes:461 ERROR: status = -22 (syz.3.8,5957,1):ocfs2_init_global_system_inodes:462 ERROR: Unable to load system inode 1, possibly corrupt fs? (syz.3.8,5957,1):ocfs2_init_global_system_inodes:472 ERROR: status = -22 (syz.3.8,5957,1):ocfs2_initialize_super:2250 ERROR: status = -22 (syz.3.8,5957,1):ocfs2_fill_super:1178 ERROR: status = -22