------------[ cut here ]------------ WARNING: CPU: 1 PID: 4642 at fs/gfs2/rgrp.c:2638 gfs2_check_blk_type+0x360/0x560 Modules linked in: CPU: 1 PID: 4642 Comm: syz-executor.2 Not tainted 5.15.155-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : gfs2_check_blk_type+0x360/0x560 lr : rgrp_contains_block fs/gfs2/rgrp.h:87 [inline] lr : gfs2_rbm_from_block fs/gfs2/rgrp.c:279 [inline] lr : gfs2_check_blk_type+0x2dc/0x560 fs/gfs2/rgrp.c:2637 sp : ffff80001d567680 x29: ffff80001d567740 x28: 1fffe0001ce34406 x27: ffff0000e71a2000 x26: dfff800000000000 x25: ffff700003aaced4 x24: 00000000fffffff9 x23: 0000000000000013 x22: ffff0000e71a2034 x21: 0000000000000012 x20: 1fffe0001ce34405 x19: ffff80001d5676c0 x18: 1fffe0003690198e x17: 1fffe0003690198e x16: ffff8000082eaf20 x15: ffff8000149dec20 x14: 1ffff0000292806a x13: dfff800000000000 x12: 0000000000040000 x11: 0000000000005996 x10: ffff80001e65f000 x9 : 0000000000005997 x8 : ffff80000a2ed45c x7 : ffff80000a28f190 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008305a68 x2 : 0000000000000000 x1 : 0000000000000012 x0 : 0000000000000013 Call trace: gfs2_check_blk_type+0x360/0x560 gfs2_inode_lookup+0x4f0/0xbd8 fs/gfs2/inode.c:177 gfs2_lookup_by_inum+0x60/0xf8 fs/gfs2/inode.c:250 gfs2_get_dentry fs/gfs2/export.c:139 [inline] gfs2_fh_to_dentry+0x128/0x1f4 fs/gfs2/export.c:162 exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436 exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576 do_handle_to_path fs/fhandle.c:152 [inline] handle_to_path fs/fhandle.c:207 [inline] do_handle_open+0x5b8/0x9fc fs/fhandle.c:223 __do_sys_open_by_handle_at fs/fhandle.c:265 [inline] __se_sys_open_by_handle_at fs/fhandle.c:256 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 145330 hardirqs last enabled at (145329): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline] hardirqs last enabled at (145329): [] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4784 hardirqs last disabled at (145330): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (145284): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (145282): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 4adcd98f6e2e755f ]--- ================================================================== BUG: KASAN: stack-out-of-bounds in should_fault_in_pages fs/gfs2/file.c:784 [inline] BUG: KASAN: stack-out-of-bounds in gfs2_file_buffered_write+0x4c8/0x874 fs/gfs2/file.c:1069 Read of size 8 at addr ffff80001d567b30 by task syz-executor.2/4642 CPU: 1 PID: 4642 Comm: syz-executor.2 Tainted: G W 5.15.155-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x174/0x1e4 mm/kasan/report.c:451 __asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309 should_fault_in_pages fs/gfs2/file.c:784 [inline] gfs2_file_buffered_write+0x4c8/0x874 fs/gfs2/file.c:1069 gfs2_file_write_iter+0x3b8/0xc80 fs/gfs2/file.c:1165 call_write_iter include/linux/fs.h:2172 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x87c/0xb3c fs/read_write.c:594 ksys_write+0x15c/0x26c fs/read_write.c:647 __do_sys_write fs/read_write.c:659 [inline] __se_sys_write fs/read_write.c:656 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:656 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 addr ffff80001d567b30 is located in stack of task syz-executor.2/4642 at offset 48 in frame: percpu_up_read include/linux/percpu-rwsem.h:118 [inline] __sb_end_write include/linux/fs.h:1806 [inline] vfs_write+0x0/0xb3c include/linux/fs.h:3051 this frame has 3 objects: [32, 48) 'iov.i' [64, 112) 'kiocb.i' [144, 184) 'iter.i' Memory state around the buggy address: ffff80001d567a00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ffff80001d567a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80001d567b00: f1 f1 f1 f1 00 00 f2 f2 00 00 00 00 00 00 f2 f2 ^ ffff80001d567b80: f2 f2 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 ffff80001d567c00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ==================================================================