================================================================== BUG: KASAN: use-after-free in alloc_branch fs/minix/itree_common.c:92 [inline] BUG: KASAN: use-after-free in get_block+0x1268/0x13a0 fs/minix/itree_common.c:191 Write of size 2 at addr ffff888077f5f3ea by task syz-executor.3/7099 CPU: 0 PID: 7099 Comm: syz-executor.3 Not tainted 5.8.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x436 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 alloc_branch fs/minix/itree_common.c:92 [inline] get_block+0x1268/0x13a0 fs/minix/itree_common.c:191 minix_get_block+0xe5/0x110 fs/minix/inode.c:376 __block_write_begin_int+0x464/0x1a80 fs/buffer.c:2012 __block_write_begin fs/buffer.c:2062 [inline] block_write_begin+0x58/0x2e0 fs/buffer.c:2121 minix_write_begin+0x35/0x220 fs/minix/inode.c:412 generic_perform_write+0x20a/0x4f0 mm/filemap.c:3299 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3428 generic_file_write_iter+0x3a6/0x5c0 mm/filemap.c:3460 call_write_iter include/linux/fs.h:1907 [inline] new_sync_write+0x422/0x650 fs/read_write.c:484 __vfs_write+0xc9/0x100 fs/read_write.c:497 __kernel_write+0x11c/0x3a0 fs/read_write.c:516 do_acct_process+0xcc2/0x10c0 kernel/acct.c:522 acct_pin_kill+0x29/0xf0 kernel/acct.c:174 pin_kill+0x16f/0x780 fs/fs_pin.c:44 mnt_pin_kill+0x62/0x1b0 fs/fs_pin.c:81 cleanup_mnt+0x413/0x500 fs/namespace.c:1111 task_work_run+0xdd/0x190 kernel/task_work.c:123 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:216 [inline] __prepare_exit_to_usermode+0x1e9/0x1f0 arch/x86/entry/common.c:246 do_syscall_64+0x6c/0xe0 arch/x86/entry/common.c:368 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45f547 Code: Bad RIP value. RSP: 002b:00007fffceca86b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000045f547 RDX: 00000000004031c8 RSI: 0000000000000002 RDI: 00007fffceca8760 RBP: 000000000000064d R08: 0000000000000000 R09: 000000000000000b R10: 0000000000000005 R11: 0000000000000246 R12: 00007fffceca97f0 R13: 00000000018f8940 R14: 0000000000000000 R15: 00007fffceca97f0 The buggy address belongs to the page: page:ffffea0001dfd7c0 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x1 flags: 0xfffe0000000000() raw: 00fffe0000000000 ffffea000213ce08 ffffea0001ae1508 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888077f5f280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888077f5f300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888077f5f380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888077f5f400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888077f5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================