================================================================== BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x578/0x9f0 Read of size 48 at addr ffff00013485dff0 by task syz-executor.1/8576 CPU: 0 PID: 8576 Comm: syz-executor.1 Not tainted 6.7.0-rc8-syzkaller-g0802e17d9aca #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x174/0x514 mm/kasan/report.c:475 kasan_report+0xd8/0x138 mm/kasan/report.c:588 kasan_check_range+0x254/0x294 mm/kasan/generic.c:187 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105 leaf_paste_in_buffer+0x578/0x9f0 leaf_copy_dir_entries+0x2b4/0xa04 fs/reiserfs/lbalance.c:108 leaf_copy_boundary_item+0x8c4/0x1a34 fs/reiserfs/lbalance.c:168 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0xa0c/0x1f7c fs/reiserfs/lbalance.c:726 leaf_shift_left+0xc8/0x39c fs/reiserfs/lbalance.c:750 balance_leaf_left fs/reiserfs/do_balan.c:616 [inline] balance_leaf+0x103c/0xe860 fs/reiserfs/do_balan.c:1409 do_balance+0x27c/0x788 fs/reiserfs/do_balan.c:1888 reiserfs_insert_item+0x940/0xa84 fs/reiserfs/stree.c:2260 reiserfs_new_inode+0xd28/0x1698 fs/reiserfs/inode.c:2048 reiserfs_mkdir+0x4ac/0x77c fs/reiserfs/namei.c:843 vfs_mkdir+0x27c/0x3e4 fs/namei.c:4106 do_mkdirat+0x248/0x574 fs/namei.c:4129 __do_sys_mkdirat fs/namei.c:4144 [inline] __se_sys_mkdirat fs/namei.c:4142 [inline] __arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4142 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 The buggy address belongs to the physical page: page:0000000022ae6348 refcount:2 mapcount:0 mapping:000000004ec9b15a index:0x214 pfn:0x17485d memcg:ffff00012a5a6000 aops:def_blk_aops ino:700001 flags: 0x5ffc00000008124(referenced|lru|active|private|node=0|zone=2|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 05ffc00000008124 fffffc0004d73548 fffffc0004d9bb88 ffff0000c154ab10 raw: 0000000000000214 ffff0001295502b8 00000002ffffffff ffff00012a5a6000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff00013485df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff00013485df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff00013485e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff00013485e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff00013485e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 5 0(1) DIR], item_len 35, item_location 3997, free_space(entry_count) 2 REISERFS error (device loop1): vs-5150 search_by_key: invalid format found in block 532. Fsck? REISERFS (device loop1): Remounting filesystem read-only REISERFS error (device loop1): vs-13050 reiserfs_update_sd_size: i/o failure occurred trying to update [2 5 0x0 SD] stat data REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 3937, free_space(entry_count) 2 REISERFS error (device loop1): vs-5150 search_by_key: invalid format found in block 531. Fsck? REISERFS error (device loop1): zam-7001 reiserfs_find_entry: io error REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 5 0(1) DIR], item_len 35, item_location 3997, free_space(entry_count) 2 REISERFS error (device loop1): vs-5150 search_by_key: invalid format found in block 532. Fsck? REISERFS error (device loop1): vs-13050 reiserfs_update_sd_size: i/o failure occurred trying to update [2 5 0x0 SD] stat data