VFS: Found a Xenix FS (block size = 1024) on device loop2 syz.2.120: attempt to access beyond end of device loop2: rw=0, sector=6491536, nr_sectors = 2 limit=128 Buffer I/O error on dev loop2, logical block 3245768, async page read ================================================================== BUG: KASAN: use-after-free in sysv_new_inode+0x107e/0x1210 fs/sysv/ialloc.c:153 Read of size 2 at addr ffff888070eab1ce by task syz.2.120/4852 CPU: 1 PID: 4852 Comm: syz.2.120 Not tainted 6.1.114-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 sysv_new_inode+0x107e/0x1210 fs/sysv/ialloc.c:153 sysv_symlink+0x9b/0x180 fs/sysv/namei.c:80 vfs_symlink+0x247/0x3d0 fs/namei.c:4471 do_symlinkat+0x21e/0x390 fs/namei.c:4500 __do_sys_symlink fs/namei.c:4522 [inline] __se_sys_symlink fs/namei.c:4520 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4520 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7c9697e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7c977a6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 00007f7c96b35f80 RCX: 00007f7c9697e719 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000020000080 RBP: 00007f7c969f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f7c96b35f80 R15: 00007ffec7a2d558 The buggy address belongs to the physical page: page:ffffea0001c3aac0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x70eab flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea00015b8388 ffffea0001c3aa88 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4817, tgid 4814 (syz.0.110), ts 122550273397, free_ts 122758881464 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2517 prep_new_page mm/page_alloc.c:2524 [inline] get_page_from_freelist+0x322e/0x33b0 mm/page_alloc.c:4290 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5558 __folio_alloc+0xf/0x30 mm/page_alloc.c:5590 vma_alloc_folio+0x486/0x990 mm/mempolicy.c:2243 alloc_page_vma include/linux/gfp.h:284 [inline] wp_page_copy+0x25d/0x18c0 mm/memory.c:3146 handle_pte_fault mm/memory.c:5047 [inline] __handle_mm_fault mm/memory.c:5171 [inline] handle_mm_fault+0x2525/0x5340 mm/memory.c:5292 do_user_addr_fault arch/x86/mm/fault.c:1340 [inline] handle_page_fault arch/x86/mm/fault.c:1431 [inline] exc_page_fault+0x26f/0x620 arch/x86/mm/fault.c:1487 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1444 [inline] free_pcp_prepare mm/page_alloc.c:1494 [inline] free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3369 free_unref_page_list+0x663/0x900 mm/page_alloc.c:3510 release_pages+0x2836/0x2b40 mm/swap.c:1055 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261 zap_pte_range mm/memory.c:1525 [inline] zap_pmd_range mm/memory.c:1574 [inline] zap_pud_range mm/memory.c:1603 [inline] zap_p4d_range mm/memory.c:1624 [inline] unmap_page_range+0x217c/0x2740 mm/memory.c:1645 unmap_vmas+0x48b/0x640 mm/memory.c:1730 exit_mmap+0x252/0x9f0 mm/mmap.c:3227 __mmput+0x115/0x3c0 kernel/fork.c:1199 exit_mm+0x226/0x300 kernel/exit.c:565 do_exit+0x9f6/0x26a0 kernel/exit.c:858 do_group_exit+0x202/0x2b0 kernel/exit.c:1021 get_signal+0x16f7/0x17d0 kernel/signal.c:2870 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303 Memory state around the buggy address: ffff888070eab080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888070eab100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888070eab180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888070eab200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888070eab280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================