REISERFS (device loop7): Created .reiserfs_priv - reserved for xattr storage. ================================================================== BUG: KASAN: use-after-free in leaf_paste_entries+0x64b/0x13a0 fs/reiserfs/lbalance.c:1362 Read of size 2 at addr ffff88805695f008 by task syz.7.1415/8572 CPU: 0 PID: 8572 Comm: syz.7.1415 Not tainted 6.1.115-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 leaf_paste_entries+0x64b/0x13a0 fs/reiserfs/lbalance.c:1362 leaf_copy_dir_entries+0x7ec/0xc60 fs/reiserfs/lbalance.c:119 leaf_copy_boundary_item+0xbbe/0x21b0 fs/reiserfs/lbalance.c:168 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0xcd0/0x28a0 fs/reiserfs/lbalance.c:726 leaf_shift_left+0xba/0x430 fs/reiserfs/lbalance.c:750 balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline] balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline] balance_leaf+0x228e/0x12510 fs/reiserfs/do_balan.c:1393 do_balance+0x309/0x8f0 fs/reiserfs/do_balan.c:1888 reiserfs_cut_from_item+0x1945/0x2580 fs/reiserfs/stree.c:1838 reiserfs_do_truncate+0xa12/0x15b0 fs/reiserfs/stree.c:1973 reiserfs_truncate_file+0x4d6/0x810 fs/reiserfs/inode.c:2310 reiserfs_setattr+0xc57/0x11c0 fs/reiserfs/inode.c:3395 notify_change+0xce3/0xfc0 fs/attr.c:499 do_truncate+0x21c/0x300 fs/open.c:65 handle_truncate fs/namei.c:3285 [inline] do_open fs/namei.c:3630 [inline] path_openat+0x27e2/0x2e60 fs/namei.c:3783 do_filp_open+0x230/0x480 fs/namei.c:3810 do_sys_openat2+0x13b/0x4f0 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f21ab17e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f21abf13038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f21ab335f80 RCX: 00007f21ab17e719 RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007f21ab1f139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f21ab335f80 R15: 00007ffd4a920d98 The buggy address belongs to the physical page: page:ffffea00015a57c0 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x1 pfn:0x5695f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001415b88 ffffea00013f42c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 8558, tgid 8557 (syz.1.1412), ts 252894430511, free_ts 253759225799 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2517 prep_new_page mm/page_alloc.c:2524 [inline] get_page_from_freelist+0x322e/0x33b0 mm/page_alloc.c:4290 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5558 __folio_alloc+0xf/0x30 mm/page_alloc.c:5590 vma_alloc_folio+0x486/0x990 mm/mempolicy.c:2243 alloc_page_vma include/linux/gfp.h:284 [inline] do_anonymous_page mm/memory.c:4189 [inline] handle_pte_fault mm/memory.c:5027 [inline] __handle_mm_fault mm/memory.c:5171 [inline] handle_mm_fault+0x2e8e/0x5340 mm/memory.c:5292 do_user_addr_fault arch/x86/mm/fault.c:1340 [inline] handle_page_fault arch/x86/mm/fault.c:1431 [inline] exc_page_fault+0x26f/0x620 arch/x86/mm/fault.c:1487 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1444 [inline] free_pcp_prepare mm/page_alloc.c:1494 [inline] free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3369 free_unref_page_list+0x663/0x900 mm/page_alloc.c:3510 release_pages+0x2836/0x2b40 mm/swap.c:1055 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261 zap_pte_range mm/memory.c:1525 [inline] zap_pmd_range mm/memory.c:1574 [inline] zap_pud_range mm/memory.c:1603 [inline] zap_p4d_range mm/memory.c:1624 [inline] unmap_page_range+0x217c/0x2740 mm/memory.c:1645 unmap_vmas+0x48b/0x640 mm/memory.c:1730 exit_mmap+0x252/0x9f0 mm/mmap.c:3227 __mmput+0x115/0x3c0 kernel/fork.c:1199 exit_mm+0x226/0x300 kernel/exit.c:565 do_exit+0x9f6/0x26a0 kernel/exit.c:858 do_group_exit+0x202/0x2b0 kernel/exit.c:1021 get_signal+0x16f7/0x17d0 kernel/signal.c:2870 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303 Memory state around the buggy address: ffff88805695ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88805695ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88805695f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805695f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805695f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================