(kworker/u8:15,1482,0):ocfs2_read_blocks_sync:112 ERROR: status = -12
(kworker/u8:15,1482,0):ocfs2_read_locked_inode:599 ERROR: status = -12
==================================================================
BUG: KASAN: slab-use-after-free in ocfs2_check_dir_entry+0x3a0/0x480 fs/ocfs2/dir.c:318
Read of size 2 at addr ffff888039b4f780 by task kworker/u8:15/1482

CPU: 0 UID: 0 PID: 1482 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: ocfs2_wq ocfs2_complete_recovery
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 ocfs2_check_dir_entry+0x3a0/0x480 fs/ocfs2/dir.c:318
 ocfs2_dir_foreach_blk_id fs/ocfs2/dir.c:1826 [inline]
 ocfs2_dir_foreach_blk+0xfff/0x1420 fs/ocfs2/dir.c:1954
 ocfs2_dir_foreach+0x42/0x70 fs/ocfs2/dir.c:1965
 ocfs2_queue_orphans fs/ocfs2/journal.c:2215 [inline]
 ocfs2_recover_orphans fs/ocfs2/journal.c:2299 [inline]
 ocfs2_complete_recovery+0xc37/0x20b0 fs/ocfs2/journal.c:1366
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 16:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 unpoison_slab_object mm/kasan/common.c:339 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:365
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4948 [inline]
 slab_alloc_node mm/slub.c:5258 [inline]
 kmem_cache_alloc_node_noprof+0x23c/0x6f0 mm/slub.c:5310
 kmalloc_reserve+0xbd/0x290 net/core/skbuff.c:586
 __alloc_skb+0x27e/0x430 net/core/skbuff.c:690
 skb_copy+0x188/0x800 net/core/skbuff.c:2162
 mac80211_hwsim_tx_frame_no_nl+0xcd3/0x11c0 drivers/net/wireless/virtual/mac80211_hwsim.c:1891
 mac80211_hwsim_tx_frame+0x1b5/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2264
 mac80211_hwsim_beacon_tx+0x3e8/0x870 drivers/net/wireless/virtual/mac80211_hwsim.c:2365
 __iterate_interfaces+0x2ab/0x590 net/mac80211/util.c:761
 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:797
 mac80211_hwsim_beacon+0xbb/0x180 drivers/net/wireless/virtual/mac80211_hwsim.c:2395
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x542/0xd00 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x1a3/0x2e0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x226/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Freed by task 13:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 kasan_save_free_info+0x4[  134.111899][ T1482]  kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6663 [inline]
 kmem_cache_free+0x18f/0x8d0 mm/slub.c:6774
 skb_release_data+0x62d/0x7c0 net/core/skbuff.c:1107
 skb_release_all net/core/skbuff.c:1182 [inline]
 __kfree_skb net/core/skbuff.c:1196 [inline]
 sk_skb_reason_drop+0x127/0x170 net/core/skbuff.c:1234
 kfree_skb_reason include/linux/skbuff.h:1322 [inline]
 kfree_skb include/linux/skbuff.h:1331 [inline]
 ieee80211_iface_work+0xb2a/0x12d0 net/mac80211/iface.c:1792
 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

The buggy address belongs to the object at ffff888039b4f740
 which belongs to the cache skbuff_small_head of size 704
The buggy address is located 64 bytes inside of
 freed 704-byte region [ffff888039b4f740, ffff888039b4fa00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x39b4c
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88801bede140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88801bede140 dead000000000122 0000000000000000
head: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000
head: 0080000000000002 ffffea0000e6d301 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2150, tgid 2150 (kworker/u8:17), ts 133376242266, free_ts 132029573869
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x234/0x290 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0x28c0/0x2960 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210
 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x86/0x3b0 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0xb10/0x1400 mm/slub.c:4651
 __slab_alloc+0xc6/0x1f0 mm/slub.c:4774
 __slab_alloc_node mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 kmem_cache_alloc_node_noprof+0x1b6/0x6f0 mm/slub.c:5310
 kmalloc_reserve+0xbd/0x290 net/core/skbuff.c:586
 __alloc_skb+0x27e/0x430 net/core/skbuff.c:690
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 inet6_rt_notify+0x170/0x470 net/ipv6/route.c:6345
 fib6_add_rt2node+0x187f/0x3470 net/ipv6/ip6_fib.c:1279
 fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532
 __ip6_ins_rt net/ipv6/route.c:1351 [inline]
 ip6_ins_rt+0xdf/0x150 net/ipv6/route.c:1361
 __ipv6_ifa_notify+0x62f/0xaa0 net/ipv6/addrconf.c:6283
 ipv6_ifa_notify net/ipv6/addrconf.c:6322 [inline]
 addrconf_dad_completed+0x16f/0xd70 net/ipv6/addrconf.c:4320
page last free pid 6037 tgid 6037 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0xfe1/0x1170 mm/page_alloc.c:2943
 __slab_free+0x1c3/0x210 mm/slub.c:5999
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4948 [inline]
 slab_alloc_node mm/slub.c:5258 [inline]
 kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5265
 mt_alloc_one lib/maple_tree.c:174 [inline]
 mas_alloc_nodes+0x291/0x350 lib/maple_tree.c:1110
 mas_preallocate+0x2e0/0x670 lib/maple_tree.c:5194
 vma_iter_prealloc mm/vma.h:502 [inline]
 commit_merge+0x1fa/0x620 mm/vma.c:746
 vma_expand+0x4a3/0xa10 mm/vma.c:1160
 vma_merge_new_range+0x61b/0x7b0 mm/vma.c:1092
 __mmap_region mm/vma.c:2703 [inline]
 mmap_region+0xd7e/0x1d00 mm/vma.c:2786
 do_mmap+0xc23/0x10c0 mm/mmap.c:558
 vm_mmap_pgoff+0x2a9/0x4d0 mm/util.c:581
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888039b4f680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888039b4f700: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888039b4f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888039b4f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888039b4f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================