REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 1) not found (pos 1) ================================================================== BUG: KASAN: out-of-bounds in leaf_paste_in_buffer+0x631/0xab0 Read of size 144 at addr ffff888090435fc0 by task syz-executor.2/19849 CPU: 0 PID: 19849 Comm: syz-executor.2 Not tainted 5.15.142-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description+0x63/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 leaf_paste_in_buffer+0x631/0xab0 leaf_copy_dir_entries+0x71a/0xc60 fs/reiserfs/lbalance.c:108 leaf_copy_boundary_item+0xbbe/0x21b0 fs/reiserfs/lbalance.c:168 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0xcd0/0x28a0 fs/reiserfs/lbalance.c:726 leaf_shift_left+0xba/0x430 fs/reiserfs/lbalance.c:750 balance_leaf+0x15cd/0x12510 fs/reiserfs/do_balan.c:1409 do_balance+0x309/0x8f0 fs/reiserfs/do_balan.c:1888 reiserfs_insert_item+0xb56/0xcb0 fs/reiserfs/stree.c:2261 reiserfs_new_inode+0x11f9/0x1d90 fs/reiserfs/inode.c:2062 reiserfs_create+0x3e3/0x6e0 fs/reiserfs/namei.c:668 lookup_open fs/namei.c:3392 [inline] open_last_lookups fs/namei.c:3462 [inline] path_openat+0x12f6/0x2f20 fs/namei.c:3669 do_filp_open+0x21c/0x460 fs/namei.c:3699 do_sys_openat2+0x13b/0x500 fs/open.c:1211 do_sys_open fs/open.c:1227 [inline] __do_sys_openat fs/open.c:1243 [inline] __se_sys_openat fs/open.c:1238 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1238 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fd17df5bba9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd17c4dd0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fd17e07af80 RCX: 00007fd17df5bba9 RDX: 0000000000080840 RSI: 0000000020000000 RDI: ffffffffffffff9c RBP: 00007fd17dfa747a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fd17e07af80 R15: 00007fffb9f81978 The buggy address belongs to the page: page:ffffea0002410d40 refcount:2 mapcount:0 mapping:ffff888146c44f30 index:0x213 pfn:0x90435 memcg:ffff88807b188000 aops:def_blk_aops ino:700002 flags: 0xfff00000002032(referenced|lru|active|private|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000002032 ffffea0000cbfe08 ffffea0000ab1d48 ffff888146c44f30 raw: 0000000000000213 ffff88808aa13828 00000002ffffffff ffff88807b188000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 19849, ts 671876358078, free_ts 671718891741 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159 __alloc_pages+0x272/0x700 mm/page_alloc.c:5421 __page_cache_alloc+0xd4/0x4a0 mm/filemap.c:1022 pagecache_get_page+0xa91/0x1010 mm/filemap.c:1940 find_or_create_page include/linux/pagemap.h:420 [inline] grow_dev_page fs/buffer.c:949 [inline] grow_buffers fs/buffer.c:1014 [inline] __getblk_slow fs/buffer.c:1041 [inline] __getblk_gfp+0x22a/0xaf0 fs/buffer.c:1336 sb_getblk include/linux/buffer_head.h:361 [inline] search_by_key+0x46d/0x4730 fs/reiserfs/stree.c:672 reiserfs_read_locked_inode+0x23c/0x2950 fs/reiserfs/inode.c:1557 reiserfs_fill_super+0x11bf/0x2690 fs/reiserfs/super.c:2075 mount_bdev+0x2c9/0x3f0 fs/super.c:1387 legacy_get_tree+0xeb/0x180 fs/fs_context.c:611 vfs_get_tree+0x88/0x270 fs/super.c:1517 do_new_mount+0x28b/0xae0 fs/namespace.c:2994 do_mount fs/namespace.c:3337 [inline] __do_sys_mount fs/namespace.c:3545 [inline] __se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3522 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317 free_unref_page_list+0x1f7/0x8e0 mm/page_alloc.c:3433 release_pages+0x1bb9/0x1f40 mm/swap.c:963 __pagevec_release+0x80/0xf0 mm/swap.c:983 pagevec_release include/linux/pagevec.h:81 [inline] shmem_undo_range+0x67a/0x1b50 mm/shmem.c:964 shmem_truncate_range mm/shmem.c:1063 [inline] shmem_evict_inode+0x21b/0xa00 mm/shmem.c:1145 evict+0x2a4/0x620 fs/inode.c:587 __dentry_kill+0x436/0x650 fs/dcache.c:582 dentry_kill+0xbb/0x290 dput+0x1f1/0x420 fs/dcache.c:888 __fput+0x5ec/0x890 fs/file_table.c:288 task_work_run+0x129/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:175 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 Memory state around the buggy address: ffff888090435f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888090435f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888090436000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888090436080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888090436100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================