================================================================== BUG: KASAN: stack-out-of-bounds in gfs2_dump_glock+0xfe4/0x1558 Read of size 8 at addr ffff800021c17b00 by task syz.6.288/5964 CPU: 0 PID: 5964 Comm: syz.6.288 Not tainted 6.1.129-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:427 kasan_report+0xd4/0x130 mm/kasan/report.c:531 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351 gfs2_dump_glock+0xfe4/0x1558 gfs2_consist_inode_i+0xe8/0x10c fs/gfs2/util.c:467 gfs2_dirent_scan+0x458/0x584 fs/gfs2/dir.c:602 gfs2_dirent_search+0x28c/0x790 fs/gfs2/dir.c:850 gfs2_dir_search+0xb8/0x280 fs/gfs2/dir.c:1650 gfs2_lookupi+0x3cc/0x5a0 fs/gfs2/inode.c:323 __gfs2_lookup+0xb0/0x28c fs/gfs2/inode.c:870 gfs2_lookup+0x2c/0x3c fs/gfs2/inode.c:904 __lookup_slow+0x250/0x374 fs/namei.c:1690 lookup_slow+0x60/0x84 fs/namei.c:1707 walk_component+0x280/0x36c fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2479 filename_lookup+0x1d4/0x4e0 fs/namei.c:2508 user_path_at_empty+0x5c/0x84 fs/namei.c:2905 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3396 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __arm64_sys_mount+0x460/0x588 fs/namespace.c:3584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the virtual mapping at [ffff800021c10000, ffff800021c19000) created by: copy_process+0x530/0x38f8 kernel/fork.c:2096 The buggy address belongs to the physical page: page:000000002d9ce49d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115554 memcg:ffff0000d0162802 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff0000d0162802 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800021c17a00: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 f2 ffff800021c17a80: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff800021c17b00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff800021c17b80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 ffff800021c17c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 5964 Comm: syz.6.288 Tainted: G B 6.1.129-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : pid_is_meaningful fs/gfs2/glock.c:1466 [inline] pc : dump_holder fs/gfs2/glock.c:2326 [inline] pc : gfs2_dump_glock+0xa6c/0x1558 fs/gfs2/glock.c:2440 lr : rcu_read_lock include/linux/rcupdate.h:792 [inline] lr : dump_holder fs/gfs2/glock.c:2325 [inline] lr : gfs2_dump_glock+0xa04/0x1558 fs/gfs2/glock.c:2440 sp : ffff800022c06fe0 x29: ffff800022c072e0 x28: 0000000000000040 x27: ffff800021c17b30 x26: 0000000000000021 x25: ffff800022c070c0 x24: 0000000000000001 x23: dfff800000000000 x22: ffff8000184d6000 x21: ffff800022c070e0 x20: 0000000000000000 x19: 0000000000000004 x18: 1fffe0003679cb76 x17: 0000000000000000 x16: ffff80001232163c x15: 0000000000000002 x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000080000 x11: 000000000007ffff x10: ffff8000339db000 x9 : ffff80000a41b0e0 x8 : 0000000000080000 x7 : 0000000000000000 x6 : ffff80000a42806c x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: pid_is_meaningful fs/gfs2/glock.c:1466 [inline] dump_holder fs/gfs2/glock.c:2326 [inline] gfs2_dump_glock+0xa6c/0x1558 fs/gfs2/glock.c:2440 gfs2_consist_inode_i+0xe8/0x10c fs/gfs2/util.c:467 gfs2_dirent_scan+0x458/0x584 fs/gfs2/dir.c:602 gfs2_dirent_search+0x28c/0x790 fs/gfs2/dir.c:850 gfs2_dir_search+0xb8/0x280 fs/gfs2/dir.c:1650 gfs2_lookupi+0x3cc/0x5a0 fs/gfs2/inode.c:323 __gfs2_lookup+0xb0/0x28c fs/gfs2/inode.c:870 gfs2_lookup+0x2c/0x3c fs/gfs2/inode.c:904 __lookup_slow+0x250/0x374 fs/namei.c:1690 lookup_slow+0x60/0x84 fs/namei.c:1707 walk_component+0x280/0x36c fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2479 filename_lookup+0x1d4/0x4e0 fs/namei.c:2508 user_path_at_empty+0x5c/0x84 fs/namei.c:2905 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3396 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __arm64_sys_mount+0x460/0x588 fs/namespace.c:3584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: 391c3a68 977bd5a6 9100831a d343ff53 (38f76a68) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 391c3a68 strb w8, [x19, #1806] 4: 977bd5a6 bl 0xfffffffffdef569c 8: 9100831a add x26, x24, #0x20 c: d343ff53 lsr x19, x26, #3 * 10: 38f76a68 ldrsb w8, [x19, x23] <-- trapping instruction