==================================================================
BUG: KASAN: slab-use-after-free in drop_metapage fs/jfs/jfs_metapage.c:229 [inline]
BUG: KASAN: slab-use-after-free in release_metapage+0x67c/0xa38 fs/jfs/jfs_metapage.c:784
Read of size 8 at addr ffff0000f53f3310 by task syz.0.70/6834

CPU: 1 UID: 0 PID: 6834 Comm: syz.0.70 Not tainted 6.14.0-rc7-syzkaller-gb5737d35364f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0x198/0x550 mm/kasan/report.c:521
 kasan_report+0xd8/0x138 mm/kasan/report.c:634
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 drop_metapage fs/jfs/jfs_metapage.c:229 [inline]
 release_metapage+0x67c/0xa38 fs/jfs/jfs_metapage.c:784
 write_metapage fs/jfs/jfs_metapage.h:75 [inline]
 flush_metapage fs/jfs/jfs_metapage.h:81 [inline]
 ea_put fs/jfs/xattr.c:618 [inline]
 __jfs_setxattr+0xe78/0x137c fs/jfs/xattr.c:787
 __jfs_xattr_set+0xf8/0x190 fs/jfs/xattr.c:936
 jfs_xattr_set+0x58/0x70 fs/jfs/xattr.c:960
 __vfs_setxattr+0x3d8/0x400 fs/xattr.c:200
 __vfs_setxattr_noperm+0x110/0x578 fs/xattr.c:234
 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295
 vfs_setxattr+0x1a8/0x344 fs/xattr.c:321
 do_setxattr fs/xattr.c:636 [inline]
 filename_setxattr+0x268/0x3fc fs/xattr.c:665
 path_setxattrat+0x370/0x41c fs/xattr.c:713
 __do_sys_setxattr fs/xattr.c:747 [inline]
 __se_sys_setxattr fs/xattr.c:743 [inline]
 __arm64_sys_setxattr+0xc0/0xdc fs/xattr.c:743
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Allocated by task 6834:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4115 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_noprof+0x254/0x410 mm/slub.c:4171
 mempool_alloc_slab+0x58/0x74 mm/mempool.c:559
 mempool_alloc_noprof+0x150/0x48c mm/mempool.c:402
 alloc_metapage fs/jfs/jfs_metapage.c:182 [inline]
 __get_metapage+0x598/0x1370 fs/jfs/jfs_metapage.c:652
 ea_get+0x8b4/0xf30 fs/jfs/xattr.c:528
 __jfs_setxattr+0x4c4/0x137c fs/jfs/xattr.c:722
 __jfs_xattr_set+0xf8/0x190 fs/jfs/xattr.c:936
 jfs_xattr_set+0x58/0x70 fs/jfs/xattr.c:960
 __vfs_setxattr+0x3d8/0x400 fs/xattr.c:200
 __vfs_setxattr_noperm+0x110/0x578 fs/xattr.c:234
 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295
 vfs_setxattr+0x1a8/0x344 fs/xattr.c:321
 do_setxattr fs/xattr.c:636 [inline]
 filename_setxattr+0x268/0x3fc fs/xattr.c:665
 path_setxattrat+0x370/0x41c fs/xattr.c:713
 __do_sys_setxattr fs/xattr.c:747 [inline]
 __se_sys_setxattr fs/xattr.c:743 [inline]
 __arm64_sys_setxattr+0xc0/0xdc fs/xattr.c:743
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Freed by task 6851:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x64/0x8c mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kmem_cache_free+0x198/0x554 mm/slub.c:4711
 mempool_free_slab+0x28/0x38 mm/mempool.c:566
 mempool_free+0xbc/0x2e8 mm/mempool.c:548
 free_metapage fs/jfs/jfs_metapage.c:197 [inline]
 drop_metapage fs/jfs/jfs_metapage.c:234 [inline]
 release_metapage+0x72c/0xa38 fs/jfs/jfs_metapage.c:784
 ea_release+0xd4/0x1cc fs/jfs/xattr.c:588
 ea_get+0xa3c/0xf30 fs/jfs/xattr.c:567
 __jfs_getxattr+0xd8/0x550 fs/jfs/xattr.c:811
 jfs_xattr_get+0x50/0x68 fs/jfs/xattr.c:950
 __vfs_getxattr+0x394/0x3c0 fs/xattr.c:423
 smk_fetch+0xc8/0x150 security/smack/smack_lsm.c:290
 smack_d_instantiate+0x658/0x880 security/smack/smack_lsm.c:3628
 security_d_instantiate+0x100/0x204 security/security.c:4079
 d_splice_alias+0x70/0x310 fs/dcache.c:3017
 jfs_lookup+0x270/0x39c fs/jfs/namei.c:1474
 lookup_one_qstr_excl+0x10c/0x25c fs/namei.c:1693
 do_renameat2+0x51c/0xe50 fs/namei.c:5167
 __do_sys_renameat2 fs/namei.c:5260 [inline]
 __se_sys_renameat2 fs/namei.c:5257 [inline]
 __arm64_sys_renameat2+0xd8/0xf4 fs/namei.c:5257
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

The buggy address belongs to the object at ffff0000f53f32e8
 which belongs to the cache jfs_mp of size 184
The buggy address is located 40 bytes inside of
 freed 184-byte region [ffff0000f53f32e8, ffff0000f53f33a0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1353f3
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000000 ffff0000c4822500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f53f3200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f53f3280: fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb
>ffff0000f53f3300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff0000f53f3380: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000f53f3400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...