==================================================================
BUG: KASAN: use-after-free in le32_add_cpu include/linux/byteorder/generic.h:151 [inline]
BUG: KASAN: use-after-free in udf_free_inode+0x214/0x284 fs/udf/ialloc.c:-1
Read of size 4 at addr ffff00018b7a4420 by task syz.4.82/4824

CPU: 1 PID: 4824 Comm: syz.4.82 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0x100 mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 le32_add_cpu include/linux/byteorder/generic.h:151 [inline]
 udf_free_inode+0x214/0x284 fs/udf/ialloc.c:-1
 udf_evict_inode+0x2dc/0x388 fs/udf/inode.c:164
 evict+0x3c8/0x810 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x764/0x7f4 fs/inode.c:1860
 do_unlinkat+0x360/0x4e8 fs/namei.c:4405
 __do_sys_unlinkat fs/namei.c:4441 [inline]
 __se_sys_unlinkat fs/namei.c:4434 [inline]
 __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:00000000531dfa1f refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1cb7a4
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc00062de908 fffffc00062de908 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00018b7a4300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff00018b7a4380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff00018b7a4400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff00018b7a4480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff00018b7a4500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41
Modules linked in:
CPU: 0 PID: 4824 Comm: syz.4.82 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
pc : udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41
lr : udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
lr : udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41
sp : ffff8000213479d0
x29: ffff8000213479e0 x28: 1fffe00020287131 x27: dfff800000000000
x26: 1fffe0001858e4cf x25: ffff0000f4143c00 x24: dfff800000000000
x23: 0000000000008000 x22: 00000000b5926b20 x21: ffff0000c2c72678
x20: ffff0000c2c72000 x19: ffff0001014387c0 x18: ffff800011a5bd40
x17: 1fffe00033ee7b7e x16: ffff800008042d90 x15: 0000000040000000
x14: 0000000000000002 x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff0080000980b32c x10: 0000000000000000 x9 : ffff80000980b32c
x8 : ffff0000d7f71bc0 x7 : 0000000000000004 x6 : ffff8000082532dc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008191f94
x2 : 0000000000000001 x1 : 00000000b5926b20 x0 : 0000000000000000
Call trace:
 udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
 udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41
 udf_evict_inode+0x2dc/0x388 fs/udf/inode.c:164
 evict+0x3c8/0x810 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x764/0x7f4 fs/inode.c:1860
 do_unlinkat+0x360/0x4e8 fs/namei.c:4405
 __do_sys_unlinkat fs/namei.c:4441 [inline]
 __se_sys_unlinkat fs/namei.c:4434 [inline]
 __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 15059
hardirqs last  enabled at (15059): [<ffff800008253370>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last  enabled at (15059): [<ffff800008253370>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003
hardirqs last disabled at (15058): [<ffff8000119d0a7c>] __schedule+0x298/0x1b18 kernel/sched/core.c:6459
softirqs last  enabled at (14634): [<ffff8000081aa3e0>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (14634): [<ffff8000081aa3e0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (14625): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_add_free_space fs/udf/balloc.c:137 [inline]
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_bitmap_free_blocks fs/udf/balloc.c:183 [inline]
WARNING: CPU: 0 PID: 4824 at fs/udf/udfdecl.h:127 udf_free_blocks+0x680/0x138c fs/udf/balloc.c:683
Modules linked in:
CPU: 0 PID: 4824 Comm: syz.4.82 Tainted: G    B   W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
pc : udf_add_free_space fs/udf/balloc.c:137 [inline]
pc : udf_bitmap_free_blocks fs/udf/balloc.c:183 [inline]
pc : udf_free_blocks+0x680/0x138c fs/udf/balloc.c:683
lr : udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
lr : udf_add_free_space fs/udf/balloc.c:137 [inline]
lr : udf_bitmap_free_blocks fs/udf/balloc.c:183 [inline]
lr : udf_free_blocks+0x680/0x138c fs/udf/balloc.c:683
sp : ffff8000213477a0
x29: ffff800021347970 x28: ffff700004268f0c x27: ffff0000c2c72000
x26: 0000000000000000 x25: 1fffe0001858e4cf x24: dfff800000000000
x23: ffff0000c2c72678 x22: ffff0000f9a14000 x21: 00000000b5926b20
x20: 0000000000001000 x19: 0000000000000128 x18: ffff800011a5bd40
x17: 1fffe00033ee7b7e x16: ffff800008042d90 x15: 0000000000000000
x14: 0000000000000406 x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff008000098054f8 x10: 0000000000000000 x9 : ffff8000098054f8
x8 : ffff0000d7f71bc0 x7 : 0000000000000000 x6 : ffff800008a7d7b4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008a80cf4
x2 : 0000000000000000 x1 : 00000000b5926b20 x0 : 0000000000000000
Call trace:
 udf_updated_lvid fs/udf/udfdecl.h:125 [inline]
 udf_add_free_space fs/udf/balloc.c:137 [inline]
 udf_bitmap_free_blocks fs/udf/balloc.c:183 [inline]
 udf_free_blocks+0x680/0x138c fs/udf/balloc.c:683
 udf_free_inode+0x1ac/0x284 fs/udf/ialloc.c:45
 udf_evict_inode+0x2dc/0x388 fs/udf/inode.c:164
 evict+0x3c8/0x810 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x764/0x7f4 fs/inode.c:1860
 do_unlinkat+0x360/0x4e8 fs/namei.c:4405
 __do_sys_unlinkat fs/namei.c:4441 [inline]
 __se_sys_unlinkat fs/namei.c:4434 [inline]
 __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 15059
hardirqs last  enabled at (15059): [<ffff800008253370>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last  enabled at (15059): [<ffff800008253370>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003
hardirqs last disabled at (15058): [<ffff8000119d0a7c>] __schedule+0x298/0x1b18 kernel/sched/core.c:6459
softirqs last  enabled at (14634): [<ffff8000081aa3e0>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (14634): [<ffff8000081aa3e0>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (14625): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---