gfs2: fsid=syz:syz.0:  H: s:SH f: e:0 p:9318 [syz.4.415] __gfs2_lookup+0xa4/0x280 fs/gfs2/inode.c:896
==================================================================
BUG: KASAN: slab-out-of-bounds in pid_is_meaningful fs/gfs2/glock.c:1483 [inline]
BUG: KASAN: slab-out-of-bounds in dump_holder fs/gfs2/glock.c:2314 [inline]
BUG: KASAN: slab-out-of-bounds in gfs2_dump_glock+0x15e0/0x1bb0 fs/gfs2/glock.c:2430
Read of size 2 at addr ffff888022fcb750 by task syz.4.415/9320

CPU: 1 UID: 0 PID: 9320 Comm: syz.4.415 Not tainted 6.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 pid_is_meaningful fs/gfs2/glock.c:1483 [inline]
 dump_holder fs/gfs2/glock.c:2314 [inline]
 gfs2_dump_glock+0x15e0/0x1bb0 fs/gfs2/glock.c:2430
 gfs2_consist_inode_i+0xf5/0x110 fs/gfs2/util.c:457
 gfs2_dirent_scan+0x52b/0x670
 gfs2_dirent_search+0x30e/0x8c0 fs/gfs2/dir.c:853
 gfs2_dir_search+0xb2/0x2f0 fs/gfs2/dir.c:1653
 gfs2_lookupi+0x461/0x5e0 fs/gfs2/inode.c:340
 __gfs2_lookup+0xa4/0x280 fs/gfs2/inode.c:896
 __lookup_slow+0x28c/0x3f0 fs/namei.c:1718
 lookup_slow+0x53/0x70 fs/namei.c:1735
 walk_component+0x2e1/0x410 fs/namei.c:2039
 lookup_last fs/namei.c:2542 [inline]
 path_lookupat+0x16f/0x450 fs/namei.c:2566
 filename_lookup+0x256/0x610 fs/namei.c:2595
 kern_path+0x35/0x50 fs/namei.c:2703
 lookup_bdev+0xc5/0x290 block/bdev.c:1157
 btrfs_control_ioctl+0x270/0x3e0 fs/btrfs/super.c:2251
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5e35b7cef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5e36947038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5e35d36058 RCX: 00007f5e35b7cef9
RDX: 00000000200004c0 RSI: 0000000050009405 RDI: 0000000000000009
RBP: 00007f5e35bef046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5e35d36058 R15: 00007ffe50630aa8
 </TASK>

Allocated by task 9318:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3992 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4060
 __d_alloc+0x31/0x700 fs/dcache.c:1636
 d_alloc fs/dcache.c:1716 [inline]
 d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2476
 __lookup_slow+0x117/0x3f0 fs/namei.c:1703
 lookup_slow+0x53/0x70 fs/namei.c:1735
 walk_component+0x2e1/0x410 fs/namei.c:2039
 lookup_last fs/namei.c:2542 [inline]
 path_lookupat+0x16f/0x450 fs/namei.c:2566
 filename_lookup+0x256/0x610 fs/namei.c:2595
 user_path_at+0x3a/0x60 fs/namei.c:3002
 do_sys_truncate+0xa4/0x190 fs/open.c:132
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
 __call_rcu_common kernel/rcu/tree.c:3106 [inline]
 call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210
 __dentry_kill+0x497/0x630 fs/dcache.c:634
 dput+0x19f/0x2b0 fs/dcache.c:857
 __lookup_slow+0x36d/0x3f0 fs/namei.c:1721
 lookup_slow+0x53/0x70 fs/namei.c:1735
 walk_component+0x2e1/0x410 fs/namei.c:2039
 lookup_last fs/namei.c:2542 [inline]
 path_lookupat+0x16f/0x450 fs/namei.c:2566
 filename_lookup+0x256/0x610 fs/namei.c:2595
 user_path_at+0x3a/0x60 fs/namei.c:3002
 do_sys_truncate+0xa4/0x190 fs/open.c:132
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888022fcb608
 which belongs to the cache dentry of size 312
The buggy address is located 16 bytes to the right of
 allocated 312-byte region [ffff888022fcb608, ffff888022fcb740)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888022fca178 pfn:0x22fca
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888032988201
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801b6fea00 ffffea0001f57100 dead000000000002
raw: ffff888022fca178 0000000080150012 00000001fdffffff ffff888032988201
head: 00fff00000000040 ffff88801b6fea00 ffffea0001f57100 dead000000000002
head: ffff888022fca178 0000000080150012 00000001fdffffff ffff888032988201
head: 00fff00000000001 ffffea00008bf281 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4692, tgid 4692 (udevadm), ts 21868613553, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x5f/0x120 mm/slub.c:2325
 allocate_slab+0x5a/0x2f0 mm/slub.c:2488
 new_slab mm/slub.c:2541 [inline]
 ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3727
 __slab_alloc+0x58/0xa0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4060
 __d_alloc+0x31/0x700 fs/dcache.c:1636
 d_alloc fs/dcache.c:1716 [inline]
 d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2476
 __lookup_slow+0x117/0x3f0 fs/namei.c:1703
 lookup_slow+0x53/0x70 fs/namei.c:1735
 walk_component+0x2e1/0x410 fs/namei.c:2039
 lookup_last fs/namei.c:2542 [inline]
 path_lookupat+0x16f/0x450 fs/namei.c:2566
 filename_lookup+0x256/0x610 fs/namei.c:2595
 vfs_statx+0x103/0x490 fs/stat.c:312
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888022fcb600: fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888022fcb680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888022fcb700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
                                                 ^
 ffff888022fcb780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888022fcb800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================