==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x578/0x9f0
Read of size 48 at addr ffff000133bddff0 by task syz-executor.1/31648

CPU: 0 PID: 31648 Comm: syz-executor.1 Not tainted 6.7.0-rc8-syzkaller-g0802e17d9aca #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0x174/0x514 mm/kasan/report.c:475
 kasan_report+0xd8/0x138 mm/kasan/report.c:588
 kasan_check_range+0x254/0x294 mm/kasan/generic.c:187
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 leaf_paste_in_buffer+0x578/0x9f0
 leaf_copy_dir_entries+0x2b4/0xa04 fs/reiserfs/lbalance.c:108
 leaf_copy_boundary_item+0x8c4/0x1a34 fs/reiserfs/lbalance.c:168
 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
 leaf_move_items+0xa0c/0x1f7c fs/reiserfs/lbalance.c:726
 leaf_shift_left+0xc8/0x39c fs/reiserfs/lbalance.c:750
 balance_leaf_insert_left fs/reiserfs/do_balan.c:339 [inline]
 balance_leaf_left fs/reiserfs/do_balan.c:611 [inline]
 balance_leaf+0x189c/0xe860 fs/reiserfs/do_balan.c:1409
 do_balance+0x27c/0x788 fs/reiserfs/do_balan.c:1888
 reiserfs_insert_item+0x940/0xa84 fs/reiserfs/stree.c:2260
 reiserfs_get_block+0x18c0/0x45d8 fs/reiserfs/inode.c:868
 __block_write_begin_int+0x3f0/0x1504 fs/buffer.c:2119
 __block_write_begin+0x7c/0xa0 fs/buffer.c:2168
 reiserfs_write_begin+0x328/0x71c fs/reiserfs/inode.c:2767
 generic_cont_expand_simple+0x160/0x258 fs/buffer.c:2473
 reiserfs_setattr+0x498/0xedc fs/reiserfs/inode.c:3298
 notify_change+0x9d4/0xc8c fs/attr.c:499
 do_truncate+0x1c0/0x28c fs/open.c:66
 do_sys_ftruncate+0x284/0x318 fs/open.c:194
 __do_sys_ftruncate fs/open.c:205 [inline]
 __se_sys_ftruncate fs/open.c:203 [inline]
 __arm64_sys_ftruncate+0x60/0x74 fs/open.c:203
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595

The buggy address belongs to the physical page:
page:00000000d87dc89a refcount:2 mapcount:0 mapping:000000004c314dee index:0x214 pfn:0x173bdd
memcg:ffff0000d4c50000
aops:def_blk_aops ino:700001
flags: 0x5ffc00000008124(referenced|lru|active|private|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000008124 fffffc0004c19508 fffffc0004abd688 ffff0000c1544210
raw: 0000000000000214 ffff00013a480570 00000002ffffffff ffff0000d4c50000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000133bddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff000133bddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff000133bde000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff000133bde080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000133bde100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 3937, free_space(entry_count) 2
REISERFS error (device loop1): vs-5150 search_by_key: invalid format found in block 531. Fsck?
REISERFS (device loop1): Remounting filesystem read-only
REISERFS error (device loop1): vs-13050 reiserfs_update_sd_size: i/o failure occurred trying to update [2 3 0x0 SD] stat data
REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 3937, free_space(entry_count) 2
REISERFS error (device loop1): vs-5150 search_by_key: invalid format found in block 531. Fsck?
REISERFS error (device loop1): vs-13050 reiserfs_update_sd_size: i/o failure occurred trying to update [2 3 0x0 SD] stat data
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 31648 Comm: syz-executor.1 Tainted: G    B              6.7.0-rc8-syzkaller-g0802e17d9aca #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 dump_stack+0x1c/0x28 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail_ex+0x3b0/0x50c lib/fault-inject.c:153
 should_fail+0x14/0x24 lib/fault-inject.c:163
 should_fail_usercopy+0x20/0x30 lib/fault-inject-usercopy.c:37
 _copy_to_user include/linux/uaccess.h:166 [inline]
 copy_to_user include/linux/uaccess.h:191 [inline]
 simple_read_from_buffer+0xd4/0x248 fs/libfs.c:1044
 proc_fail_nth_read+0x134/0x1a0 fs/proc/base.c:1423
 vfs_read+0x284/0x8a4 fs/read_write.c:468
 ksys_read+0x15c/0x26c fs/read_write.c:613
 __do_sys_read fs/read_write.c:623 [inline]
 __se_sys_read fs/read_write.c:621 [inline]
 __arm64_sys_read+0x7c/0x90 fs/read_write.c:621
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595