================================================================== BUG: KASAN: use-after-free in leaf_paste_entries+0x508/0xae0 fs/reiserfs/lbalance.c:1362 Read of size 2 at addr ffff0000e0268008 by task syz.0.525/6876 CPU: 1 PID: 6876 Comm: syz.0.525 Not tainted 6.1.137-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x88/0x220 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:427 kasan_report+0xa8/0x100 mm/kasan/report.c:531 __asan_report_load_n_noabort+0x28/0x34 mm/kasan/report_generic.c:361 leaf_paste_entries+0x508/0xae0 fs/reiserfs/lbalance.c:1362 leaf_copy_dir_entries+0x4dc/0x788 fs/reiserfs/lbalance.c:119 leaf_copy_boundary_item+0x888/0x19dc fs/reiserfs/lbalance.c:-1 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0x694/0xb9c fs/reiserfs/lbalance.c:726 leaf_shift_left+0xc8/0x3ac fs/reiserfs/lbalance.c:750 balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline] balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline] balance_leaf+0x182c/0xd2f4 fs/reiserfs/do_balan.c:1393 do_balance+0x260/0x774 fs/reiserfs/do_balan.c:1888 reiserfs_delete_solid_item+0x710/0xc34 fs/reiserfs/stree.c:1462 remove_save_link+0x1cc/0x320 fs/reiserfs/super.c:540 reiserfs_truncate_file+0x69c/0xaf4 fs/reiserfs/inode.c:2322 reiserfs_vfs_truncate_file+0x34/0x4c fs/reiserfs/file.c:133 reiserfs_direct_IO+0x1e8/0x20c fs/reiserfs/inode.c:3258 generic_file_direct_write+0x31c/0x620 mm/filemap.c:3770 __generic_file_write_iter+0x1bc/0x37c mm/filemap.c:3930 generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:4006 do_iter_readv_writev fs/read_write.c:-1 [inline] do_iter_write+0x530/0x91c fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1c8/0x2fc fs/read_write.c:1031 __do_sys_pwritev2 fs/read_write.c:1090 [inline] __se_sys_pwritev2 fs/read_write.c:1081 [inline] __arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:0000000039a6ac77 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x1 pfn:0x120268 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffc0003eac408 fffffc0003e1d208 0000000000000000 raw: 0000000000000001 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000e0267f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000e0267f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000e0268000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000e0268080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000e0268100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Unable to handle kernel write to read-only memory at virtual address ffff0000dfdf6ff0 KASAN: maybe wild-memory-access in range [0xfffc0006fefb7f80-0xfffc0006fefb7f87] Mem abort info: ESR = 0x000000009600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001ac619000 [ffff0000dfdf6ff0] pgd=180000023fff8003, p4d=180000023fff8003, pud=180000023f414003, pmd=180000023f315003, pte=006000011fdf6787 Internal error: Oops: 000000009600004f [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 6876 Comm: syz.0.525 Tainted: G B 6.1.137-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x1e8/0x250 arch/arm64/lib/memcpy.S:221 lr : memmove+0x74/0x90 mm/kasan/shadow.c:58 sp : ffff800020f263c0 x29: ffff800020f263c0 x28: dfff800000000000 x27: 0000000000000082 x26: 0000000000000002 x25: 0000000000000020 x24: 0000000000000002 x23: ffff0000e026413e x22: ffff800008cad96c x21: ffff0000e03640ac x20: ffff0000e036408c x19: fffffffffff00092 x18: ffff800011a7bd00 x17: 1fffe000367c6d76 x16: ffff800008042940 x15: 0000000040000000 x14: 000000000000000e x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff0000dfdf7030 x4 : ffff0000dfdf6fd0 x3 : ffff800008cad96c x2 : ffffffffffa92f04 x1 : ffff0000e036408c x0 : ffff0000e03640ac Call trace: __memcpy+0x1e8/0x250 arch/arm64/lib/memcpy.S:220 leaf_paste_entries+0x684/0xae0 fs/reiserfs/lbalance.c:1377 leaf_copy_dir_entries+0x4dc/0x788 fs/reiserfs/lbalance.c:119 leaf_copy_boundary_item+0x888/0x19dc fs/reiserfs/lbalance.c:-1 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0x694/0xb9c fs/reiserfs/lbalance.c:726 leaf_shift_left+0xc8/0x3ac fs/reiserfs/lbalance.c:750 balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline] balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline] balance_leaf+0x182c/0xd2f4 fs/reiserfs/do_balan.c:1393 do_balance+0x260/0x774 fs/reiserfs/do_balan.c:1888 reiserfs_delete_solid_item+0x710/0xc34 fs/reiserfs/stree.c:1462 remove_save_link+0x1cc/0x320 fs/reiserfs/super.c:540 reiserfs_truncate_file+0x69c/0xaf4 fs/reiserfs/inode.c:2322 reiserfs_vfs_truncate_file+0x34/0x4c fs/reiserfs/file.c:133 reiserfs_direct_IO+0x1e8/0x20c fs/reiserfs/inode.c:3258 generic_file_direct_write+0x31c/0x620 mm/filemap.c:3770 __generic_file_write_iter+0x1bc/0x37c mm/filemap.c:3930 generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:4006 do_iter_readv_writev fs/read_write.c:-1 [inline] do_iter_write+0x530/0x91c fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1c8/0x2fc fs/read_write.c:1031 __do_sys_pwritev2 fs/read_write.c:1090 [inline] __se_sys_pwritev2 fs/read_write.c:1081 [inline] __arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: a93e24a8 a97e2488 a93d2caa a97d2c8a (a9bc34ac) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: a93e24a8 stp x8, x9, [x5, #-32] 4: a97e2488 ldp x8, x9, [x4, #-32] 8: a93d2caa stp x10, x11, [x5, #-48] c: a97d2c8a ldp x10, x11, [x4, #-48] * 10: a9bc34ac stp x12, x13, [x5, #-64]! <-- trapping instruction