==================================================================
BUG: KASAN: use-after-free in F2FS_SB fs/f2fs/f2fs.h:1985 [inline]
BUG: KASAN: use-after-free in F2FS_I_SB fs/f2fs/f2fs.h:1990 [inline]
BUG: KASAN: use-after-free in F2FS_M_SB fs/f2fs/f2fs.h:1995 [inline]
BUG: KASAN: use-after-free in F2FS_P_SB fs/f2fs/f2fs.h:2000 [inline]
BUG: KASAN: use-after-free in f2fs_release_page+0x2fa/0x890 fs/f2fs/data.c:3600
Read of size 8 at addr ffff888112a6a3c8 by task syz-executor.2/31902
CPU: 1 PID: 31902 Comm: syz-executor.2 Tainted: G W 5.15.98-syzkaller-00348-g7364b7abbafb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
F2FS_SB fs/f2fs/f2fs.h:1985 [inline]
F2FS_I_SB fs/f2fs/f2fs.h:1990 [inline]
F2FS_M_SB fs/f2fs/f2fs.h:1995 [inline]
F2FS_P_SB fs/f2fs/f2fs.h:2000 [inline]
f2fs_release_page+0x2fa/0x890 fs/f2fs/data.c:3600
try_to_release_page+0x194/0x1f0 mm/filemap.c:4025
shrink_page_list+0x1f22/0x5820 mm/vmscan.c:1754
shrink_inactive_list mm/vmscan.c:2261 [inline]
shrink_list mm/vmscan.c:2506 [inline]
shrink_lruvec+0x17e9/0x4340 mm/vmscan.c:5694
shrink_node_memcgs mm/vmscan.c:5886 [inline]
shrink_node+0x1077/0x24e0 mm/vmscan.c:5916
shrink_zones mm/vmscan.c:6119 [inline]
do_try_to_free_pages+0x5b6/0x1570 mm/vmscan.c:6177
try_to_free_mem_cgroup_pages+0x36c/0x850 mm/vmscan.c:6491
memory_max_write+0x265/0x470 mm/memcontrol.c:6427
cgroup_file_write+0x290/0x590 kernel/cgroup/cgroup.c:3943
kernfs_fop_write_iter+0x2c4/0x410 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2157 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0xd8a/0x1160 fs/read_write.c:594
ksys_write+0x199/0x2c0 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:656
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f69c99d6169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69c8707168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f69c9af6120 RCX: 00007f69c99d6169
RDX: 0000000000000012 RSI: 0000000020000140 RDI: 000000000000000a
RBP: 00007f69c9a31ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef5bccbf R14: 00007f69c8707300 R15: 0000000000022000
Allocated by task 31860:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:227 [inline]
__kmalloc+0x13a/0x270 mm/slub.c:4425
kmalloc include/linux/slab.h:613 [inline]
sk_prot_alloc+0xf9/0x330 net/core/sock.c:1843
sk_alloc+0x38/0x430 net/core/sock.c:1900
__netlink_create net/netlink/af_netlink.c:647 [inline]
__netlink_kernel_create+0x1c4/0x910 net/netlink/af_netlink.c:2077
netlink_kernel_create include/linux/netlink.h:62 [inline]
genl_pernet_init+0xa1/0x150 net/netlink/genetlink.c:1399
ops_init+0x1cf/0x4a0 net/core/net_namespace.c:135
setup_net+0x34b/0xb50 net/core/net_namespace.c:329
copy_net_ns+0x381/0x5f0 net/core/net_namespace.c:473
create_new_namespaces+0x416/0x670 kernel/nsproxy.c:110
copy_namespaces+0x1d1/0x220 kernel/nsproxy.c:178
copy_process+0x12e7/0x3260 kernel/fork.c:2259
kernel_clone+0x21e/0x9e0 kernel/fork.c:2659
__do_sys_clone3 kernel/fork.c:2943 [inline]
__se_sys_clone3 kernel/fork.c:2927 [inline]
__x64_sys_clone3+0x376/0x3a0 kernel/fork.c:2927
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
__call_rcu kernel/rcu/tree.c:2993 [inline]
call_rcu+0x133/0x12a0 kernel/rcu/tree.c:3073
netlink_release+0x12df/0x16f0 net/netlink/af_netlink.c:819
__sock_release net/socket.c:649 [inline]
sock_release+0x7e/0x140 net/socket.c:677
netlink_kernel_release+0x4d/0x60 net/netlink/af_netlink.c:2139
genl_pernet_exit+0x40/0x60 net/netlink/genetlink.c:1412
ops_exit_list net/core/net_namespace.c:169 [inline]
cleanup_net+0x64b/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 :298
Second to last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
__call_rcu kernel/rcu/tree.c:2993 [inline]
call_rcu+0x133/0x12a0 kernel/rcu/tree.c:3073
netlink_release+0x12df/0x16f0 net/netlink/af_netlink.c:819
__sock_release net/socket.c:649 [inline]
sock_release+0x7e/0x140 net/socket.c:677
netlink_kernel_release+0x4d/0x60 net/netlink/af_netlink.c:2139
nl_fib_lookup_exit net/ipv4/fib_frontend.c:1404 [inline]
fib_net_exit+0x4b/0x80 net/ipv4/fib_frontend.c:1615
ops_exit_list net/core/net_namespace.c:169 [inline]
cleanup_net+0x64b/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 :298
The buggy address belongs to the object at ffff888112a6a000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 968 bytes inside of
2048-byte region [ffff888112a6a000, ffff888112a6a800)
The buggy address belongs to the page:
page:ffffea00044a9a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888112a6a000 pfn:0x112a68
head:ffffea00044a9a00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 ffffea00054d2408 ffffea00045a9008 ffff888100043200
raw: ffff888112a6a000 0000000000080006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10, ts 218832833145, free_ts 215271349085
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2502
prep_new_page mm/page_alloc.c:2508 [inline]
get_page_from_freelist+0x2c14/0x2cf0 mm/page_alloc.c:4291
__alloc_pages+0x386/0x7b0 mm/page_alloc.c:5569
allocate_slab mm/slub.c:1930 [inline]
new_slab+0x92/0x490 mm/slub.c:1993
___slab_alloc+0x39e/0x830 mm/slub.c:3026
__slab_alloc+0x4a/0x90 mm/slub.c:3113
slab_alloc_node mm/slub.c:3204 [inline]
slab_alloc mm/slub.c:3246 [inline]
__kmalloc_track_caller+0x16c/0x260 mm/slub.c:4943
kmalloc_reserve net/core/skbuff.c:357 [inline]
__alloc_skb+0x10c/0x550 net/core/skbuff.c:428
alloc_skb include/linux/skbuff.h:1182 [inline]
nlmsg_new include/net/netlink.h:953 [inline]
rtmsg_ifinfo_build_skb+0x7f/0x180 net/core/rtnetlink.c:3824
unregister_netdevice_many+0xea2/0x17c0 net/core/dev.c:11082
ip6gre_exit_batch_net+0x5b2/0x600 net/ipv6/ip6_gre.c:1643
ops_exit_list net/core/net_namespace.c:174 [inline]
cleanup_net+0x6ce/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 :298
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1370 [inline]
free_pcp_prepare mm/page_alloc.c:1442 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3441
free_unref_page+0xac/0x2c0 mm/page_alloc.c:3521
free_the_page mm/page_alloc.c:711 [inline]
free_compound_page+0x78/0xa0 mm/page_alloc.c:734
destroy_compound_page include/linux/mm.h:989 [inline]
__put_compound_page+0x73/0xb0 mm/swap.c:111
__put_page+0xbf/0xe0 mm/swap.c:127
put_page include/linux/mm.h:1295 [inline]
__skb_frag_unref include/linux/skbuff.h:3234 [inline]
skb_release_data+0x405/0xa80 net/core/skbuff.c:673
skb_release_all net/core/skbuff.c:743 [inline]
__kfree_skb+0x50/0x70 net/core/skbuff.c:757
sk_wmem_free_skb+0x12a/0x660 include/net/sock.h:1619
tcp_write_queue_purge+0x145/0x430 net/ipv4/tcp.c:2950
tcp_v4_destroy_sock+0x10b/0x360 net/ipv4/tcp_ipv4.c:2282
inet_csk_destroy_sock+0x160/0x370 net/ipv4/inet_connection_sock.c:1015
__tcp_close+0xb7f/0xfd0 net/ipv4/tcp.c:2899
tcp_close+0x29/0xa0 net/ipv4/tcp.c:2911
inet_release+0x184/0x200 net/ipv4/af_inet.c:431
__sock_release net/socket.c:649 [inline]
sock_close+0xdf/0x270 net/socket.c:1317
__fput+0x3fe/0x910 fs/file_table.c:280
Memory state around the buggy address:
ffff888112a6a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112a6a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888112a6a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888112a6a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112a6a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
general protection fault, probably for non-canonical address 0xdffffc00000000d0: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000680-0x0000000000000687]
CPU: 1 PID: 31902 Comm: syz-executor.2 Tainted: G B W 5.15.98-syzkaller-00348-g7364b7abbafb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
RIP: 0010:f2fs_release_page+0x309/0x890 fs/f2fs/data.c:3600
Code: 00 00 4c 03 3b 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 26 7d 91 ff bb 80 06 00 00 49 03 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 3f 05 00 00 44 8b 3b bb 00 00 00 40 be
RSP: 0018:ffffc90001516c20 EFLAGS: 00010202
RAX: 00000000000000d0 RBX: 0000000000000680 RCX: 0000000000040000
RDX: ffffc9000471a000 RSI: 0000000000000286 RDI: 00000000000319f5
RBP: ffffc90001516c68 R08: ffffffff8141d09b R09: 0000000000000003
R10: fffffbfff0e0fe4c R11: dffffc0000000001 R12: ffffea0004433440
R13: 4000000000002005 R14: dffffc0000000000 R15: ffff888112a6a3c8
FS: 00007f69c8707700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f69c8707718 CR3: 000000010f230000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
try_to_release_page+0x194/0x1f0 mm/filemap.c:4025
shrink_page_list+0x1f22/0x5820 mm/vmscan.c:1754
shrink_inactive_list mm/vmscan.c:2261 [inline]
shrink_list mm/vmscan.c:2506 [inline]
shrink_lruvec+0x17e9/0x4340 mm/vmscan.c:5694
shrink_node_memcgs mm/vmscan.c:5886 [inline]
shrink_node+0x1077/0x24e0 mm/vmscan.c:5916
shrink_zones mm/vmscan.c:6119 [inline]
do_try_to_free_pages+0x5b6/0x1570 mm/vmscan.c:6177
try_to_free_mem_cgroup_pages+0x36c/0x850 mm/vmscan.c:6491
memory_max_write+0x265/0x470 mm/memcontrol.c:6427
cgroup_file_write+0x290/0x590 kernel/cgroup/cgroup.c:3943
kernfs_fop_write_iter+0x2c4/0x410 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2157 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0xd8a/0x1160 fs/read_write.c:594
ksys_write+0x199/0x2c0 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:656
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f69c99d6169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69c8707168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f69c9af6120 RCX: 00007f69c99d6169
RDX: 0000000000000012 RSI: 0000000020000140 RDI: 000000000000000a
RBP: 00007f69c9a31ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffef5bccbf R14: 00007f69c8707300 R15: 0000000000022000
Modules linked in:
---[ end trace 2f34a1aea2014df1 ]---
RIP: 0010:f2fs_release_page+0x309/0x890 fs/f2fs/data.c:3600
Code: 00 00 4c 03 3b 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 26 7d 91 ff bb 80 06 00 00 49 03 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 3f 05 00 00 44 8b 3b bb 00 00 00 40 be
RSP: 0018:ffffc90001516c20 EFLAGS: 00010202
RAX: 00000000000000d0 RBX: 0000000000000680 RCX: 0000000000040000
RDX: ffffc9000471a000 RSI: 0000000000000286 RDI: 00000000000319f5
RBP: ffffc90001516c68 R08: ffffffff8141d09b R09: 0000000000000003
R10: fffffbfff0e0fe4c R11: dffffc0000000001 R12: ffffea0004433440
R13: 4000000000002005 R14: dffffc0000000000 R15: ffff888112a6a3c8
FS: 00007f69c8707700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f69c8707718 CR3: 000000010f230000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 4c 03 3b add (%rbx),%r15
5: 4c 89 f8 mov %r15,%rax
8: 48 c1 e8 03 shr $0x3,%rax
c: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
11: 74 08 je 0x1b
13: 4c 89 ff mov %r15,%rdi
16: e8 26 7d 91 ff callq 0xff917d41
1b: bb 80 06 00 00 mov $0x680,%ebx
20: 49 03 1f add (%r15),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 3f 05 00 00 jne 0x576
37: 44 8b 3b mov (%rbx),%r15d
3a: bb 00 00 00 40 mov $0x40000000,%ebx
3f: be .byte 0xbe