================================================================== BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] BUG: KASAN: use-after-free in buffer_locked include/linux/buffer_head.h:119 [inline] BUG: KASAN: use-after-free in wait_on_buffer include/linux/buffer_head.h:346 [inline] BUG: KASAN: use-after-free in jbd2_log_do_checkpoint+0xe1a/0xed0 fs/jbd2/checkpoint.c:341 Read of size 8 at addr ffff88019acc4b28 by task syz-executor3/30065 CPU: 0 PID: 30065 Comm: syz-executor3 Not tainted 4.9.130+ #46 ffff8801a2fd7790 ffffffff81b36c89 ffffea00066b3100 ffff88019acc4b28 0000000000000000 ffff88019acc4b28 ffff8801cb488300 ffff8801a2fd77c8 ffffffff8150080d ffff88019acc4b28 0000000000000008 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [] kasan_report_error mm/kasan/report.c:355 [inline] [] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] [] buffer_locked include/linux/buffer_head.h:119 [inline] [] wait_on_buffer include/linux/buffer_head.h:346 [inline] [] jbd2_log_do_checkpoint+0xe1a/0xed0 fs/jbd2/checkpoint.c:341 [] jbd2_journal_flush+0x156/0x4f0 fs/jbd2/journal.c:1974 [] ext4_change_inode_journal_flag+0x20b/0x3b0 fs/ext4/inode.c:5714 [] ext4_ioctl_setflags+0x521/0x5d0 fs/ext4/ioctl.c:286 [] ext4_ioctl+0xe44/0x3620 fs/ext4/ioctl.c:465 [] vfs_ioctl fs/ioctl.c:43 [inline] [] file_ioctl fs/ioctl.c:493 [inline] [] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677 [] SYSC_ioctl fs/ioctl.c:694 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 30060: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:505 [inline] set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547 slab_post_alloc_hook mm/slab.h:417 [inline] slab_alloc_node mm/slub.c:2715 [inline] slab_alloc mm/slub.c:2723 [inline] kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728 kmem_cache_zalloc include/linux/slab.h:626 [inline] alloc_buffer_head+0x22/0xd0 fs/buffer.c:3383 alloc_page_buffers+0xb7/0x200 fs/buffer.c:875 create_empty_buffers+0x39/0x470 fs/buffer.c:1582 create_page_buffers+0x154/0x1c0 fs/buffer.c:1657 __block_write_begin_int+0x1b1/0x1020 fs/buffer.c:1966 __block_write_begin+0x30/0x40 fs/buffer.c:2038 ext4_write_begin+0x4ac/0x1400 fs/ext4/inode.c:1259 generic_perform_write+0x28a/0x500 mm/filemap.c:2753 __generic_file_write_iter+0x352/0x540 mm/filemap.c:2878 ext4_file_write_iter+0x63d/0xd70 fs/ext4/file.c:165 aio_write+0x2f2/0x510 fs/aio.c:1505 io_submit_one fs/aio.c:1586 [inline] do_io_submit+0xd35/0x1080 fs/aio.c:1654 SYSC_io_submit fs/aio.c:1679 [inline] SyS_io_submit+0x27/0x30 fs/aio.c:1676 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 30068: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:505 [inline] set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kmem_cache_free+0xbe/0x310 mm/slub.c:2980 free_buffer_head+0x47/0xb0 fs/buffer.c:3398 try_to_free_buffers+0x1aa/0x290 fs/buffer.c:3313 jbd2_journal_invalidatepage+0x717/0x970 fs/jbd2/transaction.c:2319 __ext4_journalled_invalidatepage+0x155/0x410 fs/ext4/inode.c:3283 ext4_journalled_invalidatepage+0x25/0x50 fs/ext4/inode.c:3291 do_invalidatepage mm/truncate.c:99 [inline] truncate_complete_page mm/truncate.c:119 [inline] truncate_inode_page+0x125/0x260 mm/truncate.c:167 truncate_inode_pages_range+0x2be/0x1060 mm/truncate.c:291 truncate_inode_pages mm/truncate.c:401 [inline] truncate_pagecache+0x66/0x90 mm/truncate.c:706 ext4_setattr+0x14ef/0x2170 fs/ext4/inode.c:5301 notify_change2+0xad7/0xe00 fs/attr.c:313 do_truncate2+0x13d/0x1f0 fs/open.c:63 handle_truncate fs/namei.c:2990 [inline] do_last fs/namei.c:3419 [inline] path_openat+0xb86/0x2790 fs/namei.c:3534 do_filp_open+0x197/0x270 fs/namei.c:3568 do_sys_open+0x30d/0x5c0 fs/open.c:1072 SYSC_open fs/open.c:1090 [inline] SyS_open fs/open.c:1085 [inline] SYSC_creat fs/open.c:1110 [inline] SyS_creat+0x27/0x30 fs/open.c:1108 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 entry_SYSCALL_64_after_swapgs+0x5d/0xdb The buggy address belongs to the object at ffff88019acc4b28 which belongs to the cache buffer_head of size 104 The buggy address is located 0 bytes inside of 104-byte region [ffff88019acc4b28, ffff88019acc4b90) The buggy address belongs to the page: page:ffffea00066b3100 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000080(slab) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88019acc4a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88019acc4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc >ffff88019acc4b00: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb ^ ffff88019acc4b80: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb ffff88019acc4c00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fb ==================================================================