bridge_slave_0: default FDB implementation only supports local addresses
==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x631/0xab0
Read of size 48 at addr ffff8880540e0ff0 by task syz-executor.4/8039

CPU: 1 PID: 8039 Comm: syz-executor.4 Not tainted 6.1.87-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15f/0x4f0 mm/kasan/report.c:395
 kasan_report+0x136/0x160 mm/kasan/report.c:495
 kasan_check_range+0x27f/0x290 mm/kasan/generic.c:189
 memcpy+0x25/0x60 mm/kasan/shadow.c:65
 leaf_paste_in_buffer+0x631/0xab0
 leaf_copy_dir_entries+0x71a/0xc60 fs/reiserfs/lbalance.c:108
 leaf_copy_boundary_item+0xbbe/0x21b0 fs/reiserfs/lbalance.c:168
 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
 leaf_move_items+0xcd0/0x28a0 fs/reiserfs/lbalance.c:726
 leaf_shift_left+0xba/0x430 fs/reiserfs/lbalance.c:750
 balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline]
 balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline]
 balance_leaf+0x228e/0x12510 fs/reiserfs/do_balan.c:1393
 do_balance+0x309/0x8f0 fs/reiserfs/do_balan.c:1888
 reiserfs_delete_item+0xc07/0x1030 fs/reiserfs/stree.c:1371
 direct2indirect+0xc3c/0x1830 fs/reiserfs/tail_conversion.c:139
 reiserfs_get_block+0x4c57/0x5150 fs/reiserfs/inode.c:949
 __block_write_begin_int+0x544/0x1a30 fs/buffer.c:1991
 __reiserfs_write_begin+0x21c/0x460 fs/reiserfs/inode.c:2835
 reiserfs_xattr_set_handle+0x3a0/0xdc0 fs/reiserfs/xattr.c:571
 reiserfs_xattr_set+0x44e/0x570 fs/reiserfs/xattr.c:633
 __vfs_setxattr+0x3e7/0x420 fs/xattr.c:182
 __vfs_setxattr_noperm+0x12a/0x5e0 fs/xattr.c:216
 vfs_setxattr+0x21d/0x420 fs/xattr.c:309
 do_setxattr fs/xattr.c:594 [inline]
 setxattr+0x250/0x2b0 fs/xattr.c:617
 path_setxattr+0x1bc/0x2a0 fs/xattr.c:636
 __do_sys_lsetxattr fs/xattr.c:659 [inline]
 __se_sys_lsetxattr fs/xattr.c:655 [inline]
 __x64_sys_lsetxattr+0xb4/0xd0 fs/xattr.c:655
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1dc487dea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1dc55ae0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007f1dc49abf80 RCX: 00007f1dc487dea9
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000020000100
RBP: 00007f1dc48ca4a4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000015 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f1dc49abf80 R15: 00007fff3474beb8
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001503800 refcount:3 mapcount:0 mapping:ffff88801288f5f8 index:0x216 pfn:0x540e0
memcg:ffff888076560000
aops:def_blk_aops ino:700004
flags: 0xfff8c000002042(referenced|workingset|private|node=0|zone=1|lastcpupid=0xfff)
raw: 00fff8c000002042 0000000000000000 dead000000000122 ffff88801288f5f8
raw: 0000000000000216 ffff88805df129f8 00000003ffffffff ffff888076560000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 8039, tgid 8037 (syz-executor.4), ts 236503599384, free_ts 236491018312
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
 prep_new_page mm/page_alloc.c:2520 [inline]
 get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5547
 folio_alloc+0x1a/0x50 mm/mempolicy.c:2292
 filemap_alloc_folio+0xda/0x4f0 mm/filemap.c:971
 __filemap_get_folio+0x749/0xe80 mm/filemap.c:1965
 pagecache_get_page+0x28/0x250 mm/folio-compat.c:110
 find_or_create_page include/linux/pagemap.h:646 [inline]
 grow_dev_page fs/buffer.c:946 [inline]
 grow_buffers fs/buffer.c:1011 [inline]
 __getblk_slow fs/buffer.c:1038 [inline]
 __getblk_gfp+0x211/0xa20 fs/buffer.c:1333
 sb_getblk include/linux/buffer_head.h:356 [inline]
 get_empty_nodes+0x8c1/0xd70 fs/reiserfs/fix_node.c:890
 fix_nodes+0x2615/0x8c70 fs/reiserfs/fix_node.c:2662
 reiserfs_insert_item+0xa7a/0xcb0 fs/reiserfs/stree.c:2240
 indirect2direct+0x695/0xc00 fs/reiserfs/tail_conversion.c:283
 maybe_indirect_to_direct fs/reiserfs/stree.c:1587 [inline]
 reiserfs_cut_from_item+0xba3/0x2580 fs/reiserfs/stree.c:1694
 reiserfs_do_truncate+0xa12/0x15b0 fs/reiserfs/stree.c:1973
 reiserfs_truncate_file+0x4d6/0x810 fs/reiserfs/inode.c:2310
 reiserfs_setattr+0xc57/0x11c0 fs/reiserfs/inode.c:3395
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1440 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3358
 free_unref_page_list+0x663/0x900 mm/page_alloc.c:3499
 release_pages+0x2836/0x2b40 mm/swap.c:1055
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261
 tlb_finish_mmu+0xce/0x1f0 mm/mmu_gather.c:361
 exit_mmap+0x3c3/0x9f0 mm/mmap.c:3239
 __mmput+0x115/0x3c0 kernel/fork.c:1199
 exit_mm+0x226/0x300 kernel/exit.c:563
 do_exit+0x9f6/0x26a0 kernel/exit.c:856
 do_group_exit+0x202/0x2b0 kernel/exit.c:1019
 get_signal+0x16f7/0x17d0 kernel/signal.c:2862
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87

Memory state around the buggy address:
 ffff8880540e0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880540e0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880540e1000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff8880540e1080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880540e1100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================