REISERFS (device loop0): Using r5 hash to sort names REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. ================================================================== BUG: KASAN: out-of-bounds in leaf_insert_into_buf+0x1f4/0x748 fs/reiserfs/lbalance.c:933 Read of size 18446744073709551384 at addr ffff0000e041a000 by task syz-executor150/4218 CPU: 1 PID: 4218 Comm: syz-executor150 Not tainted 6.1.51-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:395 kasan_report+0xd4/0x130 mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memmove+0x48/0x90 mm/kasan/shadow.c:54 leaf_insert_into_buf+0x1f4/0x748 fs/reiserfs/lbalance.c:933 balance_leaf_new_nodes_insert fs/reiserfs/do_balan.c:1001 [inline] balance_leaf_new_nodes fs/reiserfs/do_balan.c:1243 [inline] balance_leaf+0x61f0/0xe860 fs/reiserfs/do_balan.c:1450 do_balance+0x27c/0x788 fs/reiserfs/do_balan.c:1888 reiserfs_insert_item+0x940/0xa84 fs/reiserfs/stree.c:2261 indirect2direct+0x58c/0xa40 fs/reiserfs/tail_conversion.c:283 maybe_indirect_to_direct fs/reiserfs/stree.c:1587 [inline] reiserfs_cut_from_item+0x854/0x1c98 fs/reiserfs/stree.c:1694 reiserfs_do_truncate+0x89c/0x11c8 fs/reiserfs/stree.c:1973 reiserfs_truncate_file+0x510/0xb1c fs/reiserfs/inode.c:2310 reiserfs_truncate_failed_write fs/reiserfs/inode.c:2743 [inline] reiserfs_write_end+0x640/0x800 fs/reiserfs/inode.c:2958 generic_perform_write+0x384/0x55c mm/filemap.c:3765 __generic_file_write_iter+0x168/0x388 mm/filemap.c:3882 generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:3914 call_write_iter include/linux/fs.h:2205 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x610/0x914 fs/read_write.c:584 ksys_write+0x15c/0x26c fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 The buggy address belongs to the physical page: page:0000000098bbccc5 refcount:1 mapcount:1 mapping:0000000000000000 index:0xffffffffd pfn:0x12041a memcg:ffff0000c0930000 anon flags: 0x5ffe000000a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffe000000a0014 fffffc0003804988 fffffc0003897ec8 ffff0000d7f51cc1 raw: 0000000ffffffffd 0000000000000000 0000000100000000 ffff0000c0930000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000e0419f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000e0419f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000e041a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff0000e041a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000e041a100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Unable to handle kernel paging request at virtual address dfff800000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000000] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4218 Comm: syz-executor150 Tainted: G B 6.1.51-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ma_dead_node lib/maple_tree.c:536 [inline] pc : mtree_range_walk+0x1a0/0x674 lib/maple_tree.c:2972 lr : ma_pivots lib/maple_tree.c:630 [inline] lr : mtree_range_walk+0x190/0x674 lib/maple_tree.c:2970 sp : ffff80001de159e0 x29: ffff80001de15a40 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000001 x25: 0000000000000000 x24: 0000000000000000 x23: ffffffffffffffff x22: 0000000000000000 x21: ffff80001de15b68 x20: 0000000000000000 x19: dfff800000000000 x18: 1fffe000368adf76 x17: 0000000000000000 x16: ffff8000084fa0fc x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000003 x12: ffff0000ca47b780 x11: ff808000120a3014 x10: 0000000000000000 x9 : ffff8000120a3014 x8 : ffff0000ca47b780 x7 : 0000000000000000 x6 : ffff8000120c92a4 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff8000181a0fe0 x0 : 0000000000000000 Call trace: ma_dead_node lib/maple_tree.c:535 [inline] mtree_range_walk+0x1a0/0x674 lib/maple_tree.c:2972 mas_state_walk lib/maple_tree.c:3900 [inline] mt_find+0x5a0/0xa88 lib/maple_tree.c:6534 find_vma+0x138/0x1c0 mm/mmap.c:1874 lock_mm_and_find_vma+0x74/0x2e8 mm/memory.c:5339 do_page_fault+0x2d0/0x890 arch/arm64/mm/fault.c:577 do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:803 el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 __memcpy+0x1e8/0x240 arch/arm64/lib/memcpy.S:220 0xffff80001de15fb0 Code: aa1f03f9 2a1f03f4 d343ff98 d50339bf (38736b08) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: aa1f03f9 mov x25, xzr 4: 2a1f03f4 mov w20, wzr 8: d343ff98 lsr x24, x28, #3 c: d50339bf dmb ishld * 10: 38736b08 ldrb w8, [x24, x19] <-- trapping instruction