================================================================== BUG: KASAN: use-after-free in memcpy_from_iter lib/iov_iter.c:73 [inline] BUG: KASAN: use-after-free in iterate_bvec include/linux/iov_iter.h:122 [inline] BUG: KASAN: use-after-free in iterate_and_advance2 include/linux/iov_iter.h:249 [inline] BUG: KASAN: use-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KASAN: use-after-free in __copy_from_iter lib/iov_iter.c:268 [inline] BUG: KASAN: use-after-free in copy_page_from_iter_atomic+0x9b8/0x1e80 lib/iov_iter.c:500 Read of size 4096 at addr ffff88807ce3e000 by task kworker/u4:14/6785 CPU: 0 PID: 6785 Comm: kworker/u4:14 Not tainted 6.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: loop0 loop_workfn Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 memcpy_from_iter lib/iov_iter.c:73 [inline] iterate_bvec include/linux/iov_iter.h:122 [inline] iterate_and_advance2 include/linux/iov_iter.h:249 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] __copy_from_iter lib/iov_iter.c:268 [inline] copy_page_from_iter_atomic+0x9b8/0x1e80 lib/iov_iter.c:500 generic_perform_write+0x39a/0x640 mm/filemap.c:3938 shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2893 do_iter_readv_writev+0x46c/0x640 vfs_iter_write+0x244/0x5d0 fs/read_write.c:895 lo_write_bvec drivers/block/loop.c:246 [inline] lo_write_simple drivers/block/loop.c:267 [inline] do_req_filebacked drivers/block/loop.c:491 [inline] loop_handle_cmd drivers/block/loop.c:1909 [inline] loop_process_work+0x13a2/0x1e60 drivers/block/loop.c:1944 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 The buggy address belongs to the physical page: page:ffffea0001f38f80 refcount:1 mapcount:-512 mapping:0000000000000000 index:0x0 pfn:0x7ce3e memcg:ffff88807de39cc2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xfffffdff(table) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 ffff88807e3a9b40 00000001fffffdff ffff88807de39cc2 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x540dc0(GFP_USER|__GFP_COMP|__GFP_ZERO|__GFP_ACCOUNT), pid 5093, tgid 5093 (syz-executor.0), ts 1082268424348, free_ts 1082218069466 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x255/0x680 mm/page_alloc.c:4567 alloc_pages_mpol+0x3de/0x650 mm/mempolicy.c:2133 pagetable_alloc include/linux/mm.h:2842 [inline] __pte_alloc_one include/asm-generic/pgalloc.h:68 [inline] pte_alloc_one+0x88/0x5d0 arch/x86/mm/pgtable.c:33 __pte_alloc+0x79/0x3a0 mm/memory.c:440 copy_pte_range mm/memory.c:1048 [inline] copy_pmd_range mm/memory.c:1187 [inline] copy_pud_range mm/memory.c:1224 [inline] copy_p4d_range mm/memory.c:1248 [inline] copy_page_range+0x391d/0x4240 mm/memory.c:1346 dup_mmap kernel/fork.c:745 [inline] dup_mm kernel/fork.c:1685 [inline] copy_mm+0x12f4/0x21b0 kernel/fork.c:1734 copy_process+0x1d73/0x3fc0 kernel/fork.c:2497 kernel_clone+0x222/0x840 kernel/fork.c:2902 __do_sys_clone kernel/fork.c:3045 [inline] __se_sys_clone kernel/fork.c:3029 [inline] __x64_sys_clone+0x258/0x2a0 kernel/fork.c:3029 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 page last free pid 5093 tgid 5093 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 lbmLogShutdown fs/jfs/jfs_logmgr.c:1864 [inline] lmLogShutdown+0x4fc/0x970 fs/jfs/jfs_logmgr.c:1684 lmLogClose+0x297/0x530 fs/jfs/jfs_logmgr.c:1460 jfs_umount+0x2ce/0x3a0 fs/jfs/jfs_umount.c:114 jfs_put_super+0x8a/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x136/0x2d0 fs/super.c:646 kill_block_super+0x44/0x90 fs/super.c:1680 deactivate_locked_super+0xc4/0x130 fs/super.c:477 cleanup_mnt+0x426/0x4c0 fs/namespace.c:1267 task_work_run+0x24e/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:108 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0x167/0x370 kernel/entry/common.c:212 do_syscall_64+0x108/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6f/0x77 Memory state around the buggy address: ffff88807ce3df00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff88807ce3df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807ce3e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff88807ce3e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88807ce3e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================