================================================================== BUG: KASAN: slab-out-of-bounds in mpol_parse_str+0x6bc/0x8f0 mm/mempolicy.c:2868 Write of size 1 at addr ffff8880a09727bf by task syz-executor.2/9408 CPU: 0 PID: 9408 Comm: syz-executor.2 Not tainted 5.3.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x318 mm/kasan/report.c:351 __kasan_report.cold.9+0x1b/0x3f mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:612 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:134 mpol_parse_str+0x6bc/0x8f0 mm/mempolicy.c:2868 shmem_parse_one mm/shmem.c:3472 [inline] shmem_parse_options+0x5a2/0xa40 mm/shmem.c:3520 shmem_fill_super+0x7f6/0xa60 mm/shmem.c:3652 mount_nodev+0x48/0xe0 fs/super.c:1454 shmem_mount+0x13/0x20 mm/shmem.c:3847 legacy_get_tree+0x101/0x1f0 fs/fs_context.c:659 vfs_get_tree+0x86/0x350 fs/super.c:1538 do_new_mount fs/namespace.c:2791 [inline] do_mount+0x10fa/0x1b60 fs/namespace.c:3111 ksys_mount+0xba/0xe0 fs/namespace.c:3320 __do_sys_mount fs/namespace.c:3334 [inline] __se_sys_mount fs/namespace.c:3331 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3331 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45d99a Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 2a 8c fb ff c3 66 0f 1f 84 00 00 00 00 00 RSP: 002b:00007f3ef2a86a68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000045d99a RDX: 00007f3ef2a86ae0 RSI: 00000000200000c0 RDI: 00007f3ef2a86b00 RBP: 000000000075bf20 R08: 00007f3ef2a86b40 R09: 00007f3ef2a86ae0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3ef2a876d4 R13: 00000000004cbf00 R14: 00000000004e6ba8 R15: 00000000ffffffff Allocated by task 0: (stack is not available) Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880a0972780 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 31 bytes to the right of 32-byte region [ffff8880a0972780, ffff8880a09727a0) The buggy address belongs to the page: page:ffffea0002825c80 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a0972fc1 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002822e88 ffff8880aa401248 ffff8880aa4001c0 raw: ffff8880a0972fc1 ffff8880a0972000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a0972680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a0972700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a0972780: fc fc fc fc fc fc fc fc 00 05 fc fc fc fc fc fc ^ ffff8880a0972800: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc ffff8880a0972880: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc ==================================================================