================================================================== BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x578/0x9f0 Read of size 48 at addr ffff000139ae1ff0 by task syz-executor.0/18841 CPU: 0 PID: 18841 Comm: syz-executor.0 Not tainted 6.4.0-rc7-syzkaller-ge40939bbfc68 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0x174/0x514 mm/kasan/report.c:462 kasan_report+0xd4/0x130 mm/kasan/report.c:572 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105 leaf_paste_in_buffer+0x578/0x9f0 leaf_copy_dir_entries+0x2b4/0xa04 fs/reiserfs/lbalance.c:108 leaf_copy_boundary_item+0x8c4/0x1a34 fs/reiserfs/lbalance.c:168 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0xa0c/0x1f7c fs/reiserfs/lbalance.c:726 leaf_shift_left+0xc8/0x39c fs/reiserfs/lbalance.c:750 balance_leaf_insert_left fs/reiserfs/do_balan.c:339 [inline] balance_leaf_left fs/reiserfs/do_balan.c:611 [inline] balance_leaf+0x189c/0xe860 fs/reiserfs/do_balan.c:1409 do_balance+0x27c/0x788 fs/reiserfs/do_balan.c:1888 reiserfs_insert_item+0x940/0xa84 fs/reiserfs/stree.c:2259 direct2indirect+0x5b8/0x10f8 fs/reiserfs/tail_conversion.c:84 reiserfs_get_block+0x40c4/0x45d8 fs/reiserfs/inode.c:949 __block_write_begin_int+0x460/0x1790 fs/buffer.c:2064 __block_write_begin+0x7c/0xa0 fs/buffer.c:2114 reiserfs_write_begin+0x328/0x71c fs/reiserfs/inode.c:2773 generic_perform_write+0x278/0x55c mm/filemap.c:3929 __generic_file_write_iter+0x168/0x388 mm/filemap.c:4057 generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:4089 do_iter_write+0x65c/0xa80 fs/read_write.c:860 vfs_writev fs/read_write.c:933 [inline] do_pwritev+0x1ec/0x334 fs/read_write.c:1030 __do_sys_pwritev fs/read_write.c:1077 [inline] __se_sys_pwritev fs/read_write.c:1072 [inline] __arm64_sys_pwritev+0xa0/0xb8 fs/read_write.c:1072 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 The buggy address belongs to the physical page: page:00000000f52c597f refcount:2 mapcount:0 mapping:00000000fb5948fa index:0x214 pfn:0x179ae1 memcg:ffff00012ab78000 aops:def_blk_aops ino:700000 flags: 0x5ffc00000002032(referenced|lru|active|private|node=0|zone=2|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 05ffc00000002032 fffffc00043aa688 fffffc0004e61688 ffff0000c1543f00 raw: 0000000000000214 ffff0001362aa740 00000002ffffffff ffff00012ab78000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000139ae1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff000139ae1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff000139ae2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000139ae2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000139ae2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 4106497 0(1) DIR], item_len 35, item_location 3937, free_space(entry_count) 2 REISERFS error (device loop0): vs-5150 search_by_key: invalid format found in block 531. Fsck? REISERFS (device loop0): Remounting filesystem read-only Unable to handle kernel paging request at virtual address dfff800000000005 KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000005] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 18841 Comm: syz-executor.0 Tainted: G B 6.4.0-rc7-syzkaller-ge40939bbfc68 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : reiserfs_node_data fs/reiserfs/reiserfs.h:2184 [inline] pc : item_head fs/reiserfs/reiserfs.h:2200 [inline] pc : tp_item_head fs/reiserfs/reiserfs.h:2226 [inline] pc : direct2indirect+0x6c4/0x10f8 fs/reiserfs/tail_conversion.c:119 lr : tp_item_head fs/reiserfs/reiserfs.h:2226 [inline] lr : direct2indirect+0x684/0x10f8 fs/reiserfs/tail_conversion.c:119 sp : ffff800097d56cc0 x29: ffff800097d56e00 x28: 0000000000000000 x27: 0000000000000028 x26: ffff0001362ab750 x25: ffff800097d56d40 x24: ffff800097d572f8 x23: dfff800000000000 x22: 0000000100000fff x21: ffff800097d572f0 x20: ffff800097d57310 x19: 0000000000000000 x18: 1fffe00036842bc6 x17: ffff80008deed000 x16: ffff80008a4483a0 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000002 x12: 00000000fffffffe x11: 0000000000040000 x10: 000000000003ffff x9 : ffff800098d99000 x8 : 0000000000000005 x7 : 1fffe00036842bc7 x6 : ffff80008028cc04 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800080b5d384 x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000008 Call trace: reiserfs_node_data fs/reiserfs/reiserfs.h:2184 [inline] item_head fs/reiserfs/reiserfs.h:2200 [inline] tp_item_head fs/reiserfs/reiserfs.h:2226 [inline] direct2indirect+0x6c4/0x10f8 fs/reiserfs/tail_conversion.c:119 reiserfs_get_block+0x40c4/0x45d8 fs/reiserfs/inode.c:949 __block_write_begin_int+0x460/0x1790 fs/buffer.c:2064 __block_write_begin+0x7c/0xa0 fs/buffer.c:2114 reiserfs_write_begin+0x328/0x71c fs/reiserfs/inode.c:2773 generic_perform_write+0x278/0x55c mm/filemap.c:3929 __generic_file_write_iter+0x168/0x388 mm/filemap.c:4057 generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:4089 do_iter_write+0x65c/0xa80 fs/read_write.c:860 vfs_writev fs/read_write.c:933 [inline] do_pwritev+0x1ec/0x334 fs/read_write.c:1030 __do_sys_pwritev fs/read_write.c:1077 [inline] __se_sys_pwritev fs/read_write.c:1072 [inline] __arm64_sys_pwritev+0xa0/0xb8 fs/read_write.c:1072 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: 350011e8 9100a27b b9800293 d343ff68 (38776908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 350011e8 cbnz w8, 0x23c 4: 9100a27b add x27, x19, #0x28 8: b9800293 ldrsw x19, [x20] c: d343ff68 lsr x8, x27, #3 * 10: 38776908 ldrb w8, [x8, x23] <-- trapping instruction