==================================================================
BUG: KASAN: stack-out-of-bounds in gfs2_dump_glock+0x18b1/0x1c80 fs/gfs2/glock.c:2406
Read of size 8 at addr ffffc90004207d30 by task syz.3.1261/10192
CPU: 1 UID: 0 PID: 10192 Comm: syz.3.1261 Not tainted 6.13.0-rc2-syzkaller-00130-g150b567e0d57 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:489
kasan_report+0xd9/0x110 mm/kasan/report.c:602
gfs2_dump_glock+0x18b1/0x1c80 fs/gfs2/glock.c:2406
gfs2_consist_inode_i+0x104/0x150 fs/gfs2/util.c:457
gfs2_dirent_scan+0x352/0x400 fs/gfs2/dir.c:589
gfs2_dirent_search+0x459/0x5c0 fs/gfs2/dir.c:853
gfs2_dir_search+0x98/0x2e0 fs/gfs2/dir.c:1653
gfs2_lookupi+0x4b9/0x6f0 fs/gfs2/inode.c:340
__gfs2_lookup+0xa1/0x290 fs/gfs2/inode.c:897
gfs2_atomic_open+0xdd/0x240 fs/gfs2/inode.c:1298
atomic_open fs/namei.c:3509 [inline]
lookup_open.isra.0+0xca2/0x14c0 fs/namei.c:3620
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_open fs/open.c:1425 [inline]
__se_sys_open fs/open.c:1421 [inline]
__x64_sys_open+0x154/0x1e0 fs/open.c:1421
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f60d8f85d19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f60d9e60038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f60d9176080 RCX: 00007f60d8f85d19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100
RBP: 00007f60d9001a20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f60d9176080 R15: 00007ffd60055208
The buggy address belongs to the virtual mapping at
[ffffc90004200000, ffffc90004209000) created by:
kernel_clone+0xfd/0x960 kernel/fork.c:2807
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888033c76e88 pfn:0x33c76
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888033c76e88 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 10151, tgid 10151 (syz.3.1261), ts 307373846211, free_ts 306186208002
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474
__alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
vm_area_alloc_pages mm/vmalloc.c:3589 [inline]
__vmalloc_area_node mm/vmalloc.c:3667 [inline]
__vmalloc_node_range_noprof+0x724/0x1530 mm/vmalloc.c:3844
alloc_thread_stack_node kernel/fork.c:314 [inline]
dup_task_struct kernel/fork.c:1121 [inline]
copy_process+0x2f07/0x8df0 kernel/fork.c:2225
kernel_clone+0xfd/0x960 kernel/fork.c:2807
__do_sys_clone3+0x1f9/0x270 kernel/fork.c:3111
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10122 tgid 10122 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_folios+0xa7b/0x14f0 mm/page_alloc.c:2704
folios_put_refs+0x587/0x7b0 mm/swap.c:962
free_pages_and_swap_cache+0x45f/0x510 mm/swap_state.c:335
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu mm/mmu_gather.c:373 [inline]
tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465
exit_mmap+0x3df/0xb20 mm/mmap.c:1681
__mmput+0x12a/0x4c0 kernel/fork.c:1353
mmput+0x62/0x70 kernel/fork.c:1375
exit_mm kernel/exit.c:570 [inline]
do_exit+0x9bf/0x2d70 kernel/exit.c:925
do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
__do_sys_exit_group kernel/exit.c:1098 [inline]
__se_sys_exit_group kernel/exit.c:1096 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096
x64_sys_call+0x151f/0x1720 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffffc90004207c00: 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00
ffffc90004207c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004207d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
^
ffffc90004207d80: f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffffc90004207e00: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00
==================================================================
Oops: general protection fault, probably for non-canonical address 0xe6a7492406c406a0: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x353a692036203500-0x353a692036203507]
CPU: 0 UID: 0 PID: 10192 Comm: syz.3.1261 Tainted: G B 6.13.0-rc2-syzkaller-00130-g150b567e0d57 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:pid_nr include/linux/pid.h:179 [inline]
RIP: 0010:dump_holder fs/gfs2/glock.c:2295 [inline]
RIP: 0010:gfs2_dump_glock+0x124d/0x1c80 fs/gfs2/glock.c:2407
Code: 85 8e 06 00 00 49 8b 6c 24 18 48 c7 04 24 00 00 00 00 48 85 ed 74 2f e8 b1 a5 c8 fd 48 8d bd e0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 74 08 3c 03 0f 8e 62 07 00 00 48 63 85 e0 00
RSP: 0018:ffffc90003ccf1d8 EFLAGS: 00010216
RAX: 06a74d2406c406a0 RBX: ffffffff8d7aec80 RCX: ffffc9000f4fc000
RDX: 0000000000080000 RSI: ffffffff83d15d3f RDI: 353a692036203500
RBP: 353a692036203420 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 6e696c6261736944 R12: ffffffff8d7aec60
R13: ffffc90003ccf2c8 R14: ffffffff8d7aec82 R15: dffffc0000000000
FS: 00007f60d9e606c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b304f6ff8 CR3: 000000002ee4a000 CR4: 0000000000350ef0
Call Trace:
gfs2_consist_inode_i+0x104/0x150 fs/gfs2/util.c:457
gfs2_dirent_scan+0x352/0x400 fs/gfs2/dir.c:589
gfs2_dirent_search+0x459/0x5c0 fs/gfs2/dir.c:853
gfs2_dir_search+0x98/0x2e0 fs/gfs2/dir.c:1653
gfs2_lookupi+0x4b9/0x6f0 fs/gfs2/inode.c:340
__gfs2_lookup+0xa1/0x290 fs/gfs2/inode.c:897
gfs2_atomic_open+0xdd/0x240 fs/gfs2/inode.c:1298
atomic_open fs/namei.c:3509 [inline]
lookup_open.isra.0+0xca2/0x14c0 fs/namei.c:3620
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x904/0x2d60 fs/namei.c:3984
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_open fs/open.c:1425 [inline]
__se_sys_open fs/open.c:1421 [inline]
__x64_sys_open+0x154/0x1e0 fs/open.c:1421
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f60d8f85d19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f60d9e60038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f60d9176080 RCX: 00007f60d8f85d19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100
RBP: 00007f60d9001a20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f60d9176080 R15: 00007ffd60055208
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pid_nr include/linux/pid.h:179 [inline]
RIP: 0010:dump_holder fs/gfs2/glock.c:2295 [inline]
RIP: 0010:gfs2_dump_glock+0x124d/0x1c80 fs/gfs2/glock.c:2407
Code: 85 8e 06 00 00 49 8b 6c 24 18 48 c7 04 24 00 00 00 00 48 85 ed 74 2f e8 b1 a5 c8 fd 48 8d bd e0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 74 08 3c 03 0f 8e 62 07 00 00 48 63 85 e0 00
RSP: 0018:ffffc90003ccf1d8 EFLAGS: 00010216
RAX: 06a74d2406c406a0 RBX: ffffffff8d7aec80 RCX: ffffc9000f4fc000
RDX: 0000000000080000 RSI: ffffffff83d15d3f RDI: 353a692036203500
RBP: 353a692036203420 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 6e696c6261736944 R12: ffffffff8d7aec60
R13: ffffc90003ccf2c8 R14: ffffffff8d7aec82 R15: dffffc0000000000
FS: 00007f60d9e606c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33118ff8 CR3: 000000002ee4a000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 85 8e 06 00 00 49 test %ecx,0x49000006(%rsi)
6: 8b 6c 24 18 mov 0x18(%rsp),%ebp
a: 48 c7 04 24 00 00 00 movq $0x0,(%rsp)
11: 00
12: 48 85 ed test %rbp,%rbp
15: 74 2f je 0x46
17: e8 b1 a5 c8 fd call 0xfdc8a5cd
1c: 48 8d bd e0 00 00 00 lea 0xe0(%rbp),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 74 08 je 0x3b
33: 3c 03 cmp $0x3,%al
35: 0f 8e 62 07 00 00 jle 0x79d
3b: 48 rex.W
3c: 63 .byte 0x63
3d: 85 e0 test %esp,%eax