================================================================== BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0xa9b/0x1060 lib/iov_iter.c:821 Read of size 1024 at addr ffff8880233f7800 by task kworker/u4:6/2797 CPU: 0 PID: 2797 Comm: kworker/u4:6 Not tainted 6.2.0-rc7-syzkaller-00091-g35674e787518 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 Workqueue: loop0 loop_workfn Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 memcpy+0x24/0x60 mm/kasan/shadow.c:65 copy_page_from_iter_atomic+0xa9b/0x1060 lib/iov_iter.c:821 generic_perform_write+0x2ca/0x570 mm/filemap.c:3780 __generic_file_write_iter+0x2ae/0x500 mm/filemap.c:3900 generic_file_write_iter+0xe3/0x350 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2189 [inline] do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735 do_iter_write+0x182/0x700 fs/read_write.c:861 vfs_iter_write+0x74/0xa0 fs/read_write.c:902 lo_write_bvec drivers/block/loop.c:249 [inline] lo_write_simple drivers/block/loop.c:271 [inline] do_req_filebacked drivers/block/loop.c:495 [inline] loop_handle_cmd drivers/block/loop.c:1873 [inline] loop_process_work+0xdad/0x2070 drivers/block/loop.c:1908 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Allocated by task 5980: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] hfsplus_read_wrapper+0x324/0xfd0 fs/hfsplus/wrapper.c:178 hfsplus_fill_super+0x31a/0x1a30 fs/hfsplus/super.c:413 mount_bdev+0x351/0x410 fs/super.c:1359 legacy_get_tree+0x109/0x220 fs/fs_context.c:610 vfs_get_tree+0x8d/0x2f0 fs/super.c:1489 do_new_mount fs/namespace.c:3145 [inline] path_mount+0x132a/0x1e20 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount fs/namespace.c:3674 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880233f7800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff8880233f7800, ffff8880233f7a00) The buggy address belongs to the physical page: page:ffffea00008cfdc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x233f7 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff888012440600 ffffea0001def210 ffffea0000a24790 raw: 0000000000000000 ffff8880233f7000 0000000100000004 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2c20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_THISNODE), pid 5114, tgid 5114 (syz-executor.5), ts 253101185546, free_ts 253026939714 prep_new_page mm/page_alloc.c:2531 [inline] get_page_from_freelist+0x119c/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5549 __alloc_pages_node include/linux/gfp.h:237 [inline] kmem_getpages mm/slab.c:1363 [inline] cache_grow_begin+0x94/0x390 mm/slab.c:2576 cache_alloc_refill+0x27f/0x380 mm/slab.c:2949 ____cache_alloc mm/slab.c:3025 [inline] ____cache_alloc mm/slab.c:3008 [inline] __do_cache_alloc mm/slab.c:3208 [inline] slab_alloc_node mm/slab.c:3256 [inline] __kmem_cache_alloc_node+0x44f/0x510 mm/slab.c:3546 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x4b/0xc0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0xe9/0x310 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:290 uevent_net_broadcast_tagged lib/kobject_uevent.c:351 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:412 [inline] kobject_uevent_env+0x10f3/0x1620 lib/kobject_uevent.c:593 device_add+0xb76/0x1e90 drivers/base/core.c:3460 netdev_register_kobject+0x185/0x400 net/core/net-sysfs.c:2015 register_netdevice+0xd77/0x1640 net/core/dev.c:10045 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1517 rtnl_newlink_create net/core/rtnetlink.c:3407 [inline] __rtnl_newlink+0x10c2/0x1840 net/core/rtnetlink.c:3624 rtnl_newlink+0x68/0xa0 net/core/rtnetlink.c:3637 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1446 [inline] free_pcp_prepare+0x65c/0xc00 mm/page_alloc.c:1496 free_unref_page_prepare mm/page_alloc.c:3369 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3464 slab_destroy mm/slab.c:1619 [inline] slabs_destroy+0x85/0xc0 mm/slab.c:1639 cache_flusharray mm/slab.c:3367 [inline] ___cache_free+0x2ac/0x3d0 mm/slab.c:3430 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x4f/0x1a0 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slab.h:761 [inline] slab_alloc_node mm/slab.c:3263 [inline] __kmem_cache_alloc_node+0x26b/0x510 mm/slab.c:3546 kmalloc_trace+0x26/0x60 mm/slab_common.c:1062 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] ref_tracker_alloc+0x158/0x560 lib/ref_tracker.c:85 __netdev_tracker_alloc include/linux/netdevice.h:4020 [inline] netdev_hold include/linux/netdevice.h:4049 [inline] netdev_hold include/linux/netdevice.h:4044 [inline] netdev_queue_add_kobject net/core/net-sysfs.c:1663 [inline] netdev_queue_update_kobjects+0x1ab/0x4f0 net/core/net-sysfs.c:1718 register_queue_kobjects net/core/net-sysfs.c:1779 [inline] netdev_register_kobject+0x334/0x400 net/core/net-sysfs.c:2019 register_netdevice+0xd77/0x1640 net/core/dev.c:10045 bond_newlink drivers/net/bonding/bond_netlink.c:560 [inline] bond_newlink+0x4b/0xa0 drivers/net/bonding/bond_netlink.c:550 rtnl_newlink_create net/core/rtnetlink.c:3407 [inline] __rtnl_newlink+0x10c2/0x1840 net/core/rtnetlink.c:3624 rtnl_newlink+0x68/0xa0 net/core/rtnetlink.c:3637 Memory state around the buggy address: ffff8880233f7900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880233f7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880233f7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880233f7a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880233f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================