loop5: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x22a/0x240 fs/hfsplus/bnode.c:32
Read of size 8 at addr ffff8880212783e0 by task syz-executor.5/7790

CPU: 0 PID: 7790 Comm: syz-executor.5 Not tainted 6.9.0-rc5-syzkaller-00036-g9d1ddab261f3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 hfsplus_bnode_read+0x22a/0x240 fs/hfsplus/bnode.c:32
 hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline]
 hfsplus_bnode_dump+0x2a2/0x3e0 fs/hfsplus/bnode.c:321
 hfsplus_brec_remove+0x3e2/0x4f0 fs/hfsplus/brec.c:229
 __hfsplus_delete_attr+0x2a2/0x3b0 fs/hfsplus/attributes.c:299
 hfsplus_delete_attr+0x27e/0x310 fs/hfsplus/attributes.c:345
 hfsplus_removexattr fs/hfsplus/xattr.c:794 [inline]
 __hfsplus_setxattr+0x8a6/0x2180 fs/hfsplus/xattr.c:275
 hfsplus_setxattr+0x10c/0x180 fs/hfsplus/xattr.c:434
 __vfs_removexattr+0x156/0x1c0 fs/xattr.c:518
 __vfs_removexattr_locked+0x166/0x440 fs/xattr.c:553
 vfs_removexattr+0xcf/0x260 fs/xattr.c:575
 removexattr+0x137/0x1b0 fs/xattr.c:917
 path_removexattr+0x161/0x1c0 fs/xattr.c:931
 __do_sys_removexattr fs/xattr.c:945 [inline]
 __se_sys_removexattr fs/xattr.c:942 [inline]
 __x64_sys_removexattr+0x59/0x80 fs/xattr.c:942
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f252727dea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f25280bd0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c5
RAX: ffffffffffffffda RBX: 00007f25273abf80 RCX: 00007f252727dea9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000020000040
RBP: 00007f25272ca4a4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f25273abf80 R15: 00007fffaab129a8
 </TASK>

Allocated by task 7790:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3966 [inline]
 __kmalloc+0x1f9/0x440 mm/slub.c:3979
 kmalloc include/linux/slab.h:632 [inline]
 kzalloc include/linux/slab.h:749 [inline]
 __hfs_bnode_create+0x108/0x870 fs/hfsplus/bnode.c:409
 hfsplus_bnode_find+0x2c8/0xcb0 fs/hfsplus/bnode.c:486
 hfsplus_brec_find+0x2b9/0x520 fs/hfsplus/bfind.c:183
 hfsplus_find_attr+0xe6/0x190 fs/hfsplus/attributes.c:153
 hfsplus_attr_exists+0x14d/0x200 fs/hfsplus/attributes.c:182
 __hfsplus_setxattr+0x4c6/0x2180 fs/hfsplus/xattr.c:336
 hfsplus_setxattr+0x10c/0x180 fs/hfsplus/xattr.c:434
 __vfs_setxattr+0x176/0x1e0 fs/xattr.c:200
 __vfs_setxattr_noperm+0x127/0x5e0 fs/xattr.c:234
 __vfs_setxattr_locked+0x182/0x260 fs/xattr.c:295
 vfs_setxattr+0x146/0x350 fs/xattr.c:321
 do_setxattr+0x146/0x170 fs/xattr.c:629
 setxattr+0x15d/0x180 fs/xattr.c:652
 path_setxattr+0x179/0x1e0 fs/xattr.c:671
 __do_sys_setxattr fs/xattr.c:687 [inline]
 __se_sys_setxattr fs/xattr.c:683 [inline]
 __x64_sys_setxattr+0xc4/0x160 fs/xattr.c:683
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888021278300
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 72 bytes to the right of
 allocated 152-byte region [ffff888021278300, ffff888021278398)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21278
ksm flags: 0xfff80000000800(slab|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000800 ffff888015041a00 ffffea0000888080 dead000000000003
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6751, tgid 1846982597 (syz-executor.0), ts 6752, free_ts 229389390888
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
 __alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2175 [inline]
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2391
 ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 kmalloc_trace+0x2fb/0x330 mm/slub.c:3992
 kmalloc include/linux/slab.h:628 [inline]
 kzalloc include/linux/slab.h:749 [inline]
 btrfs_alloc_workqueue+0x5b/0x510 fs/btrfs/async-thread.c:88
 btrfs_init_workqueues fs/btrfs/disk-io.c:2003 [inline]
 open_ctree+0x1626/0x52f0 fs/btrfs/disk-io.c:3354
 btrfs_fill_super fs/btrfs/super.c:938 [inline]
 btrfs_get_tree_super fs/btrfs/super.c:1858 [inline]
 btrfs_get_tree+0x11e9/0x1b90 fs/btrfs/super.c:2084
 vfs_get_tree+0x92/0x380 fs/super.c:1779
 fc_mount+0x16/0xc0 fs/namespace.c:1125
 btrfs_get_tree_subvol fs/btrfs/super.c:2047 [inline]
 btrfs_get_tree+0xa53/0x1b90 fs/btrfs/super.c:2085
 vfs_get_tree+0x92/0x380 fs/super.c:1779
 do_new_mount fs/namespace.c:3352 [inline]
 path_mount+0x14e6/0x1f20 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount fs/namespace.c:3875 [inline]
 __x64_sys_mount+0x297/0x320 fs/namespace.c:3875
page last free pid 4535 tgid 4535 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 __put_partials+0x14c/0x170 mm/slub.c:2906
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3798 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 __do_kmalloc_node mm/slub.c:3965 [inline]
 __kmalloc+0x1bd/0x440 mm/slub.c:3979
 kmalloc include/linux/slab.h:632 [inline]
 tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
 security_inode_getattr+0xf7/0x160 security/security.c:2269
 vfs_getattr fs/stat.c:173 [inline]
 vfs_fstat+0x53/0xd0 fs/stat.c:198
 vfs_fstatat+0x134/0x150 fs/stat.c:300
 __do_sys_newfstatat+0x98/0x120 fs/stat.c:468
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888021278280: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888021278300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888021278380: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                       ^
 ffff888021278400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888021278480: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
general protection fault, maybe for address 0xffffc9000352f390: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 7790 Comm: syz-executor.5 Tainted: G    B              6.9.0-rc5-syzkaller-00036-g9d1ddab261f3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:memcpy+0xc/0x20 arch/x86/lib/memcpy_64.S:38
Code: 48 18 8f e8 e6 1d d5 f9 e9 53 fd ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 48 89 f8 48 89 d1 <f3> a4 e9 e8 e8 33 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90
RSP: 0018:ffffc9000352f2f8 EFLAGS: 00010206
RAX: ffffc9000352f390 RBX: 0000000000000100 RCX: 0000000000000002
RDX: 0000000000000002 RSI: 0005088000000100 RDI: ffffc9000352f390
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000001000
R10: 0000000000000102 R11: 6e696c6261736944 R12: 0000000000000102
R13: 0000000000000002 R14: 0000000000000002 R15: ffff8880212783e0
FS:  00007f25280bd6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 000000002ceea000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 memcpy_from_page include/linux/highmem.h:417 [inline]
 hfsplus_bnode_read+0x100/0x240 fs/hfsplus/bnode.c:32
 hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline]
 hfsplus_bnode_dump+0x2a2/0x3e0 fs/hfsplus/bnode.c:321
 hfsplus_brec_remove+0x3e2/0x4f0 fs/hfsplus/brec.c:229
 __hfsplus_delete_attr+0x2a2/0x3b0 fs/hfsplus/attributes.c:299
 hfsplus_delete_attr+0x27e/0x310 fs/hfsplus/attributes.c:345
 hfsplus_removexattr fs/hfsplus/xattr.c:794 [inline]
 __hfsplus_setxattr+0x8a6/0x2180 fs/hfsplus/xattr.c:275
 hfsplus_setxattr+0x10c/0x180 fs/hfsplus/xattr.c:434
 __vfs_removexattr+0x156/0x1c0 fs/xattr.c:518
 __vfs_removexattr_locked+0x166/0x440 fs/xattr.c:553
 vfs_removexattr+0xcf/0x260 fs/xattr.c:575
 removexattr+0x137/0x1b0 fs/xattr.c:917
 path_removexattr+0x161/0x1c0 fs/xattr.c:931
 __do_sys_removexattr fs/xattr.c:945 [inline]
 __se_sys_removexattr fs/xattr.c:942 [inline]
 __x64_sys_removexattr+0x59/0x80 fs/xattr.c:942
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f252727dea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f25280bd0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c5
RAX: ffffffffffffffda RBX: 00007f25273abf80 RCX: 00007f252727dea9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000020000040
RBP: 00007f25272ca4a4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f25273abf80 R15: 00007fffaab129a8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:memcpy+0xc/0x20 arch/x86/lib/memcpy_64.S:38
Code: 48 18 8f e8 e6 1d d5 f9 e9 53 fd ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 48 89 f8 48 89 d1 <f3> a4 e9 e8 e8 33 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90
RSP: 0018:ffffc9000352f2f8 EFLAGS: 00010206
RAX: ffffc9000352f390 RBX: 0000000000000100 RCX: 0000000000000002
RDX: 0000000000000002 RSI: 0005088000000100 RDI: ffffc9000352f390
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000001000
R10: 0000000000000102 R11: 6e696c6261736944 R12: 0000000000000102
R13: 0000000000000002 R14: 0000000000000002 R15: ffff8880212783e0
FS:  00007f25280bd6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff80e323000 CR3: 000000002ceea000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	48 18 8f e8 e6 1d d5 	rex.W sbb %cl,-0x2ae21918(%rdi)
   7:	f9                   	stc
   8:	e9 53 fd ff ff       	jmp    0xfffffd60
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	f3 0f 1e fa          	endbr64
  22:	66 90                	xchg   %ax,%ax
  24:	48 89 f8             	mov    %rdi,%rax
  27:	48 89 d1             	mov    %rdx,%rcx
* 2a:	f3 a4                	rep movsb %ds:(%rsi),%es:(%rdi) <-- trapping instruction
  2c:	e9 e8 e8 33 00       	jmp    0x33e919
  31:	66 66 2e 0f 1f 84 00 	data16 cs nopw 0x0(%rax,%rax,1)
  38:	00 00 00 00
  3c:	66 90                	xchg   %ax,%ax
  3e:	90                   	nop
  3f:	90                   	nop