Process accounting resumed ================================================================== BUG: KASAN: use-after-free in add_chain fs/minix/itree_common.c:14 [inline] BUG: KASAN: use-after-free in get_branch fs/minix/itree_common.c:52 [inline] BUG: KASAN: use-after-free in get_block+0x1103/0x13a0 fs/minix/itree_common.c:160 Read of size 2 at addr ffff88806609418a by task syz-executor.4/22593 CPU: 1 PID: 22593 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x436 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 add_chain fs/minix/itree_common.c:14 [inline] get_branch fs/minix/itree_common.c:52 [inline] get_block+0x1103/0x13a0 fs/minix/itree_common.c:160 minix_get_block+0xe5/0x110 fs/minix/inode.c:376 __block_write_begin_int+0x464/0x1a80 fs/buffer.c:2012 __block_write_begin fs/buffer.c:2062 [inline] block_write_begin+0x58/0x2e0 fs/buffer.c:2121 minix_write_begin+0x35/0x220 fs/minix/inode.c:412 generic_perform_write+0x20a/0x4f0 mm/filemap.c:3318 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3447 generic_file_write_iter+0x3a6/0x5c0 mm/filemap.c:3479 call_write_iter include/linux/fs.h:1908 [inline] new_sync_write+0x422/0x650 fs/read_write.c:503 __kernel_write+0x3f8/0x500 fs/read_write.c:530 do_acct_process+0xcc2/0x10c0 kernel/acct.c:522 acct_pin_kill+0x29/0xf0 kernel/acct.c:174 pin_kill+0x16f/0x780 fs/fs_pin.c:44 mnt_pin_kill+0x62/0x1b0 fs/fs_pin.c:81 cleanup_mnt+0x413/0x500 fs/namespace.c:1111 task_work_run+0xdd/0x190 kernel/task_work.c:135 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:239 [inline] __prepare_exit_to_usermode+0x1e9/0x1f0 arch/x86/entry/common.c:269 do_syscall_64+0x6c/0xe0 arch/x86/entry/common.c:393 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45cba9 Code: Bad RIP value. RSP: 002b:00007f6401adbc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 000000000050ca80 RCX: 000000000045cba9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000500 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000cb6 R14: 00000000004cf091 R15: 00007f6401adc6d4 The buggy address belongs to the page: page:ffffea0001982500 refcount:1 mapcount:1 mapping:0000000000000000 index:0x765 anon flags: 0xfffe0000080034(uptodate|lru|active|swapbacked) raw: 00fffe0000080034 ffffea00003584c8 ffffea000194a308 ffff88809b9a9d01 raw: 0000000000000765 0000000000000000 0000000100000000 ffff88821b7ac000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff88821b7ac000 Memory state around the buggy address: ffff888066094080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888066094100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888066094180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888066094200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888066094280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================