================================================================== BUG: KASAN: use-after-free in memcpy_from_page include/linux/highmem.h:321 [inline] BUG: KASAN: use-after-free in iov_iter_copy_from_user_atomic+0x72d/0xd10 lib/iov_iter.c:991 Read of size 4096 at addr ffff8880130e0000 by task loop1/10606 CPU: 0 PID: 10606 Comm: loop1 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x176/0x24e lib/dump_stack.c:120 print_address_description+0x5f/0x3a0 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x15c/0x200 mm/kasan/report.c:416 check_region_inline mm/kasan/generic.c:135 [inline] kasan_check_range+0x2b5/0x2f0 mm/kasan/generic.c:186 memcpy+0x25/0x60 mm/kasan/shadow.c:65 memcpy_from_page include/linux/highmem.h:321 [inline] iov_iter_copy_from_user_atomic+0x72d/0xd10 lib/iov_iter.c:991 generic_perform_write+0x2c2/0x4f0 mm/filemap.c:3583 __generic_file_write_iter+0x222/0x4e0 mm/filemap.c:3704 generic_file_write_iter+0xa7/0x1b0 mm/filemap.c:3736 do_iter_readv_writev+0x48c/0x650 include/linux/fs.h:1971 do_iter_write+0x16c/0x5f0 fs/read_write.c:866 lo_write_bvec+0x279/0x660 drivers/block/loop.c:284 lo_write_simple drivers/block/loop.c:306 [inline] do_req_filebacked drivers/block/loop.c:629 [inline] loop_handle_cmd drivers/block/loop.c:2045 [inline] loop_queue_work+0x1dbe/0x2290 drivers/block/loop.c:2063 kthread_worker_fn+0x470/0x760 kernel/kthread.c:735 kthread+0x39a/0x3c0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 The buggy address belongs to the page: page:ffffea00004c3800 refcount:1 mapcount:0 mapping:ffff8880160dd990 index:0x3 pfn:0x130e0 memcg:ffff888140730000 aops:def_blk_aops ino:700005 flags: 0xfff00000020016(referenced|uptodate|lru|mappedtodisk) raw: 00fff00000020016 ffffea00004c8d48 ffffea0000486348 ffff8880160dd990 raw: 0000000000000003 0000000000000000 00000001ffffffff ffff888140730000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880130dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880130dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880130e0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880130e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880130e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================