================================================================== BUG: KASAN: use-after-free in copy_page_from_iter_atomic+0xc54/0x14d0 lib/iov_iter.c:817 Read of size 4096 at addr ffff8880721ff000 by task kworker/u4:1/11 CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.0.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: loop0 loop_workfn Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x20/0x60 mm/kasan/shadow.c:65 copy_page_from_iter_atomic+0xc54/0x14d0 lib/iov_iter.c:817 generic_perform_write+0x25f/0x480 mm/filemap.c:3746 __generic_file_write_iter+0x20e/0x400 mm/filemap.c:3866 generic_file_write_iter+0xc1/0x2c0 mm/filemap.c:3898 call_write_iter include/linux/fs.h:2187 [inline] do_iter_readv_writev+0x191/0x2e0 fs/read_write.c:729 do_iter_write+0x124/0x620 fs/read_write.c:855 lo_write_bvec drivers/block/loop.c:249 [inline] lo_write_simple drivers/block/loop.c:271 [inline] do_req_filebacked drivers/block/loop.c:495 [inline] loop_handle_cmd drivers/block/loop.c:1864 [inline] loop_process_work+0xb4f/0x1bb0 drivers/block/loop.c:1899 process_one_work+0x865/0x13d0 kernel/workqueue.c:2289 worker_thread+0x598/0xec0 kernel/workqueue.c:2436 kthread+0x294/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 The buggy address belongs to the physical page: page:ffffea0001c87fc0 refcount:1 mapcount:0 mapping:ffff8880111549f8 index:0x11 pfn:0x721ff memcg:ffff88813fe68000 aops:def_blk_aops ino:700000 flags: 0xfff00000020016(referenced|uptodate|lru|mappedtodisk|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000020016 ffffea0000808dc8 ffffea0000808d88 ffff8880111549f8 raw: 0000000000000011 0000000000000000 00000001ffffffff ffff88813fe68000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 4056, tgid 4056 (udevd), ts 209222327733, free_ts 209214820340 prep_new_page mm/page_alloc.c:2532 [inline] get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5515 folio_alloc+0x12/0x40 mm/mempolicy.c:2280 page_cache_ra_unbounded+0x173/0x470 mm/readahead.c:242 do_page_cache_ra mm/readahead.c:293 [inline] force_page_cache_ra+0x284/0x440 mm/readahead.c:324 page_cache_sync_readahead include/linux/pagemap.h:1215 [inline] filemap_get_pages+0x267/0x1490 mm/filemap.c:2566 filemap_read+0x28f/0xb30 mm/filemap.c:2660 blkdev_read_iter+0x2d5/0x5f0 block/fops.c:598 call_read_iter include/linux/fs.h:2181 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x55f/0x7c0 fs/read_write.c:470 ksys_read+0xee/0x1c0 fs/read_write.c:607 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1449 [inline] free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499 free_unref_page_prepare mm/page_alloc.c:3380 [inline] free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476 lbmLogShutdown fs/jfs/jfs_logmgr.c:1864 [inline] lmLogShutdown+0x2ff/0x590 fs/jfs/jfs_logmgr.c:1684 lmLogClose+0x4a5/0x670 fs/jfs/jfs_logmgr.c:1460 jfs_umount+0x2ac/0x3c0 fs/jfs/jfs_umount.c:116 jfs_put_super+0x69/0x160 fs/jfs/super.c:194 generic_shutdown_super+0x12e/0x3a0 fs/super.c:491 kill_block_super+0x90/0xd0 fs/super.c:1427 deactivate_locked_super+0x7b/0x130 fs/super.c:332 cleanup_mnt+0x253/0x360 fs/namespace.c:1186 task_work_run+0xc0/0x160 kernel/task_work.c:177 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff8880721fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880721fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888072200000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888072200080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888072200100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================