ffff888095027cd0: 00 00 00 04 00 00 00 05 00 00 00 00 00 00 00 01 ................ ffff888095027ce0: 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 04 ................ ffff888095027cf0: 00 00 00 04 00 00 7f be 00 00 7f be 00 00 00 00 ................ XFS (loop2): metadata I/O error: block 0x1 ("xfs_trans_read_buf_map") error 117 numblks 1 ===================================== WARNING: bad unlock balance detected! 4.14.302-syzkaller #0 Not tainted ------------------------------------- syz-executor.2/9541 is trying to release lock (&xfs_nondir_ilock_class) at: [] mrunlock_excl fs/xfs/mrlock.h:74 [inline] [] xfs_iunlock+0x29f/0x3b0 fs/xfs/xfs_inode.c:327 but there are no more locks to release! other info that might help us debug this: 2 locks held by syz-executor.2/9541: #0: (&type->s_umount_key#49/1){+.+.}, at: [] alloc_super fs/super.c:251 [inline] #0: (&type->s_umount_key#49/1){+.+.}, at: [] sget_userns+0x556/0xc10 fs/super.c:516 #1: (sb_internal#3){.+.+}, at: [] sb_start_intwrite include/linux/fs.h:1598 [inline] #1: (sb_internal#3){.+.+}, at: [] xfs_trans_alloc+0x259/0x320 fs/xfs/xfs_trans.c:242 stack backtrace: CPU: 1 PID: 9541 Comm: syz-executor.2 Not tainted 4.14.302-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_unlock_imbalance_bug include/trace/events/lock.h:58 [inline] __lock_release kernel/locking/lockdep.c:3769 [inline] lock_release.cold+0x70/0xbf kernel/locking/lockdep.c:4017 up_write+0x17/0x60 kernel/locking/rwsem.c:115 mrunlock_excl fs/xfs/mrlock.h:74 [inline] xfs_iunlock+0x29f/0x3b0 fs/xfs/xfs_inode.c:327 xfs_inode_item_unlock+0x83/0xa0 fs/xfs/xfs_inode_item.c:613 xfs_trans_free_items+0x172/0x230 fs/xfs/xfs_trans.c:768 xfs_trans_cancel+0x1ae/0x250 fs/xfs/xfs_trans.c:1025 xfs_qm_dqread+0x9c2/0xe50 fs/xfs/xfs_dquot.c:684 xfs_qm_dqget+0x4f4/0x19a0 fs/xfs/xfs_dquot.c:837 xfs_qm_quotacheck_dqadjust+0x96/0x5c0 fs/xfs/xfs_qm.c:1077 xfs_qm_dqusage_adjust+0x6f4/0xc20 fs/xfs/xfs_qm.c:1199 xfs_bulkstat_ag_ichunk fs/xfs/xfs_itable.c:313 [inline] xfs_bulkstat+0x72a/0xf60 fs/xfs/xfs_itable.c:498 xfs_qm_quotacheck+0x223/0x790 fs/xfs/xfs_qm.c:1338 xfs_qm_mount_quotas+0xe9/0x570 fs/xfs/xfs_qm.c:1457 xfs_mountfs+0x18be/0x1f40 fs/xfs/xfs_mount.c:979 xfs_fs_fill_super+0xb7a/0x1380 fs/xfs/xfs_super.c:1688 mount_bdev+0x2b3/0x360 fs/super.c:1134 mount_fs+0x92/0x2a0 fs/super.c:1237 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2572 [inline] do_mount+0xe65/0x2a30 fs/namespace.c:2905 SYSC_mount fs/namespace.c:3121 [inline] SyS_mount+0xa8/0x120 fs/namespace.c:3098 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f97dd0db5fa RSP: 002b:00007f97db64bf88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 000000000000bc0e RCX: 00007f97dd0db5fa RDX: 0000000020000040 RSI: 0000000020000000 RDI: 00007f97db64bfe0 RBP: 00007f97db64c020 R08: 00007f97db64c020 R09: 0000000002008090 R10: 0000000002008090 R11: 0000000000000202 R12: 0000000020000040 R13: 0000000020000000 R14: 00007f97db64bfe0 R15: 00000000200001c0 XFS (loop2): Quotacheck: Unsuccessful (Error -117): Disabling quotas. syz-executor.2 (9541) used greatest stack depth: 24816 bytes left XFS (loop2): Unmounting Filesystem ================================================================== BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 Read of size 4 at addr ffff8880b4a90f10 by task syz-executor.5/9604 CPU: 1 PID: 9604 Comm: syz-executor.5 Not tainted 4.14.302-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429 tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 NILFS (loop1): invalid segment: Checksum error in segment payload tipc_sendmcast+0x51a/0xac0 net/tipc/socket.c:768 NILFS (loop1): trying rollback from an earlier position __tipc_sendmsg+0xbab/0xf90 net/tipc/socket.c:975 tipc_sendmsg+0x4c/0x70 net/tipc/socket.c:923 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7fe4af91f0c9 RSP: 002b:00007fe4ade91168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fe4afa3ef80 RCX: 00007fe4af91f0c9 RDX: 0000000000000000 RSI: 0000000020000540 RDI: 0000000000000003 RBP: 00007fe4af97aae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdaed3eb1f R14: 00007fe4ade91300 R15: 0000000000022000 Allocated by task 8006: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 tipc_nameseq_create+0x53/0x290 net/tipc/name_table.c:152 tipc_nametbl_insert_publ+0xb37/0x14e0 net/tipc/name_table.c:476 tipc_nametbl_publish+0x211/0x3f0 net/tipc/name_table.c:701 tipc_sk_publish net/tipc/socket.c:2206 [inline] tipc_bind+0x2c4/0x600 net/tipc/socket.c:630 tipc_create_listen_sock net/tipc/server.c:338 [inline] tipc_open_listening_sock net/tipc/server.c:396 [inline] tipc_server_start+0x31f/0x880 net/tipc/server.c:611 tipc_topsrv_start net/tipc/subscr.c:382 [inline] tipc_topsrv_init_net+0x53b/0x730 net/tipc/subscr.c:397 ops_init+0xaa/0x3e0 net/core/net_namespace.c:118 setup_net+0x22f/0x530 net/core/net_namespace.c:298 copy_net_ns+0x19b/0x440 net/core/net_namespace.c:422 create_new_namespaces+0x375/0x720 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xa1/0x1d0 kernel/nsproxy.c:206 SYSC_unshare kernel/fork.c:2413 [inline] SyS_unshare+0x308/0x7f0 kernel/fork.c:2363 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 Freed by task 7: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 aa_free_task_context+0xda/0x130 security/apparmor/context.c:54 apparmor_cred_free+0x34/0x70 security/apparmor/lsm.c:58 security_cred_free+0x71/0xb0 security/security.c:1003 put_cred_rcu+0xe3/0x300 kernel/cred.c:117 __rcu_reclaim kernel/rcu/rcu.h:195 [inline] rcu_do_batch kernel/rcu/tree.c:2699 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline] rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 The buggy address belongs to the object at ffff8880b4a90f00 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 16 bytes inside of 32-byte region [ffff8880b4a90f00, ffff8880b4a90f20) The buggy address belongs to the page: page:ffffea0002d2a400 count:1 mapcount:0 mapping:ffff8880b4a90000 index:0xffff8880b4a90fc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880b4a90000 ffff8880b4a90fc1 000000010000003f raw: ffffea00028dc960 ffffea00027afde0 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880b4a90e00: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc ffff8880b4a90e80: 00 00 02 fc fc fc fc fc fb fb fb fb fc fc fc fc >ffff8880b4a90f00: 00 00 fc fc fc fc fc fc 00 00 00 fc fc fc fc fc ^ ffff8880b4a90f80: 05 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880b4a91000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================