bisecting fixing commit since cbfa1702aaf69b2311ea1b35e04f113c48368c67 building syzkaller on 2d5ea0cb6edb828803beea8af38dbc04dc80f028 testing commit cbfa1702aaf69b2311ea1b35e04f113c48368c67 with gcc (GCC) 8.1.0 kernel signature: e288235ffd2de824a37d4472126bf0c8c2f376b7bdb042a49a25ac5d7d4eb9c1 run #0: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #1: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #2: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #3: crashed: KASAN: use-after-free Read in leaf_paste_entries run #4: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #5: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #6: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #7: crashed: KASAN: use-after-free Read in search_by_entry_key run #8: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #9: crashed: KASAN: out-of-bounds Read in leaf_paste_entries testing current HEAD 87335852c5d9ec629f80bb2257b9a9945962b719 testing commit 87335852c5d9ec629f80bb2257b9a9945962b719 with gcc (GCC) 8.1.0 kernel signature: 25547391212ea38402ebaeeb0735fb90f92c07e151f2e1c42e5d8414f183ba64 run #0: crashed: KASAN: use-after-free Read in search_by_entry_key run #1: crashed: KASAN: use-after-free Read in leaf_paste_entries run #2: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #3: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #4: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #5: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #6: crashed: KASAN: use-after-free Read in search_by_entry_key run #7: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #8: crashed: KASAN: out-of-bounds Read in leaf_paste_entries run #9: crashed: KASAN: out-of-bounds Read in leaf_paste_entries revisions tested: 2, total time: 23m25.112394351s (build: 16m59.155724331s, test: 5m33.228440363s) the crash still happens on HEAD commit msg: Linux 4.14.209 crash: KASAN: out-of-bounds Read in leaf_paste_entries REISERFS (device loop1): journal params: device loop1, size 15748, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30 REISERFS (device loop1): checking transaction log (loop1) REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): using 3.5.x disk format ================================================================== BUG: KASAN: out-of-bounds in memmove include/linux/string.h:387 [inline] BUG: KASAN: out-of-bounds in leaf_paste_entries+0x3f7/0xa20 fs/reiserfs/lbalance.c:1378 Read of size 18446744073709473760 at addr ffff888066d19fbf by task syz-executor.2/7879 CPU: 0 PID: 7879 Comm: syz-executor.2 Not tainted 4.14.209-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 print_address_description.cold.6+0x9/0x1ca mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.7+0x11a/0x2d4 mm/kasan/report.c:409 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13c/0x1b0 mm/kasan/kasan.c:267 memmove+0x23/0x50 mm/kasan/kasan.c:293 memmove include/linux/string.h:387 [inline] leaf_paste_entries+0x3f7/0xa20 fs/reiserfs/lbalance.c:1378 balance_leaf_finish_node_paste_dirent fs/reiserfs/do_balan.c:1306 [inline] balance_leaf_finish_node_paste.isra.15+0x494/0x12b0 fs/reiserfs/do_balan.c:1332 balance_leaf_finish_node fs/reiserfs/do_balan.c:1375 [inline] balance_leaf fs/reiserfs/do_balan.c:1463 [inline] do_balance+0x257c/0x67e0 fs/reiserfs/do_balan.c:1899 reiserfs_paste_into_item+0x44f/0x570 fs/reiserfs/stree.c:2142 reiserfs_add_entry+0x6d5/0xa50 fs/reiserfs/namei.c:566 reiserfs_mkdir+0x586/0x820 fs/reiserfs/namei.c:858 xattr_mkdir.constprop.6+0x80/0xc0 fs/reiserfs/xattr.c:76 create_privroot fs/reiserfs/xattr.c:880 [inline] reiserfs_xattr_init+0x391/0x930 fs/reiserfs/xattr.c:1002 reiserfs_fill_super+0x199b/0x26e0 fs/reiserfs/super.c:2180 mount_bdev+0x26f/0x330 fs/super.c:1134 get_super_block+0x10/0x20 fs/reiserfs/super.c:2609 mount_fs+0x7f/0x269 fs/super.c:1237 vfs_kern_mount.part.9+0x58/0x3c0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x352/0x2af0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xb1/0xd0 fs/namespace.c:3072 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x460bca RSP: 002b:00007fed21967a88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fed21967b20 RCX: 0000000000460bca RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fed21967ae0 RBP: 00007fed21967ae0 R08: 00007fed21967b20 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000 R13: 0000000020000100 R14: 0000000020000140 R15: 0000000020000040 The buggy address belongs to the page: page:ffffea00019b4640 count:1 mapcount:0 mapping:ffff8880b5b56d80 index:0x2623 flags: 0xfffe000004003c(referenced|uptodate|dirty|lru|swapbacked) raw: 00fffe000004003c ffff8880b5b56d80 0000000000002623 00000001ffffffff raw: ffffea00019b4620 ffffea00019b46a0 0000000000000000 ffff8880b5843300 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8880b5843300 Memory state around the buggy address: ffff888066d19e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888066d19f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888066d19f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888066d1a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888066d1a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================