... Log Wrap ... Log Wrap ... Log Wrap ... find_entry called with index >= next_index ================================================================== BUG: KASAN: use-after-free in dtSplitRoot+0xb20/0x11bc fs/jfs/jfs_dtree.c:1997 Read of size 4 at addr ffff0000c89a801c by task syz.4.32/5465 CPU: 0 PID: 5465 Comm: syz.4.32 Not tainted 5.15.185-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308 dtSplitRoot+0xb20/0x11bc fs/jfs/jfs_dtree.c:1997 dtSplitUp fs/jfs/jfs_dtree.c:991 [inline] dtInsert+0xb0c/0x5634 fs/jfs/jfs_dtree.c:869 jfs_symlink+0x66c/0xd78 fs/jfs/namei.c:1019 vfs_symlink+0x238/0x3b0 fs/namei.c:4429 do_symlinkat+0x184/0x5a8 fs/namei.c:4458 __do_sys_symlinkat fs/namei.c:4475 [inline] __se_sys_symlinkat fs/namei.c:4472 [inline] __arm64_sys_symlinkat+0xa4/0xbc fs/namei.c:4472 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Allocated by task 5477: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x74/0x408 mm/slab.h:519 slab_alloc_node mm/slub.c:3220 [inline] slab_alloc mm/slub.c:3228 [inline] kmem_cache_alloc+0x1e0/0x3e4 mm/slub.c:3233 ptlock_alloc mm/memory.c:5556 [inline] ptlock_init include/linux/mm.h:2230 [inline] pgtable_pte_page_ctor include/linux/mm.h:2257 [inline] __pte_alloc_one include/asm-generic/pgalloc.h:66 [inline] pte_alloc_one+0x78/0x258 include/asm-generic/pgalloc.h:85 __pte_alloc+0x34/0x21c mm/memory.c:439 copy_pte_range mm/memory.c:1032 [inline] copy_pmd_range mm/memory.c:1167 [inline] copy_pud_range mm/memory.c:1204 [inline] copy_p4d_range mm/memory.c:1228 [inline] copy_page_range+0x1da8/0x22b8 mm/memory.c:1301 dup_mmap kernel/fork.c:615 [inline] dup_mm kernel/fork.c:1466 [inline] copy_mm+0x9c8/0x1084 kernel/fork.c:1518 copy_process+0x14d8/0x34ac kernel/fork.c:2290 kernel_clone+0x1d8/0x9d4 kernel/fork.c:2679 __do_sys_clone kernel/fork.c:2796 [inline] __se_sys_clone kernel/fork.c:2764 [inline] __arm64_sys_clone+0x138/0x190 kernel/fork.c:2764 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Freed by task 5478: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x84 mm/kasan/common.c:46 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kmem_cache_free+0xdc/0x3b4 mm/slub.c:3515 ptlock_free mm/memory.c:5565 [inline] pgtable_pte_page_dtor+0x54/0x1c8 include/linux/mm.h:2266 __pte_free_tlb arch/arm64/include/asm/tlb.h:78 [inline] free_pte_range mm/memory.c:231 [inline] free_pmd_range mm/memory.c:249 [inline] free_pud_range mm/memory.c:283 [inline] free_p4d_range mm/memory.c:317 [inline] free_pgd_range+0x520/0xc04 mm/memory.c:397 free_pgtables+0x23c/0x278 mm/memory.c:-1 exit_mmap+0x2bc/0x4e0 mm/mmap.c:3205 __mmput+0xec/0x3b8 kernel/fork.c:1127 mmput+0x80/0xc8 kernel/fork.c:1148 exec_mmap+0x3f8/0x4dc fs/exec.c:1035 begin_new_exec+0x6bc/0xeb8 fs/exec.c:1293 load_elf_binary+0x698/0x1e9c fs/binfmt_elf.c:1001 search_binary_handler fs/exec.c:1742 [inline] exec_binprm fs/exec.c:1783 [inline] bprm_execve+0x7f4/0x1508 fs/exec.c:1852 do_execveat_common+0x648/0x7dc fs/exec.c:1957 do_execve fs/exec.c:2027 [inline] __do_sys_execve fs/exec.c:2103 [inline] __se_sys_execve fs/exec.c:2098 [inline] __arm64_sys_execve+0x98/0xb0 fs/exec.c:2098 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the object at ffff0000c89a8000 which belongs to the cache page->ptl of size 64 The buggy address is located 28 bytes inside of 64-byte region [ffff0000c89a8000, ffff0000c89a8040) The buggy address belongs to the page: page:0000000068581897 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1089a8 flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000200 fffffc000327a200 0000001600000016 ffff0000c000cd80 raw: 0000000000000000 00000000802a002a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000c89a7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000c89a7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000c89a8000: fa fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00 ^ ffff0000c89a8080: 00 00 00 00 fc fc fc fc fa fb fb fb fb fb fb fb ffff0000c89a8100: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc ================================================================== find_entry called with index >= next_index ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ...