... Log Wrap ... Log Wrap ... Log Wrap ... ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_write include/linux/instrumented.h:82 [inline] BUG: KASAN: slab-use-after-free in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: slab-use-after-free in txEnd+0x328/0x558 fs/jfs/jfs_txnmgr.c:554 Write of size 8 at addr ffff0000cf656840 by task jfsCommit/95 CPU: 0 PID: 95 Comm: jfsCommit Not tainted 6.8.0-rc6-syzkaller-00250-g04b8076df253 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x174/0x514 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 kasan_check_range+0x254/0x294 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:82 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] txEnd+0x328/0x558 fs/jfs/jfs_txnmgr.c:554 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline] jfs_lazycommit+0x4c8/0x98c fs/jfs/jfs_txnmgr.c:2733 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Allocated by task 6035: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:575 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x90/0xa8 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x268/0x468 mm/slub.c:4012 kmalloc include/linux/slab.h:590 [inline] kzalloc include/linux/slab.h:711 [inline] open_inline_log fs/jfs/jfs_logmgr.c:1159 [inline] lmLogOpen+0x2a8/0xdc8 fs/jfs/jfs_logmgr.c:1069 jfs_mount_rw+0xe4/0x5b8 fs/jfs/jfs_mount.c:257 jfs_fill_super+0x4f0/0x9f0 fs/jfs/super.c:565 mount_bdev+0x1d4/0x2a0 fs/super.c:1658 jfs_do_mount+0x44/0x58 fs/jfs/super.c:670 legacy_get_tree+0xd4/0x16c fs/fs_context.c:662 vfs_get_tree+0x90/0x288 fs/super.c:1779 do_new_mount+0x278/0x900 fs/namespace.c:3352 path_mount+0x590/0xe04 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount fs/namespace.c:3875 [inline] __arm64_sys_mount+0x45c/0x594 fs/namespace.c:3875 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Freed by task 5863: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:589 poison_slab_object+0x120/0x188 mm/kasan/common.c:240 __kasan_slab_free+0x1c/0x48 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x128/0x3a4 mm/slub.c:4409 lmLogClose+0x270/0x4d4 jfs_umount+0x274/0x360 fs/jfs/jfs_umount.c:114 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x128/0x2b8 fs/super.c:641 kill_block_super+0x44/0x90 fs/super.c:1675 deactivate_locked_super+0xc4/0x12c fs/super.c:472 deactivate_super+0xe0/0x100 fs/super.c:505 cleanup_mnt+0x34c/0x3dc fs/namespace.c:1267 __cleanup_mnt+0x20/0x30 fs/namespace.c:1274 task_work_run+0x230/0x2e0 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] do_notify_resume+0x214c/0x3960 arch/arm64/kernel/signal.c:1305 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:144 [inline] el0_svc+0x9c/0x158 arch/arm64/kernel/entry-common.c:679 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The buggy address belongs to the object at ffff0000cf656800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 64 bytes inside of freed 1024-byte region [ffff0000cf656800, ffff0000cf656c00) The buggy address belongs to the physical page: page:00000000aaea2738 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f650 head:00000000aaea2738 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 05ffc00000000840 ffff0000c0001dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000cf656700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000cf656780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000cf656800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000cf656880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000cf656900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... Unable to handle kernel paging request at virtual address dfff800000000006 KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000006] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 95 Comm: jfsCommit Tainted: G B 6.8.0-rc6-syzkaller-00250-g04b8076df253 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : write_special_inodes fs/jfs/jfs_logmgr.c:207 [inline] pc : lmLogSync+0xec/0x978 fs/jfs/jfs_logmgr.c:935 lr : write_special_inodes fs/jfs/jfs_logmgr.c:207 [inline] lr : lmLogSync+0xe0/0x978 fs/jfs/jfs_logmgr.c:935 sp : ffff8000951f7b20 x29: ffff8000951f7bf0 x28: ffff800094b46000 x27: dfff800000000000 x26: dfff800000000000 x25: ffff8000951f7b40 x24: 1ffff00011b413bc x23: 0000000000000002 x22: 0000000000000006 x21: 0000000000000030 x20: ffff0000c83e6c98 x19: ffff0000c1a7e000 x18: 1fffe000368c6f96 x17: ffff80008d45d000 x16: ffff800089f04bc0 x15: ffff700012a3ef70 x14: 1ffff00012a3ef6d x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700012a3ef70 x10: 0000000000ff0100 x9 : ffff800091260740 x8 : 0000000000000006 x7 : 0000000000000000 x6 : ffff80008a081114 x5 : 0000000000000000 x4 : 0000000000000004 x3 : ffff800081ab46bc x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 Call trace: write_special_inodes fs/jfs/jfs_logmgr.c:207 [inline] lmLogSync+0xec/0x978 fs/jfs/jfs_logmgr.c:935 jfs_syncpt+0x74/0x98 fs/jfs/jfs_logmgr.c:1041 txEnd+0x2ec/0x558 fs/jfs/jfs_txnmgr.c:549 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline] jfs_lazycommit+0x4c8/0x98c fs/jfs/jfs_txnmgr.c:2733 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: 97bce273 f94002a8 9100c115 d343fea8 (387b6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97bce273 bl 0xfffffffffef389cc 4: f94002a8 ldr x8, [x21] 8: 9100c115 add x21, x8, #0x30 c: d343fea8 lsr x8, x21, #3 * 10: 387b6908 ldrb w8, [x8, x27] <-- trapping instruction