================================================================== BUG: KASAN: slab-out-of-bounds in sysv_new_inode+0xd54/0xec8 fs/sysv/ialloc.c:153 Read of size 2 at addr ffff0000d75211ce by task syz-executor.0/10954 CPU: 1 PID: 10954 Comm: syz-executor.0 Not tainted 5.15.182-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_load2_noabort+0x44/0x50 mm/kasan/report_generic.c:307 sysv_new_inode+0xd54/0xec8 fs/sysv/ialloc.c:153 sysv_mknod+0x5c/0x100 fs/sysv/namei.c:53 sysv_create+0x38/0x4c fs/sysv/namei.c:67 lookup_open fs/namei.c:3462 [inline] open_last_lookups fs/namei.c:3532 [inline] path_openat+0x1144/0x26e4 fs/namei.c:3739 do_filp_open+0x164/0x330 fs/namei.c:3769 do_sys_openat2+0x128/0x3d8 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x120/0x154 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Allocated by task 10954: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] __kmalloc_node+0x2bc/0x520 mm/slub.c:4455 kmalloc_array_node include/linux/slab.h:697 [inline] kcalloc_node include/linux/slab.h:702 [inline] memcg_alloc_page_obj_cgroups+0x80/0x174 mm/memcontrol.c:2841 memcg_slab_post_alloc_hook mm/slab.h:313 [inline] slab_post_alloc_hook+0xc0/0x408 mm/slab.h:526 slab_alloc_node mm/slub.c:3220 [inline] slab_alloc mm/slub.c:3228 [inline] kmem_cache_alloc+0x1e0/0x3e4 mm/slub.c:3233 kmem_cache_zalloc include/linux/slab.h:725 [inline] alloc_buffer_head+0x2c/0x150 fs/buffer.c:3311 alloc_page_buffers+0x3d8/0x8cc fs/buffer.c:832 create_empty_buffers+0x4c/0x554 fs/buffer.c:1562 create_page_buffers+0x180/0x2c4 fs/buffer.c:1679 block_read_full_page+0xe0/0xc40 fs/buffer.c:2270 sysv_readpage+0x28/0x38 fs/sysv/itree.c:463 do_read_cache_page+0x5f4/0x8f8 mm/filemap.c:-1 read_cache_page+0x68/0x88 mm/filemap.c:3574 read_mapping_page include/linux/pagemap.h:515 [inline] dir_get_page fs/sysv/dir.c:58 [inline] sysv_find_entry+0x178/0x424 fs/sysv/dir.c:146 sysv_inode_by_name+0x38/0x138 fs/sysv/dir.c:360 sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38 lookup_open fs/namei.c:3440 [inline] open_last_lookups fs/namei.c:3532 [inline] path_openat+0xfbc/0x26e4 fs/namei.c:3739 do_filp_open+0x164/0x330 fs/namei.c:3769 do_sys_openat2+0x128/0x3d8 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x120/0x154 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the object at ffff0000d7521000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 206 bytes to the right of 256-byte region [ffff0000d7521000, ffff0000d7521100) The buggy address belongs to the page: page:00000000331c4628 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000d7521a00 pfn:0x117520 head:00000000331c4628 order:1 compound_mapcount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 fffffc0003a11e08 fffffc0003153188 ffff0000c0002480 raw: ffff0000d7521a00 000000000010000d 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d7521080: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000d7521100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000d7521180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0000d7521200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000d7521280: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ================================================================== sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_block: flc_count > flc_size sysv_free_inode: inode 0,1,2 or nonexistent inode