ocfs2: Unmounting device (7,3) on (node local) ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. ocfs2: Unmounting device (7,3) on (node local) ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. ================================================================== BUG: KASAN: slab-out-of-bounds in ocfs2_match fs/ocfs2/dir.c:349 [inline] BUG: KASAN: slab-out-of-bounds in ocfs2_search_dirblock fs/ocfs2/dir.c:382 [inline] BUG: KASAN: slab-out-of-bounds in ocfs2_find_entry_id fs/ocfs2/dir.c:428 [inline] BUG: KASAN: slab-out-of-bounds in ocfs2_find_entry+0x13b2/0x1540 fs/ocfs2/dir.c:1092 Read of size 1 at addr ffff8800a9f3c8cb by task syz.3.18/3861 CPU: 0 PID: 3861 Comm: syz.3.18 Not tainted 4.19.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x10c/0x17a lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 ocfs2_match fs/ocfs2/dir.c:349 [inline] ocfs2_search_dirblock fs/ocfs2/dir.c:382 [inline] ocfs2_find_entry_id fs/ocfs2/dir.c:428 [inline] ocfs2_find_entry+0x13b2/0x1540 fs/ocfs2/dir.c:1092 ocfs2_find_files_on_disk+0x54/0x2e0 fs/ocfs2/dir.c:2002 ocfs2_lookup_ino_from_name+0x83/0xc0 fs/ocfs2/dir.c:2024 ocfs2_lookup+0x179/0x850 fs/ocfs2/namei.c:137 lookup_open+0x5c5/0x1d20 fs/namei.c:3213 do_last fs/namei.c:3324 [inline] path_openat+0xe56/0x2910 fs/namei.c:3534 do_filp_open+0x177/0x250 fs/namei.c:3564 do_sys_open+0x1dc/0x350 fs/open.c:1063 __do_sys_open fs/open.c:1081 [inline] __se_sys_open fs/open.c:1076 [inline] __x64_sys_open+0x79/0xb0 fs/open.c:1076 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fa4ecc82849 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa4ec701058 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fa4ece47fa0 RCX: 00007fa4ecc82849 RDX: 0000000000000000 RSI: 0000000400141042 RDI: 0000000020000080 RBP: 00007fa4eccf5986 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fa4ece47fa0 R15: 00007ffd03102478 Allocated by task 3770: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:444 [inline] slab_alloc_node mm/slub.c:2706 [inline] slab_alloc mm/slub.c:2714 [inline] kmem_cache_alloc+0xdc/0x230 mm/slub.c:2719 vm_area_dup+0x1b/0x150 kernel/fork.c:323 __split_vma+0x8e/0x4b0 mm/mmap.c:2624 do_munmap+0x1fa/0xd60 mm/mmap.c:2733 mmap_region+0x1a4/0x13c0 mm/mmap.c:1705 do_mmap+0x673/0xe90 mm/mmap.c:1535 do_mmap_pgoff include/linux/mm.h:2298 [inline] vm_mmap_pgoff+0x17f/0x1e0 mm/util.c:357 ksys_mmap_pgoff+0x250/0x5a0 mm/mmap.c:1585 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 3770: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1371 [inline] slab_free_freelist_hook mm/slub.c:1398 [inline] slab_free mm/slub.c:2953 [inline] kmem_cache_free+0xc7/0x290 mm/slub.c:2969 vm_area_free+0x13/0x20 kernel/fork.c:334 remove_vma+0xf5/0x130 mm/mmap.c:185 exit_mmap+0x2ce/0x450 mm/mmap.c:3104 __mmput kernel/fork.c:1001 [inline] mmput kernel/fork.c:1022 [inline] mmput+0xc7/0x330 kernel/fork.c:1017 exit_mm kernel/exit.c:545 [inline] do_exit+0x8fd/0x2a80 kernel/exit.c:854 do_group_exit+0xf1/0x2b0 kernel/exit.c:970 __do_sys_exit_group kernel/exit.c:981 [inline] __se_sys_exit_group kernel/exit.c:979 [inline] __x64_sys_exit_group+0x39/0x40 kernel/exit.c:979 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff8800a9f3c800 which belongs to the cache vm_area_struct of size 192 The buggy address is located 11 bytes to the right of 192-byte region [ffff8800a9f3c800, ffff8800a9f3c8c0) The buggy address belongs to the page: page:ffffea0002a7cf00 count:1 mapcount:0 mapping:ffff88013bf5e800 index:0x0 flags: 0xfff00000000100(slab) raw: 00fff00000000100 dead000000000100 dead000000000200 ffff88013bf5e800 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page allocated via order 0, migratetype Unmovable, gfp_mask 0x6212c0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:1906 [inline] prep_new_page mm/page_alloc.c:1914 [inline] get_page_from_freelist+0x2c68/0x41c0 mm/page_alloc.c:3345 __alloc_pages_nodemask+0x390/0x2380 mm/page_alloc.c:4370 alloc_pages_current+0xfd/0x290 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] alloc_slab_page mm/slub.c:1438 [inline] allocate_slab mm/slub.c:1583 [inline] new_slab+0x49d/0x7f0 mm/slub.c:1654 new_slab_objects mm/slub.c:2417 [inline] ___slab_alloc+0x5b3/0x8e0 mm/slub.c:2569 __slab_alloc.isra.22+0x6a/0xa0 mm/slub.c:2609 slab_alloc_node mm/slub.c:2672 [inline] slab_alloc mm/slub.c:2714 [inline] kmem_cache_alloc+0x1ef/0x230 mm/slub.c:2719 vm_area_alloc+0x1b/0xf0 kernel/fork.c:315 mmap_region+0x761/0x13c0 mm/mmap.c:1732 do_mmap+0x673/0xe90 mm/mmap.c:1535 do_mmap_pgoff include/linux/mm.h:2298 [inline] vm_mmap_pgoff+0x17f/0x1e0 mm/util.c:357 ksys_mmap_pgoff+0x250/0x5a0 mm/mmap.c:1585 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Memory state around the buggy address: ffff8800a9f3c780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8800a9f3c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8800a9f3c880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8800a9f3c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800a9f3c980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================