================================================================== BUG: KASAN: use-after-free in lbmIODone+0xb69/0xed0 fs/jfs/jfs_logmgr.c:2206 Read of size 4 at addr ffff8880a99b0d08 by task ksoftirqd/0/9 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.1.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x86/0xca lib/dump_stack.c:113 print_address_description.cold.3+0x9/0x244 mm/kasan/report.c:187 kasan_report.cold.4+0x1b/0x35 mm/kasan/report.c:317 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131 lbmIODone+0xb69/0xed0 fs/jfs/jfs_logmgr.c:2206 bio_endio.part.10+0x352/0x640 block/bio.c:1861 bio_endio+0x9/0x10 block/bio.c:1828 req_bio_endio block/blk-core.c:196 [inline] blk_update_request+0x248/0x990 block/blk-core.c:1457 blk_mq_end_request+0x54/0x3d0 block/blk-mq.c:558 lo_complete_rq+0x1af/0x270 drivers/block/loop.c:485 blk_done_softirq+0x261/0x3f0 block/blk-softirq.c:37 __do_softirq+0x220/0x8b6 kernel/softirq.c:293 run_ksoftirqd kernel/softirq.c:655 [inline] run_ksoftirqd+0x30/0x50 kernel/softirq.c:647 smpboot_thread_fn+0x56b/0x870 kernel/smpboot.c:164 kthread+0x327/0x3f0 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Allocated by task 7093: save_stack mm/kasan/common.c:75 [inline] set_track mm/kasan/common.c:87 [inline] __kasan_kmalloc.part.0+0x66/0x100 mm/kasan/common.c:497 __kasan_kmalloc.constprop.1+0xb1/0xc0 mm/kasan/common.c:478 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:511 kmem_cache_alloc_trace+0x127/0x2d0 mm/slub.c:2783 kmalloc include/linux/slab.h:545 [inline] lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline] lmLogInit+0x45a/0x17e0 fs/jfs/jfs_logmgr.c:1292 open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline] lmLogOpen+0x56b/0x1250 fs/jfs/jfs_logmgr.c:1090 jfs_mount_rw+0x2cb/0x570 fs/jfs/jfs_mount.c:271 jfs_fill_super+0x7f7/0xba0 fs/jfs/super.c:598 mount_bdev+0x272/0x330 fs/super.c:1346 jfs_do_mount+0x10/0x20 fs/jfs/super.c:703 legacy_get_tree+0xeb/0x1d0 fs/fs_context.c:584 vfs_get_tree+0x102/0x400 fs/super.c:1481 do_new_mount fs/namespace.c:2622 [inline] do_mount+0x10f7/0x2ae0 fs/namespace.c:2942 ksys_mount+0xb1/0xd0 fs/namespace.c:3151 __do_sys_mount fs/namespace.c:3165 [inline] __se_sys_mount fs/namespace.c:3162 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3162 do_syscall_64+0x9f/0x440 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4347: save_stack mm/kasan/common.c:75 [inline] set_track mm/kasan/common.c:87 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/common.c:459 kasan_slab_free+0xe/0x10 mm/kasan/common.c:467 slab_free_hook mm/slub.c:1429 [inline] slab_free_freelist_hook mm/slub.c:1456 [inline] slab_free mm/slub.c:3003 [inline] kfree+0xf2/0x320 mm/slub.c:3955 lbmLogShutdown+0xb6/0xf0 fs/jfs/jfs_logmgr.c:1885 lmLogShutdown+0x3e8/0x520 fs/jfs/jfs_logmgr.c:1705 lmLogClose+0x4ae/0x690 fs/jfs/jfs_logmgr.c:1481 jfs_umount+0x29f/0x3a0 fs/jfs/jfs_umount.c:129 jfs_put_super+0x6e/0x170 fs/jfs/super.c:223 generic_shutdown_super+0x130/0x330 fs/super.c:458 kill_block_super+0x96/0xe0 fs/super.c:1373 deactivate_locked_super+0x7c/0xd0 fs/super.c:331 deactivate_super fs/super.c:362 [inline] deactivate_super+0x13f/0x160 fs/super.c:358 cleanup_mnt+0xa3/0x140 fs/namespace.c:1119 __cleanup_mnt+0xd/0x10 fs/namespace.c:1126 task_work_run+0x10e/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x129/0x150 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x3a0/0x440 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a99b0d00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 8 bytes inside of 192-byte region [ffff8880a99b0d00, ffff8880a99b0dc0) The buggy address belongs to the page: page:ffffea0002a66c00 count:1 mapcount:0 mapping:ffff88813ff35000 index:0x0 flags: 0xfff00000000200(slab) raw: 00fff00000000200 ffffea0002ce3100 0000000300000003 ffff88813ff35000 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2007 [inline] prep_new_page+0x26c/0x310 mm/page_alloc.c:2015 get_page_from_freelist.part.21+0xfcf/0x4280 mm/page_alloc.c:3559 get_page_from_freelist mm/page_alloc.c:3449 [inline] __alloc_pages_nodemask+0x2a6/0x25f0 mm/page_alloc.c:4602 alloc_pages_current+0xd6/0x1b0 mm/mempolicy.c:2106 alloc_pages include/linux/gfp.h:509 [inline] alloc_slab_page mm/slub.c:1497 [inline] allocate_slab mm/slub.c:1642 [inline] new_slab+0x44e/0x700 mm/slub.c:1714 new_slab_objects mm/slub.c:2468 [inline] ___slab_alloc+0x57b/0x8d0 mm/slub.c:2619 __slab_alloc.isra.23+0x4f/0x80 mm/slub.c:2659 slab_alloc_node mm/slub.c:2722 [inline] slab_alloc mm/slub.c:2764 [inline] __kmalloc+0x2a2/0x320 mm/slub.c:3795 kmalloc include/linux/slab.h:550 [inline] kzalloc include/linux/slab.h:740 [inline] lsm_cred_alloc.isra.1+0x24/0xa0 security/security.c:467 security_prepare_creds+0x25/0xb0 security/security.c:1504 prepare_creds+0x24f/0x2d0 kernel/cred.c:280 copy_creds+0x70/0x430 kernel/cred.c:346 copy_process.part.4+0x9e6/0x7670 kernel/fork.c:1785 copy_process kernel/fork.c:1709 [inline] _do_fork+0x159/0xb10 kernel/fork.c:2226 __ia32_sys_vfork+0x1a/0x20 kernel/fork.c:2304 do_syscall_64+0x9f/0x440 arch/x86/entry/common.c:290 Memory state around the buggy address: ffff8880a99b0c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a99b0c80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a99b0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a99b0d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880a99b0e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================