IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
==================================================================
BUG: KASAN: use-after-free in diWrite+0x90e/0x12a0 fs/jfs/jfs_imap.c:764
Write of size 32 at addr ffff8801e23cb0c0 by task syz.2.15/4732

CPU: 0 PID: 4732 Comm: syz.2.15 Not tainted 4.19.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x10c/0x17a lib/dump_stack.c:113
 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13c/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x37/0x50 mm/kasan/kasan.c:303
 diWrite+0x90e/0x12a0 fs/jfs/jfs_imap.c:764
 txCommit+0x55f/0x4020 fs/jfs/jfs_txnmgr.c:1263
 add_missing_indices fs/jfs/jfs_dtree.c:2967 [inline]
 jfs_readdir+0x23b2/0x3af0 fs/jfs/jfs_dtree.c:3315
 iterate_dir+0x1b0/0x5f0 fs/readdir.c:53
 ksys_getdents64+0x102/0x1d0 fs/readdir.c:314
 __do_sys_getdents64 fs/readdir.c:333 [inline]
 __se_sys_getdents64 fs/readdir.c:330 [inline]
 __x64_sys_getdents64+0x6e/0xb0 fs/readdir.c:330
 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fbfe53f3819
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbfe4e74038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007fbfe55aafa0 RCX: 00007fbfe53f3819
RDX: 0000000000001000 RSI: 00000000200038c0 RDI: 0000000000000005
RBP: 00007fbfe546675e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fbfe55aafa0 R15: 00007ffd1a2f4258

Allocated by task 21:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc_node mm/slub.c:2706 [inline]
 kmem_cache_alloc_node+0xe2/0x240 mm/slub.c:2742
 __alloc_skb+0xa7/0x580 net/core/skbuff.c:193
 alloc_skb include/linux/skbuff.h:995 [inline]
 nlmsg_new include/net/netlink.h:511 [inline]
 inet_netconf_notify_devconf+0x83/0x140 net/ipv4/devinet.c:1906
 __devinet_sysctl_unregister.isra.8+0x75/0xa0 net/ipv4/devinet.c:2362
 devinet_sysctl_unregister+0x8d/0xe0 net/ipv4/devinet.c:2386
 inetdev_destroy net/ipv4/devinet.c:311 [inline]
 inetdev_event+0x61a/0x1030 net/ipv4/devinet.c:1536
 notifier_call_chain+0xce/0x150 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401
 call_netdevice_notifiers_info net/core/dev.c:1733 [inline]
 call_netdevice_notifiers+0x7b/0xa0 net/core/dev.c:1751
 rollback_registered_many+0x7b2/0xcb0 net/core/dev.c:7976
 unregister_netdevice_many+0x3e/0x1f0 net/core/dev.c:9081
 ip6gre_exit_batch_net+0x2d2/0x3f0 net/ipv6/ip6_gre.c:1612
 ops_exit_list.isra.3+0xd9/0x130 net/core/net_namespace.c:156
 cleanup_net+0x363/0x840 net/core/net_namespace.c:551
 process_one_work+0x78b/0x1330 kernel/workqueue.c:2153
 worker_thread+0x375/0x9e0 kernel/workqueue.c:2296
 kthread+0x2f2/0x3b0 kernel/kthread.c:246
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:413

Freed by task 21:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1371 [inline]
 slab_free_freelist_hook mm/slub.c:1398 [inline]
 slab_free mm/slub.c:2953 [inline]
 kmem_cache_free+0xc7/0x240 mm/slub.c:2969
 kfree_skbmem+0x89/0xf0 net/core/skbuff.c:582
 __kfree_skb net/core/skbuff.c:642 [inline]
 consume_skb+0xb7/0x1d0 net/core/skbuff.c:701
 netlink_broadcast_filtered+0x288/0x910 net/netlink/af_netlink.c:1519
 netlink_broadcast+0xe/0x10 net/netlink/af_netlink.c:1541
 nlmsg_multicast include/net/netlink.h:591 [inline]
 nlmsg_notify+0x107/0x140 net/netlink/af_netlink.c:2497
 rtnl_notify+0x86/0xe0 net/core/rtnetlink.c:736
 inet_netconf_notify_devconf+0xcb/0x140 net/ipv4/devinet.c:1918
 __devinet_sysctl_unregister.isra.8+0x75/0xa0 net/ipv4/devinet.c:2362
 devinet_sysctl_unregister+0x8d/0xe0 net/ipv4/devinet.c:2386
 inetdev_destroy net/ipv4/devinet.c:311 [inline]
 inetdev_event+0x61a/0x1030 net/ipv4/devinet.c:1536
 notifier_call_chain+0xce/0x150 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401
 call_netdevice_notifiers_info net/core/dev.c:1733 [inline]
 call_netdevice_notifiers+0x7b/0xa0 net/core/dev.c:1751
 rollback_registered_many+0x7b2/0xcb0 net/core/dev.c:7976
 unregister_netdevice_many+0x3e/0x1f0 net/core/dev.c:9081
 ip6gre_exit_batch_net+0x2d2/0x3f0 net/ipv6/ip6_gre.c:1612
 ops_exit_list.isra.3+0xd9/0x130 net/core/net_namespace.c:156
 cleanup_net+0x363/0x840 net/core/net_namespace.c:551
 process_one_work+0x78b/0x1330 kernel/workqueue.c:2153
 worker_thread+0x375/0x9e0 kernel/workqueue.c:2296
 kthread+0x2f2/0x3b0 kernel/kthread.c:246
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:413

The buggy address belongs to the object at ffff8801e23cb000
 which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 192 bytes inside of
 232-byte region [ffff8801e23cb000, ffff8801e23cb0e8)
The buggy address belongs to the page:
page:ffffea000788f2c0 count:1 mapcount:0 mapping:ffff8801f42dca00 index:0x0
flags: 0x100000000000100(slab)
raw: 0100000000000100 ffffea000788f0c0 0000000700000007 ffff8801f42dca00
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page allocated via order 0, migratetype Unmovable, gfp_mask 0x6012c0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:1906 [inline]
 prep_new_page mm/page_alloc.c:1914 [inline]
 get_page_from_freelist+0x2c01/0x4060 mm/page_alloc.c:3345
 __alloc_pages_nodemask+0x390/0x2300 mm/page_alloc.c:4370
 alloc_pages_current+0xfd/0x290 mm/mempolicy.c:2093
 alloc_pages include/linux/gfp.h:509 [inline]
 alloc_slab_page mm/slub.c:1438 [inline]
 allocate_slab mm/slub.c:1583 [inline]
 new_slab+0x458/0x7d0 mm/slub.c:1654
 new_slab_objects mm/slub.c:2417 [inline]
 ___slab_alloc+0x600/0x890 mm/slub.c:2569
 __slab_alloc+0x2f/0x60 mm/slub.c:2609
 slab_alloc_node mm/slub.c:2672 [inline]
 kmem_cache_alloc_node+0xb6/0x240 mm/slub.c:2742
 __alloc_skb+0xa7/0x580 net/core/skbuff.c:193
 alloc_skb include/linux/skbuff.h:995 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline]
 netlink_sendmsg+0x961/0xc00 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xae/0xf0 net/socket.c:631
 ___sys_sendmsg+0x649/0x950 net/socket.c:2116
 __sys_sendmsg+0xd9/0x180 net/socket.c:2154
 __do_sys_sendmsg net/socket.c:2163 [inline]
 __se_sys_sendmsg net/socket.c:2161 [inline]
 __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2161
 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8801e23caf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801e23cb000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801e23cb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
                                           ^
 ffff8801e23cb100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff8801e23cb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================