==================================================================
BUG: KASAN: vmalloc-out-of-bounds in cleanup_bitmap_list+0x144/0x47c fs/reiserfs/journal.c:231
Read of size 8 at addr ffff80001bc50008 by task syz-executor/4585

CPU: 1 PID: 4585 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 dump_backtrace+0x0/0x458 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x78/0x30c mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xec/0x158 mm/kasan/report.c:451
 __asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
 cleanup_bitmap_list+0x144/0x47c fs/reiserfs/journal.c:231
 cleanup_freed_for_journal_list fs/reiserfs/journal.c:570 [inline]
 flush_commit_list+0x1128/0x1a88 fs/reiserfs/journal.c:1139
 flush_journal_list+0x264/0x1958 fs/reiserfs/journal.c:1388
 flush_used_journal_lists+0xfb0/0x12b4 fs/reiserfs/journal.c:1826
 do_journal_end+0x2db4/0x3a4c fs/reiserfs/journal.c:-1
 journal_end_sync+0x164/0x1c8 fs/reiserfs/journal.c:3535
 reiserfs_sync_fs+0xe0/0x170 fs/reiserfs/super.c:78
 sync_filesystem+0xe8/0x218 fs/sync.c:56
 generic_shutdown_super+0x74/0x2f8 fs/super.c:448
 kill_block_super+0x78/0xe0 fs/super.c:1427
 reiserfs_kill_sb+0x124/0x13c fs/reiserfs/super.c:570
 deactivate_locked_super+0xc0/0x13c fs/super.c:335
 deactivate_super+0xf0/0x110 fs/super.c:366
 cleanup_mnt+0x3bc/0x470 fs/namespace.c:1148
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1155
 task_work_run+0x13c/0x1e8 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x2488/0x30a8 arch/arm64/kernel/signal.c:949
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xf0/0x1d0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584


Memory state around the buggy address:
 ffff80001bc4ff00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff80001bc4ff80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffff80001bc50000: 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                      ^
 ffff80001bc50080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff80001bc50100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff80001bc51000
Mem abort info:
  ESR = 0x0000000096000007
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000007
  CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000210fd3000
[ffff80001bc51000] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=10000001023f2003, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4585 Comm: syz-executor Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : cleanup_bitmap_list+0x144/0x47c fs/reiserfs/journal.c:231
lr : cleanup_bitmap_list+0x144/0x47c fs/reiserfs/journal.c:231
sp : ffff80001fdf70f0
x29: ffff80001fdf7120 x28: 0000000000000201 x27: dfff800000000000
x26: ffff8000207492e0 x25: ffff0000c2e70678 x24: 0000000000000000
x23: ffff0000d7cc1000 x22: ffff80001bc51000 x21: ffff0000c2e70018
x20: 1ffff000040e925c x19: 0000000000000000 x18: 0000000000000002
x17: 0000000040000000 x16: ffff8000082dbd3c x15: 0000000000000002
x14: ffff700002d3a574 x13: 1ffff00002d3a574 x12: 0000000000000004
x11: ff80800008c3f5d8 x10: 0000000000000000 x9 : ffff80001b045250
x8 : 0000000000000001 x7 : 0000000000000000 x6 : ffff80000824ba6c
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008c3f39c
x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
 cleanup_bitmap_list+0x144/0x47c fs/reiserfs/journal.c:231
 cleanup_freed_for_journal_list fs/reiserfs/journal.c:570 [inline]
 flush_commit_list+0x1128/0x1a88 fs/reiserfs/journal.c:1139
 flush_journal_list+0x264/0x1958 fs/reiserfs/journal.c:1388
 flush_used_journal_lists+0xfb0/0x12b4 fs/reiserfs/journal.c:1826
 do_journal_end+0x2db4/0x3a4c fs/reiserfs/journal.c:-1
 journal_end_sync+0x164/0x1c8 fs/reiserfs/journal.c:3535
 reiserfs_sync_fs+0xe0/0x170 fs/reiserfs/super.c:78
 sync_filesystem+0xe8/0x218 fs/sync.c:56
 generic_shutdown_super+0x74/0x2f8 fs/super.c:448
 kill_block_super+0x78/0xe0 fs/super.c:1427
 reiserfs_kill_sb+0x124/0x13c fs/reiserfs/super.c:570
 deactivate_locked_super+0xc0/0x13c fs/super.c:335
 deactivate_super+0xf0/0x110 fs/super.c:366
 cleanup_mnt+0x3bc/0x470 fs/namespace.c:1148
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1155
 task_work_run+0x13c/0x1e8 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x2488/0x30a8 arch/arm64/kernel/signal.c:949
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xf0/0x1d0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 387b6908 34000068 aa1603e0 97f04132 (f94002d6) 
---[ end trace 0793918dd4c10221 ]---
----------------
Code disassembly (best guess):
   0:	387b6908 	ldrb	w8, [x8, x27]
   4:	34000068 	cbz	w8, 0x10
   8:	aa1603e0 	mov	x0, x22
   c:	97f04132 	bl	0xffffffffffc104d4
* 10:	f94002d6 	ldr	x22, [x22] <-- trapping instruction