ocfs2: Unmounting device (7,0) on (node local) JBD2: Ignoring recovery information on journal ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. (syz.1.21,5222,0):ocfs2_fill_super:1114 ERROR: Unable to create per-mount debugfs root. ================================================================== BUG: KASAN: use-after-free in ocfs2_replay_truncate_records fs/ocfs2/alloc.c:5972 [inline] BUG: KASAN: use-after-free in __ocfs2_flush_truncate_log+0xbc6/0xd50 fs/ocfs2/alloc.c:6051 Read of size 4 at addr ffff8800a49202b8 by task syz-executor/4092 CPU: 0 PID: 4092 Comm: syz-executor Not tainted 4.19.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x10c/0x17a lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 ocfs2_replay_truncate_records fs/ocfs2/alloc.c:5972 [inline] __ocfs2_flush_truncate_log+0xbc6/0xd50 fs/ocfs2/alloc.c:6051 ocfs2_flush_truncate_log+0x47/0x70 fs/ocfs2/alloc.c:6073 ocfs2_sync_fs+0x1b1/0x350 fs/ocfs2/super.c:419 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem fs/sync.c:67 [inline] sync_filesystem+0x162/0x1f0 fs/sync.c:48 generic_shutdown_super+0x69/0x330 fs/super.c:442 kill_block_super+0x96/0xd0 fs/super.c:1185 deactivate_locked_super+0x7c/0xd0 fs/super.c:329 deactivate_super fs/super.c:360 [inline] deactivate_super+0x13f/0x160 fs/super.c:356 cleanup_mnt+0x97/0x120 fs/namespace.c:1098 __cleanup_mnt+0xd/0x10 fs/namespace.c:1105 task_work_run+0x10e/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x18a/0x200 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x2bf/0x340 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f8c9272e327 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe573f5918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007f8c9279f134 RCX: 00007f8c9272e327 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe573f59d0 RBP: 00007ffe573f59d0 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe573f6a50 R13: 00007f8c9279f134 R14: 00000000000105c2 R15: 00007ffe573f6a90 Allocated by task 5036: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:444 [inline] slab_alloc_node mm/slub.c:2706 [inline] slab_alloc mm/slub.c:2714 [inline] kmem_cache_alloc+0xdc/0x230 mm/slub.c:2719 kmem_cache_zalloc include/linux/slab.h:697 [inline] __alloc_file+0x2b/0x280 fs/file_table.c:100 alloc_empty_file+0x45/0x110 fs/file_table.c:150 path_openat+0x101/0x2870 fs/namei.c:3523 do_filp_open+0x177/0x250 fs/namei.c:3564 do_sys_open+0x1dc/0x350 fs/open.c:1063 __do_sys_openat fs/open.c:1090 [inline] __se_sys_openat fs/open.c:1084 [inline] __x64_sys_openat+0x98/0xf0 fs/open.c:1084 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 17: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1371 [inline] slab_free_freelist_hook mm/slub.c:1398 [inline] slab_free mm/slub.c:2953 [inline] kmem_cache_free+0xc7/0x290 mm/slub.c:2969 file_free_rcu+0x51/0x70 fs/file_table.c:49 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch kernel/rcu/tree.c:2576 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline] rcu_process_callbacks+0x5be/0xfe0 kernel/rcu/tree.c:2864 __do_softirq+0x200/0x69d kernel/softirq.c:292 The buggy address belongs to the object at ffff8800a4920280 which belongs to the cache filp of size 456 The buggy address is located 56 bytes inside of 456-byte region [ffff8800a4920280, ffff8800a4920448) The buggy address belongs to the page: page:ffffea0002924800 count:1 mapcount:0 mapping:ffff88013beada00 index:0x0 compound_mapcount: 0 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 0000000000000000 0000000300000001 ffff88013beada00 (syz.1.21,5222,1):ocfs2_fill_super:1225 ERROR: status = -22 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page allocated via order 1, migratetype Unmovable, gfp_mask 0x352c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:1906 [inline] prep_new_page mm/page_alloc.c:1914 [inline] get_page_from_freelist+0x2c68/0x41c0 mm/page_alloc.c:3345 __alloc_pages_nodemask+0x390/0x2380 mm/page_alloc.c:4370 alloc_pages_current+0xfd/0x290 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] alloc_slab_page mm/slub.c:1438 [inline] allocate_slab mm/slub.c:1583 [inline] new_slab+0x49d/0x7f0 mm/slub.c:1654 ocfs2: Unmounting device (7,1) on (node local) new_slab_objects mm/slub.c:2417 [inline] ___slab_alloc+0x5b3/0x8e0 mm/slub.c:2569 __slab_alloc.isra.22+0x6a/0xa0 mm/slub.c:2609 slab_alloc_node mm/slub.c:2672 [inline] slab_alloc mm/slub.c:2714 [inline] kmem_cache_alloc+0x1ef/0x230 mm/slub.c:2719 kmem_cache_zalloc include/linux/slab.h:697 [inline] __alloc_file+0x2b/0x280 fs/file_table.c:100 alloc_empty_file+0x45/0x110 fs/file_table.c:150 path_openat+0x101/0x2870 fs/namei.c:3523 do_filp_open+0x177/0x250 fs/namei.c:3564 do_sys_open+0x1dc/0x350 fs/open.c:1063 __do_sys_openat fs/open.c:1090 [inline] __se_sys_openat fs/open.c:1084 [inline] __x64_sys_openat+0x98/0xf0 fs/open.c:1084 do_syscall_64+0xd0/0x340 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Memory state around the buggy address: ffff8800a4920180: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc ffff8800a4920200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800a4920280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800a4920300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800a4920380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================