[v6.1] KASAN: out-of-bounds Read in leaf_insert_into_buf

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c2cbfe5f5122 Linux 6.1.51
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1744483fa80000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d4808acd84533b3
dashboard link: https://syzkaller.appspot.com/bug?extid=1d0e2d4c915a7e465985
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b0e4b18220c/disk-c2cbfe5f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/810364b9b0ad/vmlinux-c2cbfe5f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7be5b7edc358/Image-c2cbfe5f.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d0e2d...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: out-of-bounds in leaf_insert_into_buf+0x1f4/0x748 fs/reiserfs/lbalance.c:933
Read of size 18446744073709551384 at addr ffff000129088000 by task syz-executor.3/23736

CPU: 0 PID: 23736 Comm: syz-executor.3 Not tainted 6.1.51-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
memmove+0x48/0x90 mm/kasan/shadow.c:54
leaf_insert_into_buf+0x1f4/0x748 fs/reiserfs/lbalance.c:933
balance_leaf_new_nodes_insert fs/reiserfs/do_balan.c:1001 [inline]
balance_leaf_new_nodes fs/reiserfs/do_balan.c:1243 [inline]
balance_leaf+0x61f0/0xe860 fs/reiserfs/do_balan.c:1450
do_balance+0x27c/0x788 fs/reiserfs/do_balan.c:1888
reiserfs_insert_item+0x940/0xa84 fs/reiserfs/stree.c:2261
indirect2direct+0x58c/0xa40 fs/reiserfs/tail_conversion.c:283
maybe_indirect_to_direct fs/reiserfs/stree.c:1587 [inline]
reiserfs_cut_from_item+0x854/0x1c98 fs/reiserfs/stree.c:1694
reiserfs_do_truncate+0x89c/0x11c8 fs/reiserfs/stree.c:1973
reiserfs_truncate_file+0x510/0xb1c fs/reiserfs/inode.c:2310
reiserfs_truncate_failed_write fs/reiserfs/inode.c:2743 [inline]
reiserfs_write_end+0x640/0x800 fs/reiserfs/inode.c:2958
generic_perform_write+0x384/0x55c mm/filemap.c:3765
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3882
generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:3914
call_write_iter include/linux/fs.h:2205 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x914 fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

The buggy address belongs to the physical page:
page:00000000feb662b2 refcount:1 mapcount:1 mapping:0000000000000000 index:0xffff669fe pfn:0x169088
memcg:ffff0000c0930000
anon flags: 0x5ffe000000a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffe000000a0014 fffffc00043f57c8 fffffc0004a14ec8 ffff0000dca1b991
raw: 0000000ffff669fe 0000000000000000 0000000100000000 ffff0000c0930000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff000129087f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff000129087f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff000129088000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff000129088080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff000129088100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c2cbfe5f5122 Linux 6.1.51
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=134ca198680000

kernel config: https://syzkaller.appspot.com/x/.config?x=6d4808acd84533b3
dashboard link: https://syzkaller.appspot.com/bug?extid=1d0e2d4c915a7e465985
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e7d83fa80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1347bf70680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b0e4b18220c/disk-c2cbfe5f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/810364b9b0ad/vmlinux-c2cbfe5f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7be5b7edc358/Image-c2cbfe5f.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/f4d32b592d7e/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d0e2d...@syzkaller.appspotmail.com

REISERFS (device loop0): Using r5 hash to sort names
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.

==================================================================
BUG: KASAN: out-of-bounds in leaf_insert_into_buf+0x1f4/0x748 fs/reiserfs/lbalance.c:933

Read of size 18446744073709551384 at addr ffff0000e041a000 by task syz-executor150/4218

CPU: 1 PID: 4218 Comm: syz-executor150 Not tainted 6.1.51-syzkaller #0

page:0000000098bbccc5 refcount:1 mapcount:1 mapping:0000000000000000 index:0xffffffffd pfn:0x12041a

memcg:ffff0000c0930000
anon flags: 0x5ffe000000a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=2|lastcpupid=0x7ff)

raw: 05ffe000000a0014 fffffc0003804988 fffffc0003897ec8 ffff0000d7f51cc1
raw: 0000000ffffffffd 0000000000000000 0000000100000000 ffff0000c0930000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000e0419f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000e0419f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000e041a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff0000e041a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000e041a100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 4218 Comm: syz-executor150 Tainted: G B 6.1.51-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ma_dead_node lib/maple_tree.c:536 [inline]
pc : mtree_range_walk+0x1a0/0x674 lib/maple_tree.c:2972
lr : ma_pivots lib/maple_tree.c:630 [inline]
lr : mtree_range_walk+0x190/0x674 lib/maple_tree.c:2970
sp : ffff80001de159e0
x29: ffff80001de15a40 x28: 0000000000000000 x27: 0000000000000000
x26: 0000000000000001 x25: 0000000000000000 x24: 0000000000000000
x23: ffffffffffffffff x22: 0000000000000000 x21: ffff80001de15b68
x20: 0000000000000000 x19: dfff800000000000 x18: 1fffe000368adf76
x17: 0000000000000000 x16: ffff8000084fa0fc x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000003 x12: ffff0000ca47b780
x11: ff808000120a3014 x10: 0000000000000000 x9 : ffff8000120a3014
x8 : ffff0000ca47b780 x7 : 0000000000000000 x6 : ffff8000120c92a4
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000000 x1 : ffff8000181a0fe0 x0 : 0000000000000000
Call trace:
ma_dead_node lib/maple_tree.c:535 [inline]
mtree_range_walk+0x1a0/0x674 lib/maple_tree.c:2972
mas_state_walk lib/maple_tree.c:3900 [inline]
mt_find+0x5a0/0xa88 lib/maple_tree.c:6534
find_vma+0x138/0x1c0 mm/mmap.c:1874
lock_mm_and_find_vma+0x74/0x2e8 mm/memory.c:5339
do_page_fault+0x2d0/0x890 arch/arm64/mm/fault.c:577
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:803
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367
el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576
__memcpy+0x1e8/0x240 arch/arm64/lib/memcpy.S:220
0xffff80001de15fb0
Code: aa1f03f9 2a1f03f4 d343ff98 d50339bf (38736b08)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: aa1f03f9 mov x25, xzr
4: 2a1f03f4 mov w20, wzr
8: d343ff98 lsr x24, x28, #3
c: d50339bf dmb ishld
* 10: 38736b08 ldrb w8, [x24, x19] <-- trapping instruction


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.