[v6.6] KASAN: use-after-free Read in reiserfs_release_objectid

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1e89a1be4fe9 Linux 6.6.117
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=111bb912580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=aded4eb8ededd7e4b280
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ad3647e47b66/disk-1e89a1be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d6f7ba94aea7/vmlinux-1e89a1be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e08af2290355/bzImage-1e89a1be.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aded4e...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in reiserfs_release_objectid+0x575/0x820 fs/reiserfs/objectid.c:165
Read of size 8188 at addr ffff88805a4f1050 by task syz.4.254/7842

CPU: 1 PID: 7842 Comm: syz.4.254 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x220 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
__asan_memmove+0x29/0x70 mm/kasan/shadow.c:94
reiserfs_release_objectid+0x575/0x820 fs/reiserfs/objectid.c:165
remove_save_link+0x2ba/0x3c0 fs/reiserfs/super.c:542
reiserfs_evict_inode+0x395/0x490 fs/reiserfs/inode.c:91
evict+0x486/0x870 fs/inode.c:705
__dentry_kill+0x431/0x650 fs/dcache.c:611
dentry_kill+0xb8/0x290 fs/dcache.c:-1
dput+0xfe/0x1e0 fs/dcache.c:918
__fput+0x5e5/0x970 fs/file_table.c:392
task_work_run+0x1ce/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f79b3b8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc53b2308 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f79b3de7da0 RCX: 00007f79b3b8f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f79b3de7da0 R08: 0000000000000150 R09: 00000013c53b25ff
R10: 00007f79b3de7cb0 R11: 0000000000000246 R12: 000000000002baea
R13: 00007ffdc53b2400 R14: ffffffffffffffff R15: 00007ffdc53b2420
</TASK>

The buggy address belongs to the physical page:
page:ffffea0001693c40 refcount:2 mapcount:0 mapping:ffff88801fe27b78 index:0x10 pfn:0x5a4f1
memcg:ffff88807be7e000
aops:def_blk_aops ino:700004
flags: 0xfff5800002822c(referenced|uptodate|lru|workingset|private|mappedtodisk|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff5800002822c ffffea0001dd5d88 ffffea0001dc8f88 ffff88801fe27b78
raw: 0000000000000010 ffff888059627910 00000002ffffffff ffff88807be7e000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 7846, tgid 7842 (syz.4.254), ts 178088601152, free_ts 178063478799
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
__filemap_get_folio+0x3ee/0xbc0 mm/filemap.c:1962
grow_dev_page fs/buffer.c:1058 [inline]
grow_buffers fs/buffer.c:1118 [inline]
__getblk_slow fs/buffer.c:1145 [inline]
__getblk_gfp+0x223/0x660 fs/buffer.c:1439
__bread_gfp+0x2a/0x330 fs/buffer.c:1473
sb_bread include/linux/buffer_head.h:326 [inline]
read_super_block+0x91/0x7c0 fs/reiserfs/super.c:1604
reiserfs_fill_super+0x7a2/0x2340 fs/reiserfs/super.c:1966
mount_bdev+0x22b/0x2d0 fs/super.c:1643
legacy_get_tree+0xea/0x180 fs/fs_context.c:662
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3386
do_mount fs/namespace.c:3726 [inline]
__do_sys_mount fs/namespace.c:3935 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3912
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
release_pages+0x1fa0/0x2220 mm/swap.c:1022
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x368/0x4f0 mm/mmu_gather.c:300
tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:392
unmap_region+0x2ed/0x340 mm/mmap.c:2349
do_vmi_align_munmap+0xffe/0x1660 mm/mmap.c:2592
do_vmi_munmap+0x252/0x2d0 mm/mmap.c:2660
__vm_munmap+0x193/0x3c0 mm/mmap.c:2961
__do_sys_munmap mm/mmap.c:2978 [inline]
__se_sys_munmap mm/mmap.c:2975 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:2975
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
ffff88805a4f1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88805a4f1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88805a4f2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88805a4f2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88805a4f2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup