[v6.6] KASAN: use-after-free Read in leaf_paste_in_buffer
1 view
Skip to first unread message
syzbot
Jul 9, 2025, 10:00:34 AM7/9/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a5df3a702b2c Linux 6.6.96
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=118f2a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2632deddafa957e8
dashboard link: https://syzkaller.appspot.com/bug?extid=ef4ab278e3f74d7865eb
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9ba5b19f9f4d/disk-a5df3a70.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2cd779015729/vmlinux-a5df3a70.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b56fc39e5cb8/bzImage-a5df3a70.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ef4ab2...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
Read of size 48 at addr ffff88804f904ff0 by task syz.4.450/7988
CPU: 1 PID: 7988 Comm: syz.4.450 Not tainted 6.6.96-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x230 mm/kasan/report.c:475
kasan_report+0x117/0x150 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
leaf_copy_dir_entries+0x5e7/0x990 fs/reiserfs/lbalance.c:108
leaf_copy_boundary_item+0xb90/0x2180 fs/reiserfs/lbalance.c:168
leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
leaf_move_items+0x8b5/0xe90 fs/reiserfs/lbalance.c:726
leaf_shift_left+0xbd/0x450 fs/reiserfs/lbalance.c:750
balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline]
balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline]
balance_leaf+0x1dc1/0x10da0 fs/reiserfs/do_balan.c:1393
do_balance+0x2fe/0x940 fs/reiserfs/do_balan.c:1888
reiserfs_delete_solid_item+0x8b5/0xec0 fs/reiserfs/stree.c:1460
remove_save_link+0x25a/0x3c0 fs/reiserfs/super.c:540
reiserfs_truncate_file+0x561/0x7c0 fs/reiserfs/inode.c:2318
reiserfs_setattr+0xc0c/0x11a0 fs/reiserfs/inode.c:3392
notify_change+0xb0d/0xe10 fs/attr.c:499
do_truncate+0x19b/0x220 fs/open.c:66
vfs_truncate+0x266/0x300 fs/open.c:112
do_sys_truncate+0xe0/0x1a0 fs/open.c:135
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe851b8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe85291b038 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: ffffffffffffffda RBX: 00007fe851db6080 RCX: 00007fe851b8e929
RDX: 0000000000000000 RSI: 00000000003a6000 RDI: 0000200000000080
RBP: 00007fe851c10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fe851db6080 R15: 00007ffca04688c8
</TASK>
The buggy address belongs to the physical page:
page:ffffea00013e4100 refcount:2 mapcount:0 mapping:ffff88801fea58f8 index:0x215 pfn:0x4f904
memcg:ffff88807dde6000
aops:def_blk_aops ino:700004
flags: 0xfff50000008224(referenced|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff50000008224 ffffea0001573e88 ffffea00015d3308 ffff88801fea58f8
raw: 0000000000000215 ffff88805aeec740 00000002ffffffff ffff88807dde6000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 7989, tgid 7984 (syz.4.450), ts 221684318736, free_ts 221565809829
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
__filemap_get_folio+0x3ee/0xbc0 mm/filemap.c:1962
grow_dev_page fs/buffer.c:1058 [inline]
grow_buffers fs/buffer.c:1118 [inline]
__getblk_slow fs/buffer.c:1145 [inline]
__getblk_gfp+0x223/0x660 fs/buffer.c:1439
sb_getblk include/linux/buffer_head.h:344 [inline]
get_empty_nodes+0x515/0x8c0 fs/reiserfs/fix_node.c:890
fix_nodes+0x1e52/0x82e0 fs/reiserfs/fix_node.c:2663
reiserfs_insert_item+0x9a1/0xbe0 fs/reiserfs/stree.c:2238
reiserfs_new_inode+0xf67/0x17d0 fs/reiserfs/inode.c:2052
reiserfs_create+0x3be/0x680 fs/reiserfs/namei.c:666
lookup_open fs/namei.c:3488 [inline]
open_last_lookups fs/namei.c:3556 [inline]
path_openat+0x1277/0x3190 fs/namei.c:3786
do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
release_pages+0x1fa0/0x2220 mm/swap.c:1022
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x368/0x4f0 mm/mmu_gather.c:300
tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:392
unmap_region+0x2ed/0x340 mm/mmap.c:2345
do_vmi_align_munmap+0xffe/0x1660 mm/mmap.c:2588
do_vmi_munmap+0x252/0x2d0 mm/mmap.c:2656
__vm_munmap+0x193/0x3c0 mm/mmap.c:2957
__do_sys_munmap mm/mmap.c:2974 [inline]
__se_sys_munmap mm/mmap.c:2971 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:2971
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff88804f904f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88804f904f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88804f905000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804f905080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804f905100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: a5df3a702b2c Linux 6.6.96
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=118f2a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2632deddafa957e8
dashboard link: https://syzkaller.appspot.com/bug?extid=ef4ab278e3f74d7865eb
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9ba5b19f9f4d/disk-a5df3a70.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2cd779015729/vmlinux-a5df3a70.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b56fc39e5cb8/bzImage-a5df3a70.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ef4ab2...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
Read of size 48 at addr ffff88804f904ff0 by task syz.4.450/7988
CPU: 1 PID: 7988 Comm: syz.4.450 Not tainted 6.6.96-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x230 mm/kasan/report.c:475
kasan_report+0x117/0x150 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
leaf_copy_dir_entries+0x5e7/0x990 fs/reiserfs/lbalance.c:108
leaf_copy_boundary_item+0xb90/0x2180 fs/reiserfs/lbalance.c:168
leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
leaf_move_items+0x8b5/0xe90 fs/reiserfs/lbalance.c:726
leaf_shift_left+0xbd/0x450 fs/reiserfs/lbalance.c:750
balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline]
balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline]
balance_leaf+0x1dc1/0x10da0 fs/reiserfs/do_balan.c:1393
do_balance+0x2fe/0x940 fs/reiserfs/do_balan.c:1888
reiserfs_delete_solid_item+0x8b5/0xec0 fs/reiserfs/stree.c:1460
remove_save_link+0x25a/0x3c0 fs/reiserfs/super.c:540
reiserfs_truncate_file+0x561/0x7c0 fs/reiserfs/inode.c:2318
reiserfs_setattr+0xc0c/0x11a0 fs/reiserfs/inode.c:3392
notify_change+0xb0d/0xe10 fs/attr.c:499
do_truncate+0x19b/0x220 fs/open.c:66
vfs_truncate+0x266/0x300 fs/open.c:112
do_sys_truncate+0xe0/0x1a0 fs/open.c:135
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe851b8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe85291b038 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: ffffffffffffffda RBX: 00007fe851db6080 RCX: 00007fe851b8e929
RDX: 0000000000000000 RSI: 00000000003a6000 RDI: 0000200000000080
RBP: 00007fe851c10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fe851db6080 R15: 00007ffca04688c8
</TASK>
The buggy address belongs to the physical page:
page:ffffea00013e4100 refcount:2 mapcount:0 mapping:ffff88801fea58f8 index:0x215 pfn:0x4f904
memcg:ffff88807dde6000
aops:def_blk_aops ino:700004
flags: 0xfff50000008224(referenced|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff50000008224 ffffea0001573e88 ffffea00015d3308 ffff88801fea58f8
raw: 0000000000000215 ffff88805aeec740 00000002ffffffff ffff88807dde6000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 7989, tgid 7984 (syz.4.450), ts 221684318736, free_ts 221565809829
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
__filemap_get_folio+0x3ee/0xbc0 mm/filemap.c:1962
grow_dev_page fs/buffer.c:1058 [inline]
grow_buffers fs/buffer.c:1118 [inline]
__getblk_slow fs/buffer.c:1145 [inline]
__getblk_gfp+0x223/0x660 fs/buffer.c:1439
sb_getblk include/linux/buffer_head.h:344 [inline]
get_empty_nodes+0x515/0x8c0 fs/reiserfs/fix_node.c:890
fix_nodes+0x1e52/0x82e0 fs/reiserfs/fix_node.c:2663
reiserfs_insert_item+0x9a1/0xbe0 fs/reiserfs/stree.c:2238
reiserfs_new_inode+0xf67/0x17d0 fs/reiserfs/inode.c:2052
reiserfs_create+0x3be/0x680 fs/reiserfs/namei.c:666
lookup_open fs/namei.c:3488 [inline]
open_last_lookups fs/namei.c:3556 [inline]
path_openat+0x1277/0x3190 fs/namei.c:3786
do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
release_pages+0x1fa0/0x2220 mm/swap.c:1022
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x368/0x4f0 mm/mmu_gather.c:300
tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:392
unmap_region+0x2ed/0x340 mm/mmap.c:2345
do_vmi_align_munmap+0xffe/0x1660 mm/mmap.c:2588
do_vmi_munmap+0x252/0x2d0 mm/mmap.c:2656
__vm_munmap+0x193/0x3c0 mm/mmap.c:2957
__do_sys_munmap mm/mmap.c:2974 [inline]
__se_sys_munmap mm/mmap.c:2971 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:2971
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff88804f904f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88804f904f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88804f905000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804f905080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804f905100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 12, 2025, 5:45:33 AM8/12/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11232842580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=133815a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f06c672f5fa8/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9af9b7afcdc5/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/351a55aafa77/bzImage-3a8ababb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2f134c5ac8a7/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=135f45a2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ef4ab2...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
Read of size 48 at addr ffff88806b707ff0 by task syz.0.30/6009
CPU: 0 PID: 6009 Comm: syz.0.30 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
kasan_report+0x117/0x150 mm/kasan/report.c:581
balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline]
balance_leaf+0xc257/0x10da0 fs/reiserfs/do_balan.c:1393
do_balance+0x2fe/0x940 fs/reiserfs/do_balan.c:1888
reiserfs_cut_from_item+0x13b2/0x1f10 fs/reiserfs/stree.c:1836
reiserfs_do_truncate+0xa3d/0x1340 fs/reiserfs/stree.c:1971
reiserfs_truncate_file+0x37a/0x7c0 fs/reiserfs/inode.c:2306
do_open fs/namei.c:3636 [inline]
path_openat+0x298c/0x3190 fs/namei.c:3789
RAX: ffffffffffffffda RBX: 00007f54001b6180 RCX: 00007f53fff8ebe9
RDX: 0000000000000300 RSI: 0000200000000080 RDI: ffffffffffffff9c
RBP: 00007f5400011e19 R08: 0000000000000000 R09: 0000000000000000
memcg:ffff8880785c0000
aops:def_blk_aops ino:700000
flags: 0xfff58000008234(referenced|dirty|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff58000008234 ffffea00017bb788 ffffea00017ac908 ffff888148d00878
raw: 0000000000000334 ffff88805f55ce80 00000002ffffffff ffff8880785c0000
reiserfs_get_block+0x1bd3/0x3ed0 fs/reiserfs/inode.c:1069
__block_write_begin_int+0x566/0x1ad0 fs/buffer.c:2124
reiserfs_write_begin+0x20a/0x4c0 fs/reiserfs/inode.c:2771
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
generic_file_write_iter+0xaf/0x2e0 mm/filemap.c:4137
do_iter_readv_writev fs/read_write.c:-1 [inline]
do_iter_write+0x79a/0xc70 fs/read_write.c:860
folio_batch_release include/linux/pagevec.h:83 [inline]
truncate_inode_pages_range+0x358/0xf00 mm/truncate.c:371
kill_bdev block/bdev.c:76 [inline]
blkdev_flush_mapping+0x132/0x290 block/bdev.c:632
blkdev_put_whole block/bdev.c:663 [inline]
blkdev_put+0x498/0x760 block/bdev.c:941
bdev_release+0x57/0x70 block/bdev.c:951
deactivate_locked_super+0x97/0x100 fs/super.c:481
cleanup_mnt+0x429/0x4c0 fs/namespace.c:1250
task_work_run+0x1ce/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
ffff88806b707f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88806b708000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88806b708080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88806b708100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11232842580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=ef4ab278e3f74d7865eb
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13cd75bc580000
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=133815a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f06c672f5fa8/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9af9b7afcdc5/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/351a55aafa77/bzImage-3a8ababb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2f134c5ac8a7/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=135f45a2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ef4ab2...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
CPU: 0 PID: 6009 Comm: syz.0.30 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x220 mm/kasan/report.c:468
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
kasan_report+0x117/0x150 mm/kasan/report.c:581
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
leaf_copy_dir_entries+0x5e7/0x990 fs/reiserfs/lbalance.c:108
leaf_copy_boundary_item+0xb90/0x2180 fs/reiserfs/lbalance.c:168
leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
leaf_move_items+0x8b5/0xe90 fs/reiserfs/lbalance.c:726
balance_leaf_when_delete_left fs/reiserfs/do_balan.c:167 [inline]
kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
leaf_paste_in_buffer+0x6a1/0xbd0 fs/reiserfs/lbalance.c:-1
leaf_copy_dir_entries+0x5e7/0x990 fs/reiserfs/lbalance.c:108
leaf_copy_boundary_item+0xb90/0x2180 fs/reiserfs/lbalance.c:168
leaf_copy_items fs/reiserfs/lbalance.c:551 [inline]
leaf_move_items+0x8b5/0xe90 fs/reiserfs/lbalance.c:726
balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline]
balance_leaf+0xc257/0x10da0 fs/reiserfs/do_balan.c:1393
do_balance+0x2fe/0x940 fs/reiserfs/do_balan.c:1888
reiserfs_cut_from_item+0x13b2/0x1f10 fs/reiserfs/stree.c:1836
reiserfs_do_truncate+0xa3d/0x1340 fs/reiserfs/stree.c:1971
reiserfs_truncate_file+0x37a/0x7c0 fs/reiserfs/inode.c:2306
reiserfs_setattr+0xc0c/0x11a0 fs/reiserfs/inode.c:3392
notify_change+0xb0d/0xe10 fs/attr.c:499
do_truncate+0x19b/0x220 fs/open.c:66
handle_truncate fs/namei.c:3291 [inline]
notify_change+0xb0d/0xe10 fs/attr.c:499
do_truncate+0x19b/0x220 fs/open.c:66
do_open fs/namei.c:3636 [inline]
path_openat+0x298c/0x3190 fs/namei.c:3789
do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f53fff8ebe9
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f53ff5fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f54001b6180 RCX: 00007f53fff8ebe9
RDX: 0000000000000300 RSI: 0000200000000080 RDI: ffffffffffffff9c
RBP: 00007f5400011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f54001b6218 R14: 00007f54001b6180 R15: 00007ffd9b2d71c8
</TASK>
The buggy address belongs to the physical page:
page:ffffea0001adc1c0 refcount:2 mapcount:0 mapping:ffff888148d00878 index:0x334 pfn:0x6b707
The buggy address belongs to the physical page:
memcg:ffff8880785c0000
aops:def_blk_aops ino:700000
flags: 0xfff58000008234(referenced|dirty|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff58000008234 ffffea00017bb788 ffffea00017ac908 ffff888148d00878
raw: 0000000000000334 ffff88805f55ce80 00000002ffffffff ffff8880785c0000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 6008, tgid 6005 (syz.0.30), ts 87763469873, free_ts 85861615908
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
__filemap_get_folio+0x3ee/0xbc0 mm/filemap.c:1962
grow_dev_page fs/buffer.c:1058 [inline]
grow_buffers fs/buffer.c:1118 [inline]
__getblk_slow fs/buffer.c:1145 [inline]
__getblk_gfp+0x223/0x660 fs/buffer.c:1439
sb_getblk include/linux/buffer_head.h:344 [inline]
get_empty_nodes+0x515/0x8c0 fs/reiserfs/fix_node.c:890
fix_nodes+0x1e52/0x82e0 fs/reiserfs/fix_node.c:2663
reiserfs_paste_into_item+0x5ce/0x7f0 fs/reiserfs/stree.c:2128
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
__filemap_get_folio+0x3ee/0xbc0 mm/filemap.c:1962
grow_dev_page fs/buffer.c:1058 [inline]
grow_buffers fs/buffer.c:1118 [inline]
__getblk_slow fs/buffer.c:1145 [inline]
__getblk_gfp+0x223/0x660 fs/buffer.c:1439
sb_getblk include/linux/buffer_head.h:344 [inline]
get_empty_nodes+0x515/0x8c0 fs/reiserfs/fix_node.c:890
fix_nodes+0x1e52/0x82e0 fs/reiserfs/fix_node.c:2663
reiserfs_get_block+0x1bd3/0x3ed0 fs/reiserfs/inode.c:1069
__block_write_begin_int+0x566/0x1ad0 fs/buffer.c:2124
reiserfs_write_begin+0x20a/0x4c0 fs/reiserfs/inode.c:2771
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
generic_file_write_iter+0xaf/0x2e0 mm/filemap.c:4137
do_iter_readv_writev fs/read_write.c:-1 [inline]
do_iter_write+0x79a/0xc70 fs/read_write.c:860
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
release_pages+0x1fa0/0x2220 mm/swap.c:1022
__folio_batch_release+0x71/0xe0 mm/swap.c:1042
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
release_pages+0x1fa0/0x2220 mm/swap.c:1022
folio_batch_release include/linux/pagevec.h:83 [inline]
truncate_inode_pages_range+0x358/0xf00 mm/truncate.c:371
kill_bdev block/bdev.c:76 [inline]
blkdev_flush_mapping+0x132/0x290 block/bdev.c:632
blkdev_put_whole block/bdev.c:663 [inline]
blkdev_put+0x498/0x760 block/bdev.c:941
bdev_release+0x57/0x70 block/bdev.c:951
deactivate_locked_super+0x97/0x100 fs/super.c:481
cleanup_mnt+0x429/0x4c0 fs/namespace.c:1250
task_work_run+0x1ce/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff88806b707f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Memory state around the buggy address:
ffff88806b707f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88806b708000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88806b708080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88806b708100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages