el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
BUG: KASAN: use-after-free in jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
Read of size 4 at addr ffff0000f022bc28 by task syz.0.243/5050

CPU: 0 PID: 5050 Comm: syz.0.243 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
 jffs2_do_clear_inode+0x58/0x348 fs/jffs2/readinode.c:1418
 jffs2_evict_inode+0x7c/0x90 fs/jffs2/fs.c:250
 evict+0x3d8/0x824 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x728/0x7e8 fs/inode.c:1860
 jffs2_new_inode+0x358/0xa54 fs/jffs2/fs.c:-1
 jffs2_create+0x88/0x288 fs/jffs2/dir.c:180
 lookup_open fs/namei.c:3533 [inline]
 open_last_lookups fs/namei.c:3601 [inline]
 path_openat+0xda8/0x27a0 fs/namei.c:3831
 do_filp_open+0x198/0x38c fs/namei.c:3861
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4702:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x430 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x234/0x310 mm/slub.c:3383
 jffs2_alloc_inode_cache+0x20/0x2c fs/jffs2/malloc.c:265
 jffs2_scan_make_ino_cache+0x8c/0x1c0 fs/jffs2/scan.c:978
 jffs2_sum_process_sum_data fs/jffs2/summary.c:467 [inline]
 jffs2_sum_scan_sumnode+0x5ec/0x20d0 fs/jffs2/summary.c:640
 jffs2_scan_eraseblock fs/jffs2/scan.c:546 [inline]
 jffs2_scan_medium+0x610/0x5bc8 fs/jffs2/scan.c:151
 jffs2_build_filesystem fs/jffs2/build.c:112 [inline]
 jffs2_do_mount_fs+0x5dc/0x1c28 fs/jffs2/build.c:416
 jffs2_do_fill_super+0x484/0xa20 fs/jffs2/fs.c:573
 jffs2_fill_super+0x258/0x28c fs/jffs2/super.c:289
 mtd_get_sb+0xc4/0x2a0 drivers/mtd/mtdsuper.c:80
 mtd_get_sb_by_nr+0x94/0xb0 drivers/mtd/mtdsuper.c:111
 get_tree_mtd+0x4bc/0x61c drivers/mtd/mtdsuper.c:164
 jffs2_get_tree+0x28/0x38 fs/jffs2/super.c:294
 vfs_get_tree+0x90/0x278 fs/super.c:1584
 do_new_mount+0x228/0x804 fs/namespace.c:3078
 path_mount+0x5ac/0xe6c fs/namespace.c:3408
 do_mount fs/namespace.c:3421 [inline]
 __do_sys_mount fs/namespace.c:3629 [inline]
 __se_sys_mount fs/namespace.c:3606 [inline]
 __arm64_sys_mount+0x4a0/0x5a0 fs/namespace.c:3606
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000f022bc00
 which belongs to the cache jffs2_inode_cache of size 48
The buggy address is located 40 bytes inside of
 48-byte region [ffff0000f022bc00, ffff0000f022bc30)

The buggy address belongs to the physical page:
page:00000000e2ebaa61 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000f022bfc0 pfn:0x13022b
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc0003a4bcc8 fffffc0003b81f48 ffff0000c4cb7b00
raw: ffff0000f022bfc0 0000000000400001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f022bb00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bb80: fa fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
>ffff0000f022bc00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
                                  ^
 ffff0000f022bc80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bd00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
==================================================================