gfs2: fsid=syz:syz.0: H: s:SH f:H e:0 p:5533 [syz-executor154] iterate_dir+0x1f4/0x4ec ================================================================== BUG: KASAN: stack-out-of-bounds in gfs2_dump_glock+0xfe4/0x1558 Read of size 8 at addr ffff800022ed7b00 by task syz-executor154/5518 CPU: 0 PID: 5518 Comm: syz-executor154 Not tainted 6.1.130-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:427 kasan_report+0xd4/0x130 mm/kasan/report.c:531 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351 gfs2_dump_glock+0xfe4/0x1558 gfs2_consist_inode_i+0xe8/0x10c fs/gfs2/util.c:467 gfs2_dirent_scan+0x458/0x584 fs/gfs2/dir.c:602 gfs2_dirent_search+0x28c/0x790 fs/gfs2/dir.c:850 gfs2_dir_search+0xb8/0x280 fs/gfs2/dir.c:1650 gfs2_lookupi+0x3cc/0x5a0 fs/gfs2/inode.c:323 __gfs2_lookup+0xb0/0x28c fs/gfs2/inode.c:870 gfs2_lookup+0x2c/0x3c fs/gfs2/inode.c:904 __lookup_slow+0x250/0x374 fs/namei.c:1690 lookup_slow+0x60/0x84 fs/namei.c:1707 walk_component+0x280/0x36c fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2479 filename_lookup+0x1d4/0x4e0 fs/namei.c:2508 user_path_at_empty+0x5c/0x84 fs/namei.c:2905 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3396 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __arm64_sys_mount+0x460/0x588 fs/namespace.c:3584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the virtual mapping at [ffff800022ed0000, ffff800022ed9000) created by: copy_process+0x530/0x38f8 kernel/fork.c:2096 The buggy address belongs to the physical page: page:000000003403ff6a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a544 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800022ed7a00: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 f2 ffff800022ed7a80: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff800022ed7b00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff800022ed7b80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 ffff800022ed7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 5518 Comm: syz-executor154 Tainted: G B 6.1.130-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : pid_is_meaningful fs/gfs2/glock.c:1466 [inline] pc : dump_holder fs/gfs2/glock.c:2326 [inline] pc : gfs2_dump_glock+0xa6c/0x1558 fs/gfs2/glock.c:2440 lr : rcu_read_lock include/linux/rcupdate.h:792 [inline] lr : dump_holder fs/gfs2/glock.c:2325 [inline] lr : gfs2_dump_glock+0xa04/0x1558 fs/gfs2/glock.c:2440 sp : ffff800022e56fe0 x29: ffff800022e572e0 x28: 0000000000000040 x27: ffff800022ed7b30 x26: 0000000000000021 x25: ffff800022e570c0 x24: 0000000000000001 x23: dfff800000000000 x22: ffff8000184e7000 x21: ffff800022e570e0 x20: 0000000000000000 x19: 0000000000000004 x18: 1fffe00036798576 x17: 0000000000000000 x16: ffff80001232a73c x15: 0000000000000000 x14: 00000000ffffffff x13: 00000000000207b8 x12: ffff800022e56ec0 x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a41ca00 x8 : ffff0000ca0ed340 x7 : 0000000000000000 x6 : ffff80000a42998c x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: pid_is_meaningful fs/gfs2/glock.c:1466 [inline] dump_holder fs/gfs2/glock.c:2326 [inline] gfs2_dump_glock+0xa6c/0x1558 fs/gfs2/glock.c:2440 gfs2_consist_inode_i+0xe8/0x10c fs/gfs2/util.c:467 gfs2_dirent_scan+0x458/0x584 fs/gfs2/dir.c:602 gfs2_dirent_search+0x28c/0x790 fs/gfs2/dir.c:850 gfs2_dir_search+0xb8/0x280 fs/gfs2/dir.c:1650 gfs2_lookupi+0x3cc/0x5a0 fs/gfs2/inode.c:323 __gfs2_lookup+0xb0/0x28c fs/gfs2/inode.c:870 gfs2_lookup+0x2c/0x3c fs/gfs2/inode.c:904 __lookup_slow+0x250/0x374 fs/namei.c:1690 lookup_slow+0x60/0x84 fs/namei.c:1707 walk_component+0x280/0x36c fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2479 filename_lookup+0x1d4/0x4e0 fs/namei.c:2508 user_path_at_empty+0x5c/0x84 fs/namei.c:2905 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3396 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __arm64_sys_mount+0x460/0x588 fs/namespace.c:3584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: 392e5a68 977bcf5e 9100831a d343ff53 (38f76a68) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 392e5a68 strb w8, [x19, #2966] 4: 977bcf5e bl 0xfffffffffdef3d7c 8: 9100831a add x26, x24, #0x20 c: d343ff53 lsr x19, x26, #3 * 10: 38f76a68 ldrsb w8, [x19, x23] <-- trapping instruction