syz.2.142: attempt to access beyond end of device
loop2: rw=0, sector=6491536, nr_sectors = 2 limit=128
Buffer I/O error on dev loop2, logical block 3245768, async page read
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7272 at fs/inode.c:464 inc_nlink+0x120/0x170 fs/inode.c:464
Modules linked in:
CPU: 0 UID: 0 PID: 7272 Comm: syz.2.142 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : inc_nlink+0x120/0x170 fs/inode.c:464
lr : inc_nlink+0x120/0x170 fs/inode.c:464
sp : ffff80009f187b80
x29: ffff80009f187b80 x28: 1fffe0001e43780c x27: dfff800000000000
x26: 0000000000000000 x25: 00000000000001c0 x24: 000000000000007e
x23: 1fffe0001e437810 x22: dfff800000000000 x21: 0000000000000000
x20: ffff0000f21bc038 x19: ffff0000f21bc080 x18: ffff80009f1873e0
x17: 0000000000032047 x16: ffff80008b7c7f00 x15: 0000000000000005
x14: 1ffff00013e30f48 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000080000 x10: 000000000001056d x9 : ffff8000a5d30000
x8 : 000000000001056e x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffff80009f187a20 x3 : 00000000000001c0
x2 : ffff0000da95a000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
inc_nlink+0x120/0x170 fs/inode.c:464 (P)
inode_inc_link_count include/linux/fs.h:2577 [inline]
sysv_mkdir+0x2c/0x138 fs/sysv/namei.c:119
vfs_mkdir+0x27c/0x410 fs/namei.c:4313
do_mkdirat+0x250/0x584 fs/namei.c:4336
__do_sys_mkdirat fs/namei.c:4351 [inline]
__se_sys_mkdirat fs/namei.c:4349 [inline]
__arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4349
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 3624
hardirqs last enabled at (3623): [<ffff800080bf9240>] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234
hardirqs last disabled at (3624): [<ffff80008b7c3e94>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488
softirqs last enabled at (2548): [<ffff8000803128a4>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last enabled at (2548): [<ffff8000803128a4>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (2409): [<ffff800080020dbc>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
==================================================================
BUG: KASAN: use-after-free in sysv_new_inode+0xd28/0xebc fs/sysv/ialloc.c:153
Read of size 2 at addr ffff0000f2ca51ce by task syz.2.142/7272
CPU: 0 UID: 0 PID: 7272 Comm: syz.2.142 Tainted: G W 6.14.0-rc7-syzkaller-ga2392f333575 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x198/0x550 mm/kasan/report.c:521
kasan_report+0xd8/0x138 mm/kasan/report.c:634
__asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379
sysv_new_inode+0xd28/0xebc fs/sysv/ialloc.c:153
sysv_mkdir+0x44/0x138 fs/sysv/namei.c:121
vfs_mkdir+0x27c/0x410 fs/namei.c:4313
do_mkdirat+0x250/0x584 fs/namei.c:4336
__do_sys_mkdirat fs/namei.c:4351 [inline]
__se_sys_mkdirat fs/namei.c:4349 [inline]
__arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4349
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
The buggy address belongs to the physical page:
page: refcount:2 mapcount:1 mapping:00000000c4cdef32 index:0x1ea pfn:0x132ca5
memcg:ffff0000d3d1c000
aops:shmem_aops ino:450 dentry name(?):"dev/zero"
flags: 0x5ffc0000002102c(referenced|uptodate|lru|arch_1|swapbacked|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc0000002102c fffffdffc3cb2908 fffffdffc3cb2988 ffff0000f08ddf10
raw: 00000000000001ea 0000000000000000 0000000200000000 ffff0000d3d1c000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000f2ca5080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000f2ca5100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000f2ca5180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff0000f2ca5200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000f2ca5280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
syz.2.142: attempt to access beyond end of device
loop2: rw=0, sector=6491536, nr_sectors = 2 limit=128
Buffer I/O error on dev loop2, logical block 3245768, async page read