================================================================== BUG: KASAN: use-after-free in leaf_paste_entries+0x49e/0x10e0 fs/reiserfs/lbalance.c:1362 Read of size 2 at addr ffff88805871100c by task syz.0.15/5914 CPU: 0 PID: 5914 Comm: syz.0.15 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xa8/0x210 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 leaf_paste_entries+0x49e/0x10e0 fs/reiserfs/lbalance.c:1362 leaf_copy_dir_entries+0x6ee/0x9e0 fs/reiserfs/lbalance.c:119 leaf_copy_boundary_item+0xb8c/0x21b0 fs/reiserfs/lbalance.c:168 leaf_copy_items fs/reiserfs/lbalance.c:551 [inline] leaf_move_items+0x8cf/0xec0 fs/reiserfs/lbalance.c:726 leaf_shift_left+0xbd/0x450 fs/reiserfs/lbalance.c:750 balance_leaf_when_delete_left fs/reiserfs/do_balan.c:194 [inline] balance_leaf_when_delete fs/reiserfs/do_balan.c:272 [inline] balance_leaf+0x132e/0x10df0 fs/reiserfs/do_balan.c:1393 do_balance+0x31c/0x930 fs/reiserfs/do_balan.c:1888 reiserfs_cut_from_item+0x156e/0x1fe0 fs/reiserfs/stree.c:1836 reiserfs_do_truncate+0x9c2/0x12d0 fs/reiserfs/stree.c:1971 reiserfs_truncate_file+0x480/0x7d0 fs/reiserfs/inode.c:2306 reiserfs_setattr+0xc1e/0x1230 fs/reiserfs/inode.c:3392 notify_change+0xb0d/0xe10 fs/attr.c:499 do_truncate+0x1b0/0x240 fs/open.c:66 handle_truncate fs/namei.c:3299 [inline] do_open fs/namei.c:3644 [inline] path_openat+0x2a32/0x3230 fs/namei.c:3797 do_filp_open+0x1f5/0x430 fs/namei.c:3824 do_sys_openat2+0x134/0x1d0 fs/open.c:1421 do_sys_open fs/open.c:1436 [inline] __do_sys_open fs/open.c:1444 [inline] __se_sys_open fs/open.c:1440 [inline] __x64_sys_open+0x11f/0x140 fs/open.c:1440 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f053819cdd9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f05363f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007f0538415fa0 RCX: 00007f053819cdd9 RDX: 0000000000000000 RSI: 000000000014937e RDI: 00002000000002c0 RBP: 00007f0538232d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0538416038 R14: 00007f0538415fa0 R15: 00007ffe2dbb48a8 The buggy address belongs to the physical page: page:ffffea000161c440 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x58711 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000000 ffffea000161c488 ffffea00014ec4c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5875, tgid 5875 (syz.1.2), ts 88529800056, free_ts 89833071322 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1581 prep_new_page mm/page_alloc.c:1588 [inline] get_page_from_freelist+0x1951/0x19e0 mm/page_alloc.c:3220 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4500 __folio_alloc+0x10/0x20 mm/page_alloc.c:4532 vma_alloc_folio+0x47a/0x8f0 mm/mempolicy.c:2240 shmem_alloc_folio+0x1a9/0x2a0 mm/shmem.c:1679 shmem_alloc_and_acct_folio+0x1e6/0x6d0 mm/shmem.c:1704 shmem_get_folio_gfp+0xcde/0x2aa0 mm/shmem.c:2041 shmem_get_folio mm/shmem.c:2164 [inline] shmem_write_begin+0xf2/0x420 mm/shmem.c:2706 generic_perform_write+0x2fe/0x5c0 mm/filemap.c:4036 shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883 __kernel_write_iter+0x28c/0x690 fs/read_write.c:517 dump_emit_page fs/coredump.c:957 [inline] dump_user_range+0x420/0x860 fs/coredump.c:984 elf_core_dump+0x31d0/0x3770 fs/binfmt_elf.c:2184 do_coredump+0x17cc/0x24d0 fs/coredump.c:833 get_signal+0x1133/0x13f0 kernel/signal.c:2888 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1181 [inline] free_unref_page_prepare+0x7b2/0x8c0 mm/page_alloc.c:2365 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2504 release_pages+0x1f7a/0x2200 mm/swap.c:1022 __folio_batch_release+0x71/0xe0 mm/swap.c:1042 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x630/0x1b20 mm/shmem.c:1026 shmem_truncate_range mm/shmem.c:1135 [inline] shmem_evict_inode+0x245/0x9e0 mm/shmem.c:1264 evict+0x4ca/0x8d0 fs/inode.c:705 do_unlinkat+0x38c/0x590 fs/namei.c:4406 __do_sys_unlink fs/namei.c:4447 [inline] __se_sys_unlink fs/namei.c:4445 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4445 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff888058710f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888058710f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888058711000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888058711080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888058711100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================