================================================================== BUG: KASAN: slab-use-after-free in xfs_inode_item_push+0x293/0x2e0 fs/xfs/xfs_inode_item.c:797 Read of size 8 at addr ffff88804fe7b178 by task xfsaild/loop8/9106 CPU: 0 UID: 0 PID: 9106 Comm: xfsaild/loop8 Not tainted 6.15.0-rc3-syzkaller-00008-ga33b5a08cbbd #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x16e/0x5b0 mm/kasan/report.c:521 kasan_report+0x143/0x180 mm/kasan/report.c:634 xfs_inode_item_push+0x293/0x2e0 fs/xfs/xfs_inode_item.c:797 xfsaild_push_item fs/xfs/xfs_trans_ail.c:390 [inline] xfsaild_push fs/xfs/xfs_trans_ail.c:518 [inline] xfsaild+0x1148/0x2c50 fs/xfs/xfs_trans_ail.c:700 kthread+0x7b9/0x940 kernel/kthread.c:464 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 9090: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4161 [inline] slab_alloc_node mm/slub.c:4210 [inline] kmem_cache_alloc_noprof+0x1e1/0x390 mm/slub.c:4217 xfs_inode_item_init+0x33/0xc0 fs/xfs/xfs_inode_item.c:892 xfs_trans_ijoin+0xeb/0x130 fs/xfs/libxfs/xfs_trans_inode.c:36 xfs_create+0x906/0x1060 fs/xfs/xfs_inode.c:732 xfs_generic_create+0x5d9/0xf50 fs/xfs/xfs_iops.c:216 xfs_vn_mkdir+0x37/0x50 fs/xfs/xfs_iops.c:309 vfs_mkdir+0x2fb/0x500 fs/namei.c:4359 do_mkdirat+0x273/0x3f0 fs/namei.c:4392 __do_sys_mkdirat fs/namei.c:4409 [inline] __se_sys_mkdirat fs/namei.c:4407 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4407 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 9114: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2398 [inline] slab_free mm/slub.c:4656 [inline] kmem_cache_free+0x197/0x410 mm/slub.c:4758 xfs_inode_free_callback+0x152/0x1d0 fs/xfs/xfs_icache.c:161 rcu_do_batch kernel/rcu/tree.c:2568 [inline] rcu_core+0xaae/0x17a0 kernel/rcu/tree.c:2824 handle_softirqs+0x2d8/0x9b0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xfb/0x220 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 The buggy address belongs to the object at ffff88804fe7b148 which belongs to the cache xfs_ili of size 264 The buggy address is located 48 bytes inside of freed 264-byte region [ffff88804fe7b148, ffff88804fe7b250) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4fe7b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801cf4b140 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x52c50(GFP_NOFS|__GFP_RECLAIMABLE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9090, tgid 9089 (syz.8.640), ts 556692460920, free_ts 546491977122 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1718 prep_new_page mm/page_alloc.c:1726 [inline] get_page_from_freelist+0x360a/0x37a0 mm/page_alloc.c:3688 __alloc_frozen_pages_noprof+0x211/0x5b0 mm/page_alloc.c:4970 alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2468 [inline] allocate_slab+0x8f/0x3b0 mm/slub.c:2632 new_slab mm/slub.c:2686 [inline] ___slab_alloc+0xc3b/0x1500 mm/slub.c:3872 __slab_alloc+0x58/0xa0 mm/slub.c:3962 __slab_alloc_node mm/slub.c:4037 [inline] slab_alloc_node mm/slub.c:4198 [inline] kmem_cache_alloc_noprof+0x270/0x390 mm/slub.c:4217 xfs_inode_item_init+0x33/0xc0 fs/xfs/xfs_inode_item.c:892 xfs_trans_ijoin+0xeb/0x130 fs/xfs/libxfs/xfs_trans_inode.c:36 xfs_icreate+0x13c/0x1f0 fs/xfs/xfs_inode.c:605 xfs_create+0x8ad/0x1060 fs/xfs/xfs_inode.c:721 xfs_generic_create+0x5d9/0xf50 fs/xfs/xfs_iops.c:216 xfs_vn_mkdir+0x37/0x50 fs/xfs/xfs_iops.c:309 vfs_mkdir+0x2fb/0x500 fs/namei.c:4359 do_mkdirat+0x273/0x3f0 fs/namei.c:4392 page last free pid 8148 tgid 8148 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1262 [inline] __free_frozen_pages+0xde8/0x10a0 mm/page_alloc.c:2725 discard_slab mm/slub.c:2730 [inline] free_partial mm/slub.c:5883 [inline] __kmem_cache_shutdown+0x3d2/0x470 mm/slub.c:5908 kmem_cache_destroy+0x76/0x160 mm/slab_common.c:523 f2fs_put_super+0xb8f/0x1130 fs/f2fs/super.c:1707 generic_shutdown_super+0x13b/0x2d0 fs/super.c:642 kill_block_super+0x44/0x90 fs/super.c:1710 kill_f2fs_super+0x37f/0x6d0 fs/f2fs/super.c:5032 deactivate_locked_super+0xc6/0x130 fs/super.c:473 cleanup_mnt+0x422/0x4c0 fs/namespace.c:1435 task_work_run+0x253/0x310 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x210 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88804fe7b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88804fe7b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88804fe7b100: 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb ^ ffff88804fe7b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804fe7b200: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc ==================================================================