================================================================== BUG: KASAN: slab-use-after-free in __list_splice include/linux/list.h:577 [inline] BUG: KASAN: slab-use-after-free in list_splice_init include/linux/list.h:619 [inline] BUG: KASAN: slab-use-after-free in xlog_cil_push_pcp_aggregate fs/xfs/xfs_log_cil.c:137 [inline] BUG: KASAN: slab-use-after-free in xlog_cil_push_work+0x986/0x2a90 fs/xfs/xfs_log_cil.c:1417 Write of size 8 at addr ffff88805e766460 by task kworker/u8:18/2319 CPU: 0 UID: 0 PID: 2319 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: xfs-cil/loop3 xlog_cil_push_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __list_splice include/linux/list.h:577 [inline] list_splice_init include/linux/list.h:619 [inline] xlog_cil_push_pcp_aggregate fs/xfs/xfs_log_cil.c:137 [inline] xlog_cil_push_work+0x986/0x2a90 fs/xfs/xfs_log_cil.c:1417 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 7793: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_noprof+0x360/0x690 mm/slub.c:5010 xfs_buf_item_init+0x6a/0x6e0 fs/xfs/xfs_buf_item.c:872 _xfs_trans_bjoin+0x46/0x110 fs/xfs/xfs_trans_buf.c:75 __xfs_trans_getsb+0x65/0x4a0 fs/xfs/xfs_trans_buf.c:191 xfs_log_sb+0x43/0x200 fs/xfs/libxfs/xfs_sb.c:1327 xfs_sync_sb_buf+0xc2/0x290 fs/xfs/libxfs/xfs_sb.c:1479 xfs_ioc_setlabel+0x1d7/0x340 fs/xfs/xfs_ioctl.c:1081 xfs_file_ioctl+0x901/0x1590 fs/xfs/xfs_ioctl.c:1238 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 7793: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kmem_cache_free+0x187/0x6d0 mm/slub.c:6635 xfs_buf_ioend+0x235/0x790 fs/xfs/xfs_buf.c:1167 xfs_buf_iowait+0x133/0x420 fs/xfs/xfs_buf.c:1336 xfs_bwrite+0x5f/0xe0 fs/xfs/xfs_buf.c:1239 xfs_sync_sb_buf+0x172/0x290 fs/xfs/libxfs/xfs_sb.c:1489 xfs_ioc_setlabel+0x1d7/0x340 fs/xfs/xfs_ioctl.c:1081 xfs_file_ioctl+0x901/0x1590 fs/xfs/xfs_ioctl.c:1238 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88805e7663f0 which belongs to the cache xfs_buf_item of size 272 The buggy address is located 112 bytes inside of freed 272-byte region [ffff88805e7663f0, ffff88805e766500) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805e766bd0 pfn:0x5e766 flags: 0x80000000000200(workingset|node=0|zone=1) page_type: f5(slab) raw: 0080000000000200 ffff888140accdc0 ffff88801f395488 ffffea0000db96d0 raw: ffff88805e766bd0 00000002000c0005 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5818, tgid 5817 (syz.1.2), ts 101659570747 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2591/0x2600 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x230/0x5c0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x45d/0x690 mm/slub.c:5010 xfs_buf_item_init+0x6a/0x6e0 fs/xfs/xfs_buf_item.c:872 _xfs_trans_bjoin+0x46/0x110 fs/xfs/xfs_trans_buf.c:75 xfs_trans_read_buf_map+0x2ee/0x820 fs/xfs/xfs_trans_buf.c:294 xfs_trans_read_buf fs/xfs/xfs_trans.h:212 [inline] xfs_read_icluster+0x218/0x3e0 fs/xfs/libxfs/xfs_inode_buf.c:139 xfs_iget_cache_miss fs/xfs/xfs_icache.c:663 [inline] xfs_iget+0xc34/0x2f00 fs/xfs/xfs_icache.c:804 xfs_trans_metafile_iget+0x77/0x330 fs/xfs/xfs_icache.c:853 xfs_rtginode_load+0x3a3/0x920 fs/xfs/libxfs/xfs_rtgroup.c:469 xfs_rtmount_rtg fs/xfs/xfs_rtalloc.c:1684 [inline] xfs_rtmount_inodes+0x14f/0x7a0 fs/xfs/xfs_rtalloc.c:1721 xfs_mountfs+0x1254/0x2380 fs/xfs/xfs_mount.c:1095 page last free pid 20 tgid 20 ts 101254058323 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xf8e/0x1070 mm/page_alloc.c:2962 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core kernel/rcu/tree.c:2919 [inline] rcu_cpu_kthread+0xb2c/0x1740 kernel/rcu/tree.c:3007 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88805e766300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805e766380: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb >ffff88805e766400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88805e766480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805e766500: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ==================================================================