loop0: detected capacity change from 0 to 32768 JFS: metapage_get_blocks failed ERROR: (device loop0): release_metapage: metapage_write_one() failed ERROR: (device loop0): remounting filesystem as read-only ================================================================== BUG: KFENCE: use-after-free read in drop_metapage fs/jfs/jfs_metapage.c:311 [inline] BUG: KFENCE: use-after-free read in release_metapage+0x760/0xac0 fs/jfs/jfs_metapage.c:892 Use-after-free read at 0xffff88805b332f70 (in kfence-#152): drop_metapage fs/jfs/jfs_metapage.c:311 [inline] release_metapage+0x760/0xac0 fs/jfs/jfs_metapage.c:892 write_metapage fs/jfs/jfs_metapage.h:75 [inline] flush_metapage fs/jfs/jfs_metapage.h:81 [inline] ea_put fs/jfs/xattr.c:623 [inline] __jfs_setxattr+0xe37/0x1160 fs/jfs/xattr.c:792 __jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941 __vfs_setxattr+0x43c/0x480 fs/xattr.c:200 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234 vfs_setxattr+0x163/0x360 fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] filename_setxattr+0x296/0x630 fs/xattr.c:664 path_setxattrat+0x3eb/0x440 fs/xattr.c:708 __do_sys_lsetxattr fs/xattr.c:749 [inline] __se_sys_lsetxattr fs/xattr.c:745 [inline] __x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:745 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#152: 0xffff88805b332f48-0xffff88805b332fff, size=184, cache=jfs_mp allocated by task 5324 on cpu 0 at 85.172306s (0.080577s ago): mempool_alloc_noprof+0x1ce/0x300 mm/mempool.c:566 alloc_metapage fs/jfs/jfs_metapage.c:264 [inline] __get_metapage+0x50c/0xde0 fs/jfs/jfs_metapage.c:760 ea_get+0xb9a/0x1330 fs/jfs/xattr.c:528 __jfs_setxattr+0x5ba/0x1160 fs/jfs/xattr.c:727 __jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941 __vfs_setxattr+0x43c/0x480 fs/xattr.c:200 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234 vfs_setxattr+0x163/0x360 fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] filename_setxattr+0x296/0x630 fs/xattr.c:664 path_setxattrat+0x3eb/0x440 fs/xattr.c:708 __do_sys_lsetxattr fs/xattr.c:749 [inline] __se_sys_lsetxattr fs/xattr.c:745 [inline] __x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:745 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f freed by task 76 on cpu 0 at 85.196042s (0.092059s ago): mempool_free+0xec/0x130 mm/mempool.c:711 free_metapage fs/jfs/jfs_metapage.c:279 [inline] metapage_release_folio+0x40e/0x540 fs/jfs/jfs_metapage.c:636 shrink_folio_list+0x2226/0x5290 mm/vmscan.c:1491 evict_folios+0x4795/0x5880 mm/vmscan.c:4718 try_to_shrink_lruvec+0xb62/0xfa0 mm/vmscan.c:4881 shrink_one+0x25c/0x710 mm/vmscan.c:4926 shrink_many mm/vmscan.c:4989 [inline] lru_gen_shrink_node mm/vmscan.c:5067 [inline] shrink_node+0x3197/0x3a90 mm/vmscan.c:6047 kswapd_shrink_node mm/vmscan.c:6894 [inline] balance_pgdat mm/vmscan.c:7070 [inline] kswapd+0x1742/0x2e10 mm/vmscan.c:7343 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:drop_metapage fs/jfs/jfs_metapage.c:311 [inline] RIP: 0010:release_metapage+0x760/0xac0 fs/jfs/jfs_metapage.c:892 Code: 5d 00 48 8b 7c 24 48 48 8b 74 24 40 e8 19 5b 54 08 48 b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 4c 89 e7 e8 c0 35 d2 fe <4d> 8b 24 24 31 ff 4c 89 e6 e8 72 5e 66 fe 4d 85 e4 74 0a e8 88 59 RSP: 0018:ffffc9000f5076b0 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000100000 RDX: ffffc9000ec4a000 RSI: 00000000000021e2 RDI: 00000000000021e3 RBP: 1ffffd4000093549 R08: ffffea000049aa47 R09: 1ffffd4000093548 R10: dffffc0000000000 R11: fffff94000093549 R12: ffff88805b332f70 R13: ffffea000049aa40 R14: ffff88805b332f48 R15: 1ffff1100b6665ee FS: 00007f4d9a7e36c0(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88805b332f70 CR3: 0000000011d39000 CR4: 0000000000352ef0 Call Trace: write_metapage fs/jfs/jfs_metapage.h:75 [inline] flush_metapage fs/jfs/jfs_metapage.h:81 [inline] ea_put fs/jfs/xattr.c:623 [inline] __jfs_setxattr+0xe37/0x1160 fs/jfs/xattr.c:792 __jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941 __vfs_setxattr+0x43c/0x480 fs/xattr.c:200 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234 vfs_setxattr+0x163/0x360 fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] filename_setxattr+0x296/0x630 fs/xattr.c:664 path_setxattrat+0x3eb/0x440 fs/xattr.c:708 __do_sys_lsetxattr fs/xattr.c:749 [inline] __se_sys_lsetxattr fs/xattr.c:745 [inline] __x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:745 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4d9999c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4d9a7e2fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 00007f4d99c15fa0 RCX: 00007f4d9999c819 RDX: 0000000000000000 RSI: 00002000000021c0 RDI: 0000200000000000 RBP: 00007f4d99a32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f4d99c16038 R14: 00007f4d99c15fa0 R15: 00007fffa948d818 ================================================================== ---------------- Code disassembly (best guess): 0: 5d pop %rbp 1: 00 48 8b add %cl,-0x75(%rax) 4: 7c 24 jl 0x2a 6: 48 rex.W 7: 48 8b 74 24 40 mov 0x40(%rsp),%rsi c: e8 19 5b 54 08 call 0x8545b2a 11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 18: fc ff df 1b: 41 80 3c 07 00 cmpb $0x0,(%r15,%rax,1) 20: 74 08 je 0x2a 22: 4c 89 e7 mov %r12,%rdi 25: e8 c0 35 d2 fe call 0xfed235ea * 2a: 4d 8b 24 24 mov (%r12),%r12 <-- trapping instruction 2e: 31 ff xor %edi,%edi 30: 4c 89 e6 mov %r12,%rsi 33: e8 72 5e 66 fe call 0xfe665eaa 38: 4d 85 e4 test %r12,%r12 3b: 74 0a je 0x47 3d: e8 .byte 0xe8 3e: 88 .byte 0x88 3f: 59 pop %rcx