loop0: detected capacity change from 0 to 32768 gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" gfs2: fsid=syz:syz: Now mounting FS (format 1801)... gfs2: fsid=syz:syz.0: journal 0 mapped with 4 extents in 0ms gfs2: fsid=syz:syz.0: first mount done, others may mount gfs2: fsid=syz:syz.0: found 1 quota changes syz.0.0: attempt to access beyond end of device loop0: rw=1, sector=16778990, nr_sectors = 2 limit=32768 gfs2: fsid=syz:syz.0: Error 10 writing to journal, jid=0 ================================================================== BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:587 [inline] BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x448/0x740 fs/gfs2/aops.c:625 Read of size 8 at addr ffff888052c09168 by task syz.0.0/5318 CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-05877-g1a9239bb4253 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x16e/0x5b0 mm/kasan/report.c:521 kasan_report+0x143/0x180 mm/kasan/report.c:634 list_empty include/linux/list.h:373 [inline] gfs2_discard fs/gfs2/aops.c:587 [inline] gfs2_invalidate_folio+0x448/0x740 fs/gfs2/aops.c:625 folio_invalidate mm/truncate.c:126 [inline] truncate_cleanup_folio+0x203/0x300 mm/truncate.c:146 truncate_inode_pages_range+0x2e7/0x10e0 mm/truncate.c:326 gfs2_evict_inode+0x444/0x13c0 fs/gfs2/super.c:1527 evict+0x4f9/0x9b0 fs/inode.c:810 gfs2_put_super+0x43a/0x940 fs/gfs2/super.c:629 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_block_super+0x44/0x90 fs/super.c:1710 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x422/0x4c0 fs/namespace.c:1435 task_work_run+0x251/0x310 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f78eb98e90a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f78ec769e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffec RBX: 00007f78ec769ef0 RCX: 00007f78eb98e90a RDX: 0000200000037f40 RSI: 0000200000000100 RDI: 00007f78ec769eb0 RBP: 0000200000037f40 R08: 00007f78ec769ef0 R09: 0000000001200010 R10: 0000000001200010 R11: 0000000000000246 R12: 0000200000000100 R13: 00007f78ec769eb0 R14: 0000000000037fd9 R15: 00002000000000c0 Allocated by task 5318: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4138 [inline] slab_alloc_node mm/slub.c:4187 [inline] kmem_cache_alloc_noprof+0x1e1/0x390 mm/slub.c:4194 gfs2_alloc_bufdata fs/gfs2/trans.c:168 [inline] gfs2_trans_add_data+0x1f5/0x5f0 fs/gfs2/trans.c:209 gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline] __gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline] gfs2_unstuff_dinode+0xc3d/0x14c0 fs/gfs2/bmap.c:166 gfs2_adjust_quota+0x2e5/0x970 fs/gfs2/quota.c:847 do_sync+0x83e/0xc60 fs/gfs2/quota.c:961 gfs2_quota_sync+0x3c2/0x4b0 fs/gfs2/quota.c:1357 gfs2_sync_fs+0x4d/0xc0 fs/gfs2/super.c:670 sync_filesystem+0xed/0x230 fs/sync.c:56 generic_shutdown_super+0x72/0x2d0 fs/super.c:621 kill_block_super+0x44/0x90 fs/super.c:1710 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x422/0x4c0 fs/namespace.c:1435 task_work_run+0x251/0x310 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5318: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2376 [inline] slab_free mm/slub.c:4633 [inline] kmem_cache_free+0x197/0x410 mm/slub.c:4735 trans_drain fs/gfs2/log.c:1020 [inline] gfs2_log_flush+0x19ed/0x2620 fs/gfs2/log.c:1160 gfs2_trans_end+0x3a0/0x560 fs/gfs2/trans.c:158 do_sync+0x951/0xc60 fs/gfs2/quota.c:971 gfs2_quota_sync+0x3c2/0x4b0 fs/gfs2/quota.c:1357 gfs2_sync_fs+0x4d/0xc0 fs/gfs2/super.c:670 sync_filesystem+0xed/0x230 fs/sync.c:56 generic_shutdown_super+0x72/0x2d0 fs/super.c:621 kill_block_super+0x44/0x90 fs/super.c:1710 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x422/0x4c0 fs/namespace.c:1435 task_work_run+0x251/0x310 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888052c09150 which belongs to the cache gfs2_bufdata of size 80 The buggy address is located 24 bytes inside of freed 80-byte region [ffff888052c09150, ffff888052c091a0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52c09 flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88803379d640 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080240024 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5318, tgid 5316 (syz.0.0), ts 59039338640, free_ts 59034003575 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551 prep_new_page mm/page_alloc.c:1559 [inline] get_page_from_freelist+0x3695/0x37e0 mm/page_alloc.c:3477 __alloc_frozen_pages_noprof+0x2c5/0x7b0 mm/page_alloc.c:4740 alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2446 [inline] allocate_slab+0x8f/0x3a0 mm/slub.c:2610 new_slab mm/slub.c:2663 [inline] ___slab_alloc+0xc3b/0x1500 mm/slub.c:3849 __slab_alloc+0x58/0xa0 mm/slub.c:3939 __slab_alloc_node mm/slub.c:4014 [inline] slab_alloc_node mm/slub.c:4175 [inline] kmem_cache_alloc_noprof+0x270/0x390 mm/slub.c:4194 gfs2_alloc_bufdata fs/gfs2/trans.c:168 [inline] gfs2_trans_add_meta+0x323/0xb40 fs/gfs2/trans.c:251 gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline] gfs2_alloc_blocks+0xb2f/0x2920 fs/gfs2/rgrp.c:2447 __gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline] gfs2_unstuff_dinode+0x2b6/0x14c0 fs/gfs2/bmap.c:166 gfs2_adjust_quota+0x2e5/0x970 fs/gfs2/quota.c:847 do_sync+0x83e/0xc60 fs/gfs2/quota.c:961 gfs2_quota_sync+0x3c2/0x4b0 fs/gfs2/quota.c:1357 gfs2_sync_fs+0x4d/0xc0 fs/gfs2/super.c:670 sync_filesystem+0xed/0x230 fs/sync.c:56 page last free pid 5300 tgid 5300 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_frozen_pages+0xe16/0x10f0 mm/page_alloc.c:2660 discard_slab mm/slub.c:2707 [inline] __put_partials+0x160/0x1c0 mm/slub.c:3176 put_cpu_partial+0x17e/0x250 mm/slub.c:3251 __slab_free+0x294/0x390 mm/slub.c:4503 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4138 [inline] slab_alloc_node mm/slub.c:4187 [inline] __do_kmalloc_node mm/slub.c:4317 [inline] __kmalloc_node_track_caller_noprof+0x23a/0x4d0 mm/slub.c:4337 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599 __alloc_skb+0x1f2/0x480 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1340 [inline] mld_newpack+0x176/0xc70 net/ipv6/mcast.c:1788 add_grhead net/ipv6/mcast.c:1899 [inline] add_grec+0x1495/0x19a0 net/ipv6/mcast.c:2037 mld_send_cr net/ipv6/mcast.c:2163 [inline] mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2702 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319 worker_thread+0x870/0xd30 kernel/workqueue.c:3400 kthread+0x7a9/0x920 kernel/kthread.c:464 Memory state around the buggy address: ffff888052c09000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb ffff888052c09080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb >ffff888052c09100: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb ^ ffff888052c09180: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb ffff888052c09200: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================