JFS: metapage_get_blocks failed ERROR: (device loop0): release_metapage: metapage_write_one() failed ERROR: (device loop0): remounting filesystem as read-only ================================================================== BUG: KFENCE: use-after-free read in drop_metapage fs/jfs/jfs_metapage.c:-1 [inline] BUG: KFENCE: use-after-free read in release_metapage+0x71b/0xa60 fs/jfs/jfs_metapage.c:893 Use-after-free read at 0xffff88805b2d4028 (in kfence-#105): drop_metapage fs/jfs/jfs_metapage.c:-1 [inline] release_metapage+0x71b/0xa60 fs/jfs/jfs_metapage.c:893 write_metapage fs/jfs/jfs_metapage.h:75 [inline] flush_metapage fs/jfs/jfs_metapage.h:81 [inline] ea_put fs/jfs/xattr.c:623 [inline] __jfs_setxattr+0xe61/0x1190 fs/jfs/xattr.c:792 __jfs_set_acl fs/jfs/acl.c:83 [inline] jfs_set_acl+0x2c3/0x460 fs/jfs/acl.c:110 set_posix_acl fs/posix_acl.c:962 [inline] vfs_set_acl+0x8a0/0xb50 fs/posix_acl.c:1141 do_set_acl+0xf5/0x190 fs/posix_acl.c:1286 do_setxattr fs/xattr.c:659 [inline] filename_setxattr+0x305/0x630 fs/xattr.c:690 path_setxattrat+0x408/0x450 fs/xattr.c:734 __do_sys_setxattr fs/xattr.c:768 [inline] __se_sys_setxattr fs/xattr.c:764 [inline] __x64_sys_setxattr+0xbc/0xe0 fs/xattr.c:764 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#105: 0xffff88805b2d4000-0xffff88805b2d40b7, size=184, cache=jfs_mp allocated by task 5319 on cpu 0 at 94.241929s (0.133225s ago): mempool_alloc_noprof+0x1bf/0x300 mm/mempool.c:559 alloc_metapage fs/jfs/jfs_metapage.c:264 [inline] __get_metapage+0x4ed/0xdf0 fs/jfs/jfs_metapage.c:761 ea_get+0xb9d/0x1300 fs/jfs/xattr.c:528 __jfs_setxattr+0x5d5/0x1190 fs/jfs/xattr.c:727 __jfs_set_acl fs/jfs/acl.c:83 [inline] jfs_set_acl+0x2c3/0x460 fs/jfs/acl.c:110 set_posix_acl fs/posix_acl.c:962 [inline] vfs_set_acl+0x8a0/0xb50 fs/posix_acl.c:1141 do_set_acl+0xf5/0x190 fs/posix_acl.c:1286 do_setxattr fs/xattr.c:659 [inline] filename_setxattr+0x305/0x630 fs/xattr.c:690 path_setxattrat+0x408/0x450 fs/xattr.c:734 __do_sys_setxattr fs/xattr.c:768 [inline] __se_sys_setxattr fs/xattr.c:764 [inline] __x64_sys_setxattr+0xbc/0xe0 fs/xattr.c:764 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f freed by task 69 on cpu 0 at 94.314093s (0.096818s ago): mempool_free+0xec/0x130 mm/mempool.c:704 free_metapage fs/jfs/jfs_metapage.c:280 [inline] metapage_release_folio+0x462/0x590 fs/jfs/jfs_metapage.c:637 shrink_folio_list+0x2364/0x5330 mm/vmscan.c:1463 evict_folios+0x3821/0x49e0 mm/vmscan.c:4834 try_to_shrink_lruvec+0xb4f/0xed0 mm/vmscan.c:4983 shrink_one+0x233/0x730 mm/vmscan.c:5024 shrink_many mm/vmscan.c:5087 [inline] lru_gen_shrink_node mm/vmscan.c:5165 [inline] shrink_node+0x3303/0x3b60 mm/vmscan.c:6154 kswapd_shrink_node mm/vmscan.c:7008 [inline] balance_pgdat mm/vmscan.c:7186 [inline] kswapd+0x17b6/0x31c0 mm/vmscan.c:7462 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:drop_metapage fs/jfs/jfs_metapage.c:312 [inline] RIP: 0010:release_metapage+0x71b/0xa60 fs/jfs/jfs_metapage.c:893 Code: fc ff df 48 8b 7c 24 18 48 8b 74 24 10 e8 1d 27 6b 08 43 80 3c 2c 00 49 8d 46 28 74 0d 49 8d 7e 28 e8 b9 ff cb fe 49 8d 46 28 <4c> 8b 20 31 ff 4c 89 e6 e8 98 cf 5c fe 4d 85 e4 74 0a e8 ae ca 5c RSP: 0018:ffffc9000eccf780 EFLAGS: 00010246 RAX: ffff88805b2d4028 RBX: ffffea0000492a80 RCX: ffff88801ae60000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 RBP: 1ffffd4000092500 R08: ffffea0000492a87 R09: 1ffffd4000092550 R10: dffffc0000000000 R11: fffff94000092551 R12: 1ffff1100b65a805 R13: dffffc0000000000 R14: ffff88805b2d4000 R15: 1ffff1100b65a804 FS: 00007fb5b906c6c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88805b2d4028 CR3: 000000001ae87000 CR4: 0000000000352ef0 Call Trace: write_metapage fs/jfs/jfs_metapage.h:75 [inline] flush_metapage fs/jfs/jfs_metapage.h:81 [inline] ea_put fs/jfs/xattr.c:623 [inline] __jfs_setxattr+0xe61/0x1190 fs/jfs/xattr.c:792 __jfs_set_acl fs/jfs/acl.c:83 [inline] jfs_set_acl+0x2c3/0x460 fs/jfs/acl.c:110 set_posix_acl fs/posix_acl.c:962 [inline] vfs_set_acl+0x8a0/0xb50 fs/posix_acl.c:1141 do_set_acl+0xf5/0x190 fs/posix_acl.c:1286 do_setxattr fs/xattr.c:659 [inline] filename_setxattr+0x305/0x630 fs/xattr.c:690 path_setxattrat+0x408/0x450 fs/xattr.c:734 __do_sys_setxattr fs/xattr.c:768 [inline] __se_sys_setxattr fs/xattr.c:764 [inline] __x64_sys_setxattr+0xbc/0xe0 fs/xattr.c:764 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb5b819e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb5b906bfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc RAX: ffffffffffffffda RBX: 00007fb5b8426090 RCX: 00007fb5b819e0d9 RDX: 0000200000000340 RSI: 0000200000002a40 RDI: 0000200000002a00 RBP: 00007fb5b8235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb5b8426128 R14: 00007fb5b8426090 R15: 00007fff35305ed8 ================================================================== ---------------- Code disassembly (best guess): 0: fc cld 1: ff lcall (bad) 2: df 48 8b fisttps -0x75(%rax) 5: 7c 24 jl 0x2b 7: 18 48 8b sbb %cl,-0x75(%rax) a: 74 24 je 0x30 c: 10 e8 adc %ch,%al e: 1d 27 6b 08 43 sbb $0x43086b27,%eax 13: 80 3c 2c 00 cmpb $0x0,(%rsp,%rbp,1) 17: 49 8d 46 28 lea 0x28(%r14),%rax 1b: 74 0d je 0x2a 1d: 49 8d 7e 28 lea 0x28(%r14),%rdi 21: e8 b9 ff cb fe call 0xfecbffdf 26: 49 8d 46 28 lea 0x28(%r14),%rax * 2a: 4c 8b 20 mov (%rax),%r12 <-- trapping instruction 2d: 31 ff xor %edi,%edi 2f: 4c 89 e6 mov %r12,%rsi 32: e8 98 cf 5c fe call 0xfe5ccfcf 37: 4d 85 e4 test %r12,%r12 3a: 74 0a je 0x46 3c: e8 .byte 0xe8 3d: ae scas %es:(%rdi),%al 3e: ca .byte 0xca 3f: 5c pop %rsp