Re: [syzbot] [ocfs2?] KASAN: use-after-free Read in ocfs2_dir_foreach_blk

[syzbot <syzbot+b20bbf680bb0f2ecedae@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

50.688447][ T6310] device veth1_vlan entered promiscuous mode
[   50.706746][ T1035] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   50.714583][ T1035] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   50.722574][ T1035] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   50.731116][ T1035] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   50.741832][ T6310] device veth0_macvtap entered promiscuous mode
[   50.752332][ T6310] device veth1_macvtap entered promiscuous mode
[   50.767297][ T6310] batman_adv: batadv0: Interface activated: batadv_slave_0
[   50.774561][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   50.782673][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   50.790547][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   50.799051][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   50.809245][ T6310] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.819680][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   50.828323][   T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   50.839843][ T6310] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.848757][ T6310] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.857500][ T6310] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.866296][ T6310] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.905760][    C0] ================================================================================
[   50.915055][    C0] UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
[   50.923684][    C0] -1416465042 + -1732037041 cannot be represented in type 'int'
[   50.931326][    C0] CPU: 0 PID: 6310 Comm: syz-executor Not tainted syzkaller #0
[   50.938841][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   50.948878][    C0] Call Trace:
[   50.952150][    C0]  <IRQ>
[   50.954981][    C0]  dump_stack+0xfd/0x16e
[   50.959197][    C0]  ubsan_epilogue+0xa/0x30
[   50.963586][    C0]  handle_overflow+0x192/0x1b0
[   50.968326][    C0]  ? do_syscall_64+0x34/0x50
[   50.972883][    C0]  ? prandom_u32+0x1d/0x1f0
[   50.977354][    C0]  ip_idents_reserve+0x14a/0x170
[   50.982259][    C0]  __ip_select_ident+0xe4/0x1c0
[   50.987096][    C0]  iptunnel_xmit+0x466/0x7b0
[   50.991696][    C0]  udp_tunnel_xmit_skb+0x1ba/0x290
[   50.996806][    C0]  geneve_xmit+0x1d05/0x2140
[   51.001464][    C0]  dev_hard_start_xmit+0x294/0x780
[   51.006575][    C0]  __dev_queue_xmit+0x1678/0x28b0
[   51.011592][    C0]  ip6_finish_output2+0x1020/0x1490
[   51.016769][    C0]  NF_HOOK+0x45/0x2c0
[   51.020719][    C0]  ? NF_HOOK+0x2c0/0x2c0
[   51.024936][    C0]  mld_sendpack+0x5f9/0xa70
[   51.029434][    C0]  mld_ifc_timer_expire+0x7e1/0x990
[   51.034621][    C0]  ? lock_acquire+0x78/0x310
[   51.039193][    C0]  ? lock_release+0x69/0x610
[   51.043762][    C0]  ? debug_object_deactivate+0x9b/0x250
[   51.049287][    C0]  ? mld_gq_timer_expire+0xe0/0xe0
[   51.054413][    C0]  call_timer_fn+0x105/0x440
[   51.059120][    C0]  ? mld_gq_timer_expire+0xe0/0xe0
[   51.064234][    C0]  __run_timers+0x5d8/0x7a0
[   51.068809][    C0]  ? __do_softirq+0x164/0x8ae
[   51.073463][    C0]  run_timer_softirq+0x19/0x30
[   51.078690][    C0]  __do_softirq+0x23c/0x8ae
[   51.083286][    C0]  ? asm_call_irq_on_stack+0xf/0x20
[   51.088488][    C0]  asm_call_irq_on_stack+0xf/0x20
[   51.093513][    C0]  </IRQ>
[   51.096429][    C0]  do_softirq_own_stack+0x6d/0xb0
[   51.101437][    C0]  __irq_exit_rcu+0x1e1/0x1f0
[   51.106105][    C0]  irq_exit_rcu+0x5/0x20
[   51.110371][    C0]  sysvec_apic_timer_interrupt+0x9d/0xb0
[   51.116111][    C0]  asm_sysvec_apic_timer_interrupt+0x12/0x20
[   51.122091][    C0] RIP: 0010:truncate_inode_pages_final+0x2/0xd0
[   51.128319][    C0] Code: fe e8 62 7a da ff 4c 89 f7 48 89 de 48 c7 c2 ff ff ff ff 5b 41 5e e9 ad e5 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 57 <41> 56 53 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 29 7a da ff 48
[   51.147990][    C0] RSP: 0018:ffffc90001cff658 EFLAGS: 00000293
[   51.154043][    C0] RAX: ffffffff81b9ba30 RBX: ffff888038e835a0 RCX: ffff88801b1cd040
[   51.161995][    C0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888038e837c8
[   51.170256][    C0] RBP: ffff888038e83678 R08: dffffc0000000000 R09: ffffed10071d06c6
[   51.178204][    C0] R10: ffffed10071d06c6 R11: 1ffff110071d06c5 R12: dffffc0000000000
[   51.186161][    C0] R13: ffffffff893efaf0 R14: 0000000000000000 R15: ffff888038e83628
[   51.194208][    C0]  ? evict+0x410/0x860
[   51.198252][    C0]  evict+0x41c/0x860
[   51.202557][    C0]  ? _raw_spin_unlock+0x1a/0x30
[   51.207377][    C0]  ? iput+0x6d9/0x890
[   51.211339][    C0]  __dentry_kill+0x436/0x660
[   51.215919][    C0]  dentry_kill+0xb9/0x2d0
[   51.220305][    C0]  dput+0xd5/0x1b0
[   51.224008][    C0]  simple_recursive_removal+0x295/0x8e0
[   51.229524][    C0]  ? debugfs_remove+0x70/0x70
[   51.234238][    C0]  debugfs_remove+0x56/0x70
[   51.238760][    C0]  ieee80211_debugfs_remove_netdev+0x4e/0xb0
[   51.244718][    C0]  ieee80211_if_change_type+0x215/0xe60
[   51.250235][    C0]  ? trace_rdev_return_void+0x7a/0x190
[   51.255665][    C0]  ? ieee80211_set_cqm_rssi_range_config+0x220/0x220
[   51.262453][    C0]  ? cfg80211_mgmt_registrations_update+0x5dc/0x7d0
[   51.269031][    C0]  ieee80211_change_iface+0x57/0x420
[   51.274298][    C0]  cfg80211_change_iface+0x73c/0xe50
[   51.279558][    C0]  nl80211_set_interface+0x43e/0x750
[   51.285004][    C0]  genl_rcv_msg+0xb22/0xdd0
[   51.289582][    C0]  ? nl80211_dump_interface+0x630/0x630
[   51.295106][    C0]  netlink_rcv_skb+0x187/0x390
[   51.299927][    C0]  ? genl_bind+0x2c0/0x2c0
[   51.304331][    C0]  genl_rcv+0x24/0x40
[   51.308316][    C0]  netlink_unicast+0x7b7/0x9b0
[   51.313154][    C0]  netlink_sendmsg+0x968/0xb50
[   51.317999][    C0]  ? netlink_getsockopt+0x4f0/0x4f0
[   51.323270][    C0]  __sock_sendmsg+0x15c/0x170
[   51.328024][    C0]  __sys_sendto+0x323/0x430
[   51.332498][    C0]  __x64_sys_sendto+0xda/0xf0
[   51.337178][    C0]  do_syscall_64+0x34/0x50
[   51.341745][    C0]  entry_SYSCALL_64_after_hwframe+0x67/0xd1
[   51.347795][    C0] RIP: 0033:0x7f971276aa3c
[   51.352206][    C0] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
[   51.371869][    C0] RSP: 002b:00007ffd4d7d3b30 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[   51.380254][    C0] RAX: ffffffffffffffda RBX: 00007f97134de620 RCX: 00007f971276aa3c
[   51.388206][    C0] RDX: 0000000000000024 RSI: 00007f97134de670 RDI: 0000000000000003
[   51.396360][    C0] RBP: 0000000000000000 R08: 00007ffd4d7d3b84 R09: 000000000000000c
[   51.404329][    C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
[   51.412277][    C0] R13: 0000000000000000 R14: 00007f97134de670 R15: 0000000000000000
[   51.420284][    C0] ================================================================================
[   51.425412][ T6054] Bluetooth: hci0: command 0x0409 tx timeout
[   51.429678][    C0] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[   51.442783][    C0] CPU: 0 PID: 6310 Comm: syz-executor Not tainted syzkaller #0
[   51.450297][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   51.460336][    C0] Call Trace:
[   51.463600][    C0]  <IRQ>
[   51.466429][    C0]  dump_stack+0xfd/0x16e
[   51.470817][    C0]  panic+0x2f0/0x9c0
[   51.474691][    C0]  check_panic_on_warn+0x95/0xe0
[   51.479688][    C0]  handle_overflow+0x192/0x1b0
[   51.484421][    C0]  ? do_syscall_64+0x34/0x50
[   51.488983][    C0]  ? prandom_u32+0x1d/0x1f0
[   51.493463][    C0]  ip_idents_reserve+0x14a/0x170
[   51.498392][    C0]  __ip_select_ident+0xe4/0x1c0
[   51.503215][    C0]  iptunnel_xmit+0x466/0x7b0
[   51.507794][    C0]  udp_tunnel_xmit_skb+0x1ba/0x290
[   51.512893][    C0]  geneve_xmit+0x1d05/0x2140
[   51.517470][    C0]  dev_hard_start_xmit+0x294/0x780
[   51.522562][    C0]  __dev_queue_xmit+0x1678/0x28b0
[   51.527566][    C0]  ip6_finish_output2+0x1020/0x1490
[   51.532737][    C0]  NF_HOOK+0x45/0x2c0
[   51.536699][    C0]  ? NF_HOOK+0x2c0/0x2c0
[   51.540927][    C0]  mld_sendpack+0x5f9/0xa70
[   51.545417][    C0]  mld_ifc_timer_expire+0x7e1/0x990
[   51.550595][    C0]  ? lock_acquire+0x78/0x310
[   51.555163][    C0]  ? lock_release+0x69/0x610
[   51.559730][    C0]  ? debug_object_deactivate+0x9b/0x250
[   51.565246][    C0]  ? mld_gq_timer_expire+0xe0/0xe0
[   51.570327][    C0]  call_timer_fn+0x105/0x440
[   51.575081][    C0]  ? mld_gq_timer_expire+0xe0/0xe0
[   51.580163][    C0]  __run_timers+0x5d8/0x7a0
[   51.584647][    C0]  ? __do_softirq+0x164/0x8ae
[   51.589330][    C0]  run_timer_softirq+0x19/0x30
[   51.594067][    C0]  __do_softirq+0x23c/0x8ae
[   51.598568][    C0]  ? asm_call_irq_on_stack+0xf/0x20
[   51.603833][    C0]  asm_call_irq_on_stack+0xf/0x20
[   51.608831][    C0]  </IRQ>
[   51.611742][    C0]  do_softirq_own_stack+0x6d/0xb0
[   51.616739][    C0]  __irq_exit_rcu+0x1e1/0x1f0
[   51.621421][    C0]  irq_exit_rcu+0x5/0x20
[   51.625666][    C0]  sysvec_apic_timer_interrupt+0x9d/0xb0
[   51.631392][    C0]  asm_sysvec_apic_timer_interrupt+0x12/0x20
[   51.637422][    C0] RIP: 0010:truncate_inode_pages_final+0x2/0xd0
[   51.643641][    C0] Code: fe e8 62 7a da ff 4c 89 f7 48 89 de 48 c7 c2 ff ff ff ff 5b 41 5e e9 ad e5 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 57 <41> 56 53 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 29 7a da ff 48
[   51.663214][    C0] RSP: 0018:ffffc90001cff658 EFLAGS: 00000293
[   51.669401][    C0] RAX: ffffffff81b9ba30 RBX: ffff888038e835a0 RCX: ffff88801b1cd040
[   51.677381][    C0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888038e837c8
[   51.685334][    C0] RBP: ffff888038e83678 R08: dffffc0000000000 R09: ffffed10071d06c6
[   51.693282][    C0] R10: ffffed10071d06c6 R11: 1ffff110071d06c5 R12: dffffc0000000000
[   51.701226][    C0] R13: ffffffff893efaf0 R14: 0000000000000000 R15: ffff888038e83628
[   51.709190][    C0]  ? evict+0x410/0x860
[   51.713328][    C0]  evict+0x41c/0x860
[   51.717195][    C0]  ? _raw_spin_unlock+0x1a/0x30
[   51.722026][    C0]  ? iput+0x6d9/0x890
[   51.725979][    C0]  __dentry_kill+0x436/0x660
[   51.730536][    C0]  dentry_kill+0xb9/0x2d0
[   51.734907][    C0]  dput+0xd5/0x1b0
[   51.738655][    C0]  simple_recursive_removal+0x295/0x8e0
[   51.744283][    C0]  ? debugfs_remove+0x70/0x70
[   51.748935][    C0]  debugfs_remove+0x56/0x70
[   51.753415][    C0]  ieee80211_debugfs_remove_netdev+0x4e/0xb0
[   51.759395][    C0]  ieee80211_if_change_type+0x215/0xe60
[   51.765032][    C0]  ? trace_rdev_return_void+0x7a/0x190
[   51.770486][    C0]  ? ieee80211_set_cqm_rssi_range_config+0x220/0x220
[   51.777136][    C0]  ? cfg80211_mgmt_registrations_update+0x5dc/0x7d0
[   51.783695][    C0]  ieee80211_change_iface+0x57/0x420
[   51.788958][    C0]  cfg80211_change_iface+0x73c/0xe50
[   51.794219][    C0]  nl80211_set_interface+0x43e/0x750
[   51.799488][    C0]  genl_rcv_msg+0xb22/0xdd0
[   51.803966][    C0]  ? nl80211_dump_interface+0x630/0x630
[   51.809481][    C0]  netlink_rcv_skb+0x187/0x390
[   51.814303][    C0]  ? genl_bind+0x2c0/0x2c0
[   51.818688][    C0]  genl_rcv+0x24/0x40
[   51.822639][    C0]  netlink_unicast+0x7b7/0x9b0
[   51.827389][    C0]  netlink_sendmsg+0x968/0xb50
[   51.832154][    C0]  ? netlink_getsockopt+0x4f0/0x4f0
[   51.837345][    C0]  __sock_sendmsg+0x15c/0x170
[   51.842085][    C0]  __sys_sendto+0x323/0x430
[   51.846568][    C0]  __x64_sys_sendto+0xda/0xf0
[   51.851220][    C0]  do_syscall_64+0x34/0x50
[   51.855606][    C0]  entry_SYSCALL_64_after_hwframe+0x67/0xd1
[   51.861556][    C0] RIP: 0033:0x7f971276aa3c
[   51.866054][    C0] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
[   51.885718][    C0] RSP: 002b:00007ffd4d7d3b30 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[   51.894103][    C0] RAX: ffffffffffffffda RBX: 00007f97134de620 RCX: 00007f971276aa3c
[   51.902132][    C0] RDX: 0000000000000024 RSI: 00007f97134de670 RDI: 0000000000000003
[   51.910076][    C0] RBP: 0000000000000000 R08: 00007ffd4d7d3b84 R09: 000000000000000c
[   51.918102][    C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
[   51.926045][    C0] R13: 0000000000000000 R14: 00007f97134de670 R15: 0000000000000000
[   51.934253][    C0] Kernel Offset: disabled
[   51.938567][    C0] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build210064581=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at e2beed91937
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=e2beed91937c0ace342f19a2e9afb67adb3a828a -X github.com/google/syzkaller/prog.gitRevisionDate=20250911-084951"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=e2beed91937c0ace342f19a2e9afb67adb3a828a -X github.com/google/syzkaller/prog.gitRevisionDate=20250911-084951"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=e2beed91937c0ace342f19a2e9afb67adb3a828a -X github.com/google/syzkaller/prog.gitRevisionDate=20250911-084951"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e2beed91937c0ace342f19a2e9afb67adb3a828a\"
/usr/bin/ld: /tmp/cczDeOCJ.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14e3db04580000


Tested on:

commit:         d3d0b4e2 Linux 5.10.245
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-5.10.y
kernel config:  https://syzkaller.appspot.com/x/.config?x=39182a54870857eb
dashboard link: https://syzkaller.appspot.com/bug?extid=b20bbf680bb0f2ecedae
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13bc7734580000