From: syzbot <syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
yun.zhou@windriver.com
Subject: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbSplit (3)
Date: Tue, 18 Nov 2025 19:16:02 -0800 [thread overview]
Message-ID: <691d3672.a70a0220.2ea503.000a.GAE@google.com> (raw)
In-Reply-To: <0d4d0121-cf1f-4149-9887-f02f03a012ff@windriver.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in release_metapage
loop0: detected capacity change from 0 to 32768
==================================================================
BUG: KASAN: slab-use-after-free in drop_metapage fs/jfs/jfs_metapage.c:312 [inline]
BUG: KASAN: slab-use-after-free in release_metapage+0x738/0xaa0 fs/jfs/jfs_metapage.c:893
Read of size 8 at addr ffff88801fef6120 by task syz.0.591/7013
CPU: 0 UID: 0 PID: 7013 Comm: syz.0.591 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
drop_metapage fs/jfs/jfs_metapage.c:312 [inline]
release_metapage+0x738/0xaa0 fs/jfs/jfs_metapage.c:893
write_metapage fs/jfs/jfs_metapage.h:75 [inline]
flush_metapage fs/jfs/jfs_metapage.h:81 [inline]
ea_write+0x658/0xdd0 fs/jfs/xattr.c:280
ea_put fs/jfs/xattr.c:619 [inline]
__jfs_setxattr+0xa01/0x1120 fs/jfs/xattr.c:792
__jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941
__vfs_setxattr+0x43c/0x480 fs/xattr.c:200
__vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234
vfs_setxattr+0x16b/0x2f0 fs/xattr.c:321
do_setxattr fs/xattr.c:636 [inline]
filename_setxattr+0x274/0x600 fs/xattr.c:665
path_setxattrat+0x364/0x3a0 fs/xattr.c:713
__do_sys_lsetxattr fs/xattr.c:754 [inline]
__se_sys_lsetxattr fs/xattr.c:750 [inline]
__x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:750
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c5938e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7c5a2af038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007f7c595b5fa0 RCX: 00007f7c5938e969
RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000200000000100
RBP: 00007f7c59410ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000fe37 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7c595b5fa0 R15: 00007ffeee4d4ad8
</TASK>
Allocated by task 7013:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
unpoison_slab_object mm/kasan/common.c:342 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:368
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
mempool_alloc_noprof+0x1a7/0x510 mm/mempool.c:406
alloc_metapage fs/jfs/jfs_metapage.c:264 [inline]
__get_metapage+0x509/0xe20 fs/jfs/jfs_metapage.c:761
ea_write+0x5e6/0xdd0 fs/jfs/xattr.c:256
ea_put fs/jfs/xattr.c:619 [inline]
__jfs_setxattr+0xa01/0x1120 fs/jfs/xattr.c:792
__jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941
__vfs_setxattr+0x43c/0x480 fs/xattr.c:200
__vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234
vfs_setxattr+0x16b/0x2f0 fs/xattr.c:321
do_setxattr fs/xattr.c:636 [inline]
filename_setxattr+0x274/0x600 fs/xattr.c:665
path_setxattrat+0x364/0x3a0 fs/xattr.c:713
__do_sys_lsetxattr fs/xattr.c:754 [inline]
__se_sys_lsetxattr fs/xattr.c:750 [inline]
__x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:750
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 73:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2543 [inline]
slab_free mm/slub.c:6642 [inline]
kmem_cache_free+0x19b/0x690 mm/slub.c:6752
free_metapage fs/jfs/jfs_metapage.c:280 [inline]
metapage_release_folio+0x46c/0x5b0 fs/jfs/jfs_metapage.c:637
shrink_folio_list+0x20ac/0x4c70 mm/vmscan.c:1519
evict_folios+0x471e/0x57c0 mm/vmscan.c:4745
try_to_shrink_lruvec+0x8a3/0xb50 mm/vmscan.c:4908
shrink_one+0x21b/0x7c0 mm/vmscan.c:4953
shrink_many mm/vmscan.c:5016 [inline]
lru_gen_shrink_node mm/vmscan.c:5094 [inline]
shrink_node+0x315d/0x3780 mm/vmscan.c:6081
kswapd_shrink_node mm/vmscan.c:6941 [inline]
balance_pgdat mm/vmscan.c:7124 [inline]
kswapd+0x147c/0x2800 mm/vmscan.c:7389
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88801fef60f8
which belongs to the cache jfs_mp of size 184
The buggy address is located 40 bytes inside of
freed 184-byte region [ffff88801fef60f8, ffff88801fef61b0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fef6
anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff8880328a6dc0 ffffea000045e380 dead000000000009
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5825, tgid 5824 (syz.0.19), ts 160783556802, free_ts 160194828150
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:3059 [inline]
allocate_slab+0x96/0x350 mm/slub.c:3232
new_slab mm/slub.c:3286 [inline]
___slab_alloc+0xf56/0x1990 mm/slub.c:4655
__slab_alloc+0x65/0x100 mm/slub.c:4778
__slab_alloc_node mm/slub.c:4854 [inline]
slab_alloc_node mm/slub.c:5276 [inline]
kmem_cache_alloc_noprof+0x3f9/0x6e0 mm/slub.c:5295
mempool_alloc_noprof+0x1a7/0x510 mm/mempool.c:406
alloc_metapage fs/jfs/jfs_metapage.c:264 [inline]
__get_metapage+0x509/0xe20 fs/jfs/jfs_metapage.c:761
diReadSpecial+0x25b/0x710 fs/jfs/jfs_imap.c:447
jfs_mount+0x174/0x870 fs/jfs/jfs_mount.c:108
jfs_fill_super+0x6bc/0xd80 fs/jfs/super.c:523
get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1698
vfs_get_tree+0x92/0x2b0 fs/super.c:1758
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3642 [inline]
do_new_mount+0x302/0xa10 fs/namespace.c:3718
page last free pid 15 tgid 15 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:290
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xcab/0x1770 kernel/rcu/tree.c:2861
handle_softirqs+0x286/0x870 kernel/softirq.c:622
run_ksoftirqd+0x9b/0x100 kernel/softirq.c:1063
smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff88801fef6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801fef6080: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa
>ffff88801fef6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801fef6180: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
ffff88801fef6200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 8b690556 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16b89658580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8a9971d3cfd3619a
dashboard link: https://syzkaller.appspot.com/bug?extid=4c1966e88c28fa96e053
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14b94e0a580000
next parent reply other threads:[~2025-11-19 3:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0d4d0121-cf1f-4149-9887-f02f03a012ff@windriver.com>
2025-11-19 3:16 ` syzbot [this message]
[not found] <87bjmu2vsk.fsf@gmail.com>
2025-09-28 20:14 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbSplit (3) syzbot
2025-04-30 21:08 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=691d3672.a70a0220.2ea503.000a.GAE@google.com \
--to=syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yun.zhou@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.