[v5.15] KASAN: user-memory-access Write in __destroy_inode

Hello,

syzbot found the following issue on:

HEAD commit: 1fe619a7d252 Linux 5.15.113
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14cb3bb9280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab36330fd14820aa
dashboard link: https://syzkaller.appspot.com/bug?extid=8cc84e9be19865da71db
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16203df5280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17bf1a69280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2d1716ac5a07/disk-1fe619a7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9e9e3ef13603/vmlinux-1fe619a7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/810a025eede3/bzImage-1fe619a7.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6b6b787efc4d/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 6
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 7
==================================================================
BUG: KASAN: user-memory-access in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: user-memory-access in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:167 [inline]
BUG: KASAN: user-memory-access in __refcount_sub_and_test include/linux/refcount.h:272 [inline]
BUG: KASAN: user-memory-access in __refcount_dec_and_test include/linux/refcount.h:315 [inline]
BUG: KASAN: user-memory-access in refcount_dec_and_test include/linux/refcount.h:333 [inline]
BUG: KASAN: user-memory-access in posix_acl_release include/linux/posix_acl.h:57 [inline]
BUG: KASAN: user-memory-access in __destroy_inode+0x427/0x5e0 fs/inode.c:273
Write of size 4 at addr 0000000b00000000 by task syz-executor394/3499

CPU: 0 PID: 3499 Comm: syz-executor394 Not tainted 5.15.113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:438 [inline]
kasan_report+0x161/0x1c0 mm/kasan/report.c:451
kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:167 [inline]
__refcount_sub_and_test include/linux/refcount.h:272 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
posix_acl_release include/linux/posix_acl.h:57 [inline]
__destroy_inode+0x427/0x5e0 fs/inode.c:273
destroy_inode fs/inode.c:284 [inline]
evict+0x51b/0x620 fs/inode.c:602
dispose_list fs/inode.c:620 [inline]
evict_inodes+0x601/0x6a0 fs/inode.c:670
generic_shutdown_super+0x99/0x2c0 fs/super.c:454
kill_block_super+0x7a/0xe0 fs/super.c:1405
deactivate_locked_super+0xa0/0x110 fs/super.c:335
cleanup_mnt+0x44e/0x500 fs/namespace.c:1143
task_work_run+0x129/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0x6a3/0x2480 kernel/exit.c:872
do_group_exit+0x144/0x310 kernel/exit.c:994
__do_sys_exit_group kernel/exit.c:1005 [inline]
__se_sys_exit_group kernel/exit.c:1003 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f0afa8dca59
Code: Unable to access opcode bytes at RIP 0x7f0afa8dca2f.
RSP: 002b:00007ffe09a32038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f0afa957330 RCX: 00007f0afa8dca59
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f0afa951e40
R10: 00007f0afa951e40 R11: 0000000000000246 R12: 00007f0afa957330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
</TASK>
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

HEAD commit: d2869ace6eeb Linux 6.1.31
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17431f49280000
kernel config: https://syzkaller.appspot.com/x/.config?x=623aacf949348d7d
dashboard link: https://syzkaller.appspot.com/bug?extid=4b3efe8571247bba411d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1734f82d280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140f58c9280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2ed651ed0d8f/disk-d2869ace.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b8d3199c542c/vmlinux-d2869ace.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a44812549bf7/bzImage-d2869ace.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/746d36c10755/mount_0.gz
Reported-by: [email protected]
BUG: KASAN: user-memory-access in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
BUG: KASAN: user-memory-access in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
BUG: KASAN: user-memory-access in __destroy_inode+0x427/0x5e0 fs/inode.c:296
Write of size 4 at addr 0000000b00000000 by task syz-executor251/3542

CPU: 1 PID: 3542 Comm: syz-executor251 Not tainted 6.1.31-syzkaller #0
print_report+0xe6/0x4f0 mm/kasan/report.c:398
kasan_report+0x136/0x160 mm/kasan/report.c:495
kasan_check_range+0x27f/0x290 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
__destroy_inode+0x427/0x5e0 fs/inode.c:296
destroy_inode fs/inode.c:307 [inline]
evict+0x51b/0x620 fs/inode.c:679
dispose_list fs/inode.c:697 [inline]
evict_inodes+0x601/0x6a0 fs/inode.c:747
generic_shutdown_super+0x94/0x340 fs/super.c:480
kill_block_super+0x7a/0xe0 fs/super.c:1450
deactivate_locked_super+0xa0/0x110 fs/super.c:332
cleanup_mnt+0x490/0x520 fs/namespace.c:1186
task_work_run+0x246/0x300 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x6fb/0x2300 kernel/exit.c:869
do_group_exit+0x202/0x2b0 kernel/exit.c:1019
__do_sys_exit_group kernel/exit.c:1030 [inline]
__se_sys_exit_group kernel/exit.c:1028 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1028
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7faac0b51a59
Code: Unable to access opcode bytes at 0x7faac0b51a2f.
RSP: 002b:00007ffe5d0c5a98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007faac0bcc330 RCX: 00007faac0b51a59
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007faac0bc6e40
R10: 00007faac0bc6e40 R11: 0000000000000246 R12: 00007faac0bcc330