Re: [BUG] nilfs2: slab-out-of-bounds read in nilfs_direct_propagate

Hi Shuangpeng,

On Fri, 2026-03-27 at 16:42 -0400, Shuangpeng wrote:
> Hi Kernel Maintainers,
> 
> I hit the following KASAN report while testing current upstream kernel:
> 
> KASAN: slab-out-of-bounds in nilfs_direct_propagate
> 
> on commit: bbeb83d3182abe0d245318e274e8531e5dd7a948 (Mar 24 2026)
> 
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/d1df8da98f957e101dd5d580b7f82215
> 
> 
> I’m happy to test debug patches or provide additional information.
> 
> Reported-by: Shuangpeng Bai <[email protected]>
> 
> 
> [   80.873778][ T8573] ==================================================================
> [   80.874653][ T8573] BUG: KASAN: slab-out-of-bounds in nilfs_direct_propagate (fs/nilfs2/direct.c:26 fs/nilfs2/direct.c:275)
> [   80.875485][ T8573] Read of size 8 at addr ffff888178c4bd38 by task segctord/8573
> [   80.876255][ T8573]
> [   80.876511][ T8573] CPU: 1 UID: 0 PID: 8573 Comm: segctord Not tainted 7.0.0-rc5-00051-gbbeb83d3182a #35 PREEMPT(f
> [   80.876520][ T8573] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [   80.876527][ T8573] Call Trace:
> [   80.876531][ T8573]  <TASK>
> [   80.876534][ T8573]  dump_stack_lvl (lib/dump_stack.c:122)
> [   80.876544][ T8573]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [   80.876608][ T8573]  kasan_report (mm/kasan/report.c:597)
> [   80.876627][ T8573]  nilfs_direct_propagate (fs/nilfs2/direct.c:26 fs/nilfs2/direct.c:275)
> [   80.876721][ T8573]  nilfs_bmap_propagate (fs/nilfs2/bmap.c:329)
> [   80.876740][ T8573]  nilfs_segctor_apply_buffers (fs/nilfs2/segment.c:1010)
> [   80.876752][ T8573]  nilfs_segctor_scan_file (fs/nilfs2/segment.c:1072)
> [   80.876822][ T8573]  nilfs_segctor_do_construct (fs/nilfs2/segment.c:1223 fs/nilfs2/segment.c:1547 fs/nilfs2/segment.c:2122)
> [   80.876964][ T8573]  nilfs_segctor_construct (fs/nilfs2/segment.c:2464)
> [   80.876975][ T8573]  nilfs_segctor_thread (fs/nilfs2/segment.c:? fs/nilfs2/segment.c:2684)
> [   80.877059][ T8573]  kthread (kernel/kthread.c:437)
> [   80.877072][ T8573]  ret_from_fork (arch/x86/kernel/process.c:164)
> [   80.877106][ T8573]  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
> [   80.877118][ T8573]  </TASK>
> [   80.877121][ T8573]
> [   80.913570][ T8573] Allocated by task 8571 on cpu 1 at 80.799594s:
> [   80.914266][ T8573]  kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)
> [   80.914762][ T8573]  __kasan_slab_alloc (mm/kasan/common.c:369)
> [   80.915266][ T8573]  kmem_cache_alloc_lru_noprof (./include/linux/kasan.h:253 mm/slub.c:4538 mm/slub.c:4866 mm/slub.c:4885)
> [   80.915870][ T8573]  nilfs_alloc_inode (fs/nilfs2/super.c:159)
> [   80.916370][ T8573]  alloc_inode (fs/inode.c:?)
> [   80.916825][ T8573]  iget5_locked (fs/inode.c:1390)
> [   80.917312][ T8573]  nilfs_iget (fs/nilfs2/inode.c:562)
> [   80.917775][ T8573]  nilfs_get_root_dentry (fs/nilfs2/super.c:915)
> [   80.918328][ T8573]  nilfs_fill_super (fs/nilfs2/super.c:1099)
> [   80.918837][ T8573]  nilfs_get_tree (fs/nilfs2/super.c:1229)
> [   80.919328][ T8573]  vfs_get_tree (fs/super.c:1754)
> [   80.919791][ T8573]  do_new_mount (fs/namespace.c:1194 fs/namespace.c:3763 fs/namespace.c:3839)
> [   80.920264][ T8573]  __se_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338)
> [   80.920754][ T8573]  do_syscall_64 (arch/x86/entry/syscall_64.c:?)
> [   80.921228][ T8573]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [   80.921870][ T8573]
> [   80.922121][ T8573] The buggy address belongs to the object at ffff888178c4b930
> [   80.922121][ T8573]  which belongs to the cache nilfs2_inode_cache of size 848
> [   80.923593][ T8573] The buggy address is located 184 bytes to the right of
> [   80.923593][ T8573]  allocated 848-byte region [ffff888178c4b930, ffff888178c4bc80)
> [   80.925065][ T8573]
> [   80.925315][ T8573] The buggy address belongs to the physical page:
> [   80.926011][ T8573] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x178c48
> [   80.926913][ T8573] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [   80.927770][ T8573] memcg:ffff888178c4bd01
> [   80.928208][ T8573] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
> [   80.928994][ T8573] page_type: f5(slab)
> [   80.929411][ T8573] raw: 017ff00000000040 ffff88810dab5c80 dead000000000100 dead000000000122
> [   80.930318][ T8573] raw: 0000000000000000 0000000800100010 00000000f5000000 ffff888178c4bd01
> [   80.931195][ T8573] head: 017ff00000000040 ffff88810dab5c80 dead000000000100 dead000000000122
> [   80.932076][ T8573] head: 0000000000000000 0000000800100010 00000000f5000000 ffff888178c4bd01
> [   80.932957][ T8573] head: 017ff00000000002 ffffea0005e31201 00000000ffffffff 00000000ffffffff
> [   80.933864][ T8573] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
> [   80.934742][ T8573] page dumped because: kasan: bad access detected
> [   80.935400][ T8573] page_owner tracks the page as allocated
> [   80.935991][ T8573] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_RECLAIMABLE|_9
> [   80.938243][ T8573]  post_alloc_hook (./include/linux/page_owner.h:? mm/page_alloc.c:1889)
> [   80.938742][ T8573]  get_page_from_freelist (mm/page_alloc.c:? mm/page_alloc.c:3962)
> [   80.939318][ T8573]  __alloc_frozen_pages_noprof (mm/page_alloc.c:5250)
> [   80.939923][ T8573]  allocate_slab (mm/slub.c:3294 mm/slub.c:3481)
> [   80.940398][ T8573]  refill_objects (mm/slub.c:7176)
> [   80.940889][ T8573]  __pcs_replace_empty_main (mm/slub.c:2815 mm/slub.c:2834 mm/slub.c:4626)
> [   80.941462][ T8573]  kmem_cache_alloc_lru_noprof (mm/slub.c:4718 mm/slub.c:4851 mm/slub.c:4885)
> [   80.942092][ T8573]  nilfs_alloc_inode (fs/nilfs2/super.c:159)
> [   80.942592][ T8573]  alloc_inode (fs/inode.c:?)
> [   80.943045][ T8573]  iget5_locked (fs/inode.c:1390)
> [   80.943502][ T8573]  nilfs_attach_btree_node_cache (fs/nilfs2/inode.c:632)
> [   80.944120][ T8573]  nilfs_btree_convert_and_insert (fs/nilfs2/btree.c:1762 fs/nilfs2/btree.c:1902)
> [   80.944749][ T8573]  nilfs_bmap_insert (fs/nilfs2/bmap.c:118 fs/nilfs2/bmap.c:149)
> [   80.945263][ T8573]  nilfs_mdt_get_block (fs/nilfs2/mdt.c:46 fs/nilfs2/mdt.c:95 fs/nilfs2/mdt.c:258)
> [   80.945821][ T8573]  nilfs_cpfile_create_checkpoint (fs/nilfs2/cpfile.c:? fs/nilfs2/cpfile.c:330)
> [   80.946451][ T8573]  nilfs_segctor_do_construct (fs/nilfs2/segment.c:1250 fs/nilfs2/segment.c:1547 fs/nilfs2/segment.c:2122)
> [   80.947065][ T8573] page last free pid 1 tgid 1 stack trace:
> [  80.947665][ T8573]  __free_frozen_pages (./include/linux/page_owner.h:? mm/page_alloc.c:1433 mm/page_alloc.c:2978)
> [   80.948197][ T8573]  free_contig_range (mm/page_alloc.c:7373)
> [   80.948699][ T8573]  destroy_args (mm/debug_vm_pgtable.c:995)
> [   80.949174][ T8573]  debug_vm_pgtable (mm/debug_vm_pgtable.c:?)
> [   80.949695][ T8573]  do_one_initcall (init/main.c:?)
> [   80.950213][ T8573]  do_initcall_level (init/main.c:1443)
> [   80.950721][ T8573]  do_initcalls (init/main.c:1457)
> [   80.951173][ T8573]  kernel_init_freeable (init/main.c:1696)
> [   80.951714][ T8573]  kernel_init (init/main.c:1584)
> [   80.952167][ T8573]  ret_from_fork (arch/x86/kernel/process.c:164)
> [   80.952651][ T8573]  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
> [   80.953151][ T8573]
> [   80.953400][ T8573] Memory state around the buggy address:
> [   80.954002][ T8573]  ffff888178c4bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [   80.954819][ T8573]  ffff888178c4bc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [   80.955641][ T8573] >ffff888178c4bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [   80.956460][ T8573]                                         ^
> [   80.957067][ T8573]  ffff888178c4bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [   80.957917][ T8573]  ffff888178c4be00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [   80.958920][ T8541] ==================================================================
> 

Thank you for the report. Could you please create an issue here [1]?

Thanks,
Slava.

[1] https://github.com/nilfs-dev/nilfs2/issues