KASAN: use-after-free Read in gfs2

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-5.15	KASAN: use-after-free Read in gfs2_invalidatepage	19				1	281d	281d	0/3	auto-obsoleted due to no activity on 2025/03/07 20:25

R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffee8ace7c0
R13: 00007f1ee482cb55 R14: 00005555712664a8 R15: 00007ffee8acf890
 </TASK>
==================================================================
BUG: KASAN: use-after-free in list_empty include/linux/list.h:290 [inline]
BUG: KASAN: use-after-free in gfs2_discard fs/gfs2/aops.c:656 [inline]
BUG: KASAN: use-after-free in gfs2_invalidatepage+0x4f8/0x830 fs/gfs2/aops.c:693
Read of size 8 at addr ffff888073fba0f8 by task syz-executor/4186

CPU: 1 PID: 4186 Comm: syz-executor Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 list_empty include/linux/list.h:290 [inline]
 gfs2_discard fs/gfs2/aops.c:656 [inline]
 gfs2_invalidatepage+0x4f8/0x830 fs/gfs2/aops.c:693
 do_invalidatepage mm/truncate.c:157 [inline]
 truncate_cleanup_page+0x170/0x420 mm/truncate.c:176
 truncate_inode_pages_range+0x236/0xef0 mm/truncate.c:325
 gfs2_evict_inode+0xa81/0x11f0 fs/gfs2/super.c:1415
 evict+0x485/0x870 fs/inode.c:647
 gfs2_put_super+0x2fe/0x7d0 fs/gfs2/super.c:603
 generic_shutdown_super+0x130/0x300 fs/super.c:475
 kill_block_super+0x7c/0xe0 fs/super.c:1427
 deactivate_locked_super+0x93/0xf0 fs/super.c:335
 cleanup_mnt+0x418/0x4d0 fs/namespace.c:1139
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1ee47abcd7
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffee8acd618 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000064 RCX: 00007f1ee47abcd7
RDX: 0000000000000200 RSI: 0000000000000009 RDI: 00007ffee8ace7c0
RBP: 00007f1ee482cb55 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffee8ace7c0
R13: 00007f1ee482cb55 R14: 00005555712664a8 R15: 00007ffee8acf890
 </TASK>

Allocated by task 4338:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x9c/0xd0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x100/0x290 mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:725 [inline]
 gfs2_alloc_bufdata fs/gfs2/trans.c:168 [inline]
 gfs2_trans_add_data+0x1fd/0x620 fs/gfs2/trans.c:209
 gfs2_unstuffer_page fs/gfs2/bmap.c:83 [inline]
 __gfs2_unstuff_inode fs/gfs2/bmap.c:121 [inline]
 gfs2_unstuff_dinode+0xac0/0x13a0 fs/gfs2/bmap.c:168
 gfs2_adjust_quota+0x234/0x810 fs/gfs2/quota.c:847
 gfs2_set_dqblk+0x96e/0xc10 fs/gfs2/quota.c:1764
 quota_setquota+0x4ac/0x530 fs/quota/quota.c:309
 __do_sys_quotactl fs/quota/quota.c:959 [inline]
 __se_sys_quotactl+0x295/0x6c0 fs/quota/quota.c:915
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 4186:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1705 [inline]
 slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731
 slab_free mm/slub.c:3499 [inline]
 kmem_cache_free+0x8f/0x210 mm/slub.c:3515
 trans_drain fs/gfs2/log.c:1015 [inline]
 gfs2_log_flush+0x1995/0x2610 fs/gfs2/log.c:1155
 gfs2_kill_sb+0x50/0xd0 fs/gfs2/ops_fstype.c:1734
 deactivate_locked_super+0x93/0xf0 fs/super.c:335
 cleanup_mnt+0x418/0x4d0 fs/namespace.c:1139
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff888073fba0e0
 which belongs to the cache gfs2_bufdata of size 80
The buggy address is located 24 bytes inside of
 80-byte region [ffff888073fba0e0, ffff888073fba130)
The buggy address belongs to the page:
page:ffffea0001cfee80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73fba
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888146cd1000
raw: 0000000000000000 0000000080240024 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 4338, ts 62053593006, free_ts 62052103620
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192
 __alloc_pages+0x1e1/0x470 mm/page_alloc.c:5474
 alloc_slab_page mm/slub.c:1775 [inline]
 allocate_slab mm/slub.c:1912 [inline]
 new_slab+0xc0/0x4b0 mm/slub.c:1975
 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3008
 __slab_alloc mm/slub.c:3095 [inline]
 slab_alloc_node mm/slub.c:3186 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x195/0x290 mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:725 [inline]
 gfs2_alloc_bufdata fs/gfs2/trans.c:168 [inline]
 gfs2_trans_add_meta+0x2ec/0x9e0 fs/gfs2/trans.c:250
 init_dinode+0x9c/0xa20 fs/gfs2/inode.c:488
 gfs2_create_inode+0xf3c/0x13b0 fs/gfs2/inode.c:751
 gfs2_atomic_open+0xce/0x210 fs/gfs2/inode.c:1296
 atomic_open fs/namei.c:3325 [inline]
 lookup_open fs/namei.c:3433 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0xe6d/0x2f30 fs/namei.c:3739
 do_filp_open+0x1b3/0x3e0 fs/namei.c:3769
 do_sys_openat2+0x142/0x4a0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x94/0x280 mm/page_alloc.c:3396
 free_slab mm/slub.c:2015 [inline]
 discard_slab mm/slub.c:2021 [inline]
 __unfreeze_partials+0x1a5/0x200 mm/slub.c:2507
 put_cpu_partial+0x12d/0x190 mm/slub.c:2587
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x100/0x290 mm/slub.c:3233
 vm_area_dup+0x1e/0xb0 kernel/fork.c:358
 __split_vma+0xb1/0x410 mm/mmap.c:2726
 mprotect_fixup+0x50c/0x800 mm/mprotect.c:477
 do_mprotect_pkey+0x657/0x910 mm/mprotect.c:636
 __do_sys_mprotect mm/mprotect.c:662 [inline]
 __se_sys_mprotect mm/mprotect.c:659 [inline]
 __x64_sys_mprotect+0x7c/0x90 mm/mprotect.c:659
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff888073fb9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888073fba000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb
>ffff888073fba080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb
                                                                ^
 ffff888073fba100: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
 ffff888073fba180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2025/07/30 07:29	linux-5.15.y	c79648372d02	f8f2b4da	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan	KASAN: use-after-free Read in gfs2_invalidatepage
2025/07/21 11:30	linux-5.15.y	c79648372d02	56d87229	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan-arm64	KASAN: use-after-free Read in gfs2_invalidatepage
2025/06/20 10:19	linux-5.15.y	1c700860e8bc	ed3e87f7	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan-arm64	KASAN: use-after-free Read in gfs2_invalidatepage
2025/05/14 06:37	linux-5.15.y	3b8db0e4f263	7344edeb	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan-arm64	KASAN: use-after-free Read in gfs2_invalidatepage