==================================================================
BUG: KASAN: use-after-free in F2FS_SB fs/f2fs/f2fs.h:1982 [inline]
BUG: KASAN: use-after-free in F2FS_I_SB fs/f2fs/f2fs.h:1987 [inline]
BUG: KASAN: use-after-free in F2FS_M_SB fs/f2fs/f2fs.h:1992 [inline]
BUG: KASAN: use-after-free in F2FS_P_SB fs/f2fs/f2fs.h:1997 [inline]
BUG: KASAN: use-after-free in f2fs_release_page+0x22a/0x7c0 fs/f2fs/data.c:3698
Read of size 8 at addr ffff8881124213c8 by task syz-executor.5/7251
CPU: 1 PID: 7251 Comm: syz-executor.5 Tainted: G W 5.15.141-syzkaller-00899-g28e3f5851a99 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
F2FS_SB fs/f2fs/f2fs.h:1982 [inline]
F2FS_I_SB fs/f2fs/f2fs.h:1987 [inline]
F2FS_M_SB fs/f2fs/f2fs.h:1992 [inline]
F2FS_P_SB fs/f2fs/f2fs.h:1997 [inline]
f2fs_release_page+0x22a/0x7c0 fs/f2fs/data.c:3698
try_to_release_page+0x194/0x1f0 mm/filemap.c:4028
shrink_page_list+0x1fd4/0x5c50 mm/vmscan.c:1762
shrink_inactive_list mm/vmscan.c:2304 [inline]
shrink_list mm/vmscan.c:2549 [inline]
shrink_lruvec+0x17ec/0x4580 mm/vmscan.c:5752
shrink_node_memcgs mm/vmscan.c:5944 [inline]
shrink_node+0x1077/0x24e0 mm/vmscan.c:5974
shrink_zones mm/vmscan.c:6177 [inline]
do_try_to_free_pages+0x5b6/0x1570 mm/vmscan.c:6235
try_to_free_mem_cgroup_pages+0x36c/0x850 mm/vmscan.c:6549
try_charge_memcg+0x48f/0x1550 mm/memcontrol.c:2686
try_charge mm/memcontrol.c:2811 [inline]
charge_memcg+0x6b/0x1a0 mm/memcontrol.c:6814
__mem_cgroup_charge+0x37/0x130 mm/memcontrol.c:6850
mem_cgroup_charge include/linux/memcontrol.h:715 [inline]
__add_to_page_cache_locked+0x2d1/0xa20 mm/filemap.c:892
add_to_page_cache_lru+0x11b/0x2c0 mm/filemap.c:984
pagecache_get_page+0xbe1/0xeb0 mm/filemap.c:1951
grab_cache_page_write_begin+0x5d/0xa0 mm/filemap.c:3788
ext4_da_write_begin+0x5ae/0xc30 fs/ext4/inode.c:3003
generic_perform_write+0x2bc/0x5a0 mm/filemap.c:3834
ext4_buffered_write_iter+0x48a/0x610 fs/ext4/file.c:270
ext4_file_write_iter+0x443/0x1c80
__kernel_write+0x5ab/0xa60 fs/read_write.c:539
__dump_emit+0x261/0x3a0 fs/coredump.c:875
dump_emit+0x381/0x3f0 fs/coredump.c:912
dump_user_range+0x86/0x1c0 fs/coredump.c:949
elf_core_dump+0x3663/0x3e80 fs/binfmt_elf.c:2285
do_coredump+0x1834/0x3050 fs/coredump.c:826
get_signal+0x4c8/0x1630 kernel/signal.c:2882
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
irqentry_exit_to_user_mode+0x9/0x20 kernel/entry/common.c:314
irqentry_exit+0x12/0x40 kernel/entry/common.c:405
exc_page_fault+0x47a/0x830 arch/x86/mm/fault.c:1608
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0xa025ca
Code: Unable to access opcode bytes at RIP 0xa025a0.
RSP: 002b:00000000200003b8 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fc0efdc3050 RCX: 00007fc0efca3ce9
RDX: 0000000020000100 RSI: 00000000200003b0 RDI: 0000000020820080
RBP: 00007fc0efcf047a R08: 0000000020000180 R09: 0000000020000180
R10: 0000000020000140 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000000000b R14: 00007fc0efdc3050 R15: 00007fffdd524638
</TASK>
Allocated by task 6897:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
__kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:466
kasan_slab_alloc include/linux/kasan.h:217 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550
slab_alloc_node mm/slub.c:3240 [inline]
slab_alloc mm/slub.c:3248 [inline]
kmem_cache_alloc+0xf5/0x200 mm/slub.c:3253
mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
mempool_alloc+0x149/0x550 mm/mempool.c:393
sg_pool_alloc+0xa4/0xd0 lib/sg_pool.c:67
__sg_alloc_table+0xbd/0x3a0 lib/scatterlist.c:318
sg_alloc_table_chained+0xea/0x1d0 lib/sg_pool.c:133
scsi_alloc_sgtables+0x288/0x940 drivers/scsi/scsi_lib.c:1003
sd_setup_read_write_cmnd drivers/scsi/sd.c:1230 [inline]
sd_init_command+0xbd1/0x2700 drivers/scsi/sd.c:1356
scsi_prepare_cmd drivers/scsi/scsi_lib.c:1576 [inline]
scsi_queue_rq+0x17f0/0x29e0 drivers/scsi/scsi_lib.c:1671
blk_mq_dispatch_rq_list+0xac4/0x1f30 block/blk-mq.c:1374
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:200 [inline]
blk_mq_do_dispatch_sched+0x755/0xd50 block/blk-mq-sched.c:214
__blk_mq_sched_dispatch_requests+0x39b/0x490
blk_mq_sched_dispatch_requests+0xf0/0x160 block/blk-mq-sched.c:366
__blk_mq_run_hw_queue+0xe5/0x170 block/blk-mq.c:1499
__blk_mq_delay_run_hw_queue+0x11b/0x580 block/blk-mq.c:1576
blk_mq_run_hw_queue+0x2a0/0x3c0 block/blk-mq.c:1629
blk_mq_sched_insert_requests+0x1b7/0x330 block/blk-mq-sched.c:519
blk_mq_flush_plug_list+0x5d8/0x7c0 block/blk-mq.c:1953
blk_flush_plug_list+0x44b/0x490 block/blk-core.c:1745
blk_mq_submit_bio+0xe29/0x1ea0 block/blk-mq.c:2278
__submit_bio+0x829/0x930 block/blk-core.c:927
__submit_bio_noacct_mq block/blk-core.c:1007 [inline]
submit_bio_noacct+0xa39/0xb20 block/blk-core.c:1037
submit_bio+0x2dd/0x560 block/blk-core.c:1099
ext4_io_submit fs/ext4/page-io.c:381 [inline]
io_submit_add_bh fs/ext4/page-io.c:425 [inline]
ext4_bio_write_page+0x1172/0x1a10 fs/ext4/page-io.c:553
mpage_submit_page+0x18e/0x230 fs/ext4/inode.c:2114
mpage_map_and_submit_buffers fs/ext4/inode.c:2362 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2501 [inline]
ext4_writepages+0x2069/0x4000 fs/ext4/inode.c:2830
do_writepages+0x40e/0x670 mm/page-writeback.c:2366
filemap_fdatawrite_wbc+0x248/0x2a0 mm/filemap.c:400
__filemap_fdatawrite_range mm/filemap.c:433 [inline]
__filemap_fdatawrite mm/filemap.c:439 [inline]
filemap_flush+0x10c/0x150 mm/filemap.c:466
ext4_alloc_da_blocks+0x77/0x1a0 fs/ext4/inode.c:3152
ext4_release_file+0x84/0x310 fs/ext4/file.c:143
__fput+0x3fe/0x910 fs/file_table.c:280
____fput+0x15/0x20 fs/file_table.c:308
task_work_run+0x129/0x190 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xc48/0x2ca0 kernel/exit.c:878
do_group_exit+0x141/0x310 kernel/exit.c:1000
get_signal+0x7a3/0x1630 kernel/signal.c:2896
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
irqentry_exit_to_user_mode+0x9/0x20 kernel/entry/common.c:314
irqentry_exit+0x12/0x40 kernel/entry/common.c:405
exc_page_fault+0x47a/0x830 arch/x86/mm/fault.c:1608
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
The buggy address belongs to the object at ffff888112421100
which belongs to the cache sgpool-64 of size 2048
The buggy address is located 712 bytes inside of
2048-byte region [ffff888112421100, ffff888112421900)
The buggy address belongs to the page:
page:ffffea0004490800 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888112424400 pfn:0x112420
head:ffffea0004490800 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 ffffea0004a33800 0000000200000002 ffff8881027bca80
raw: ffff888112424400 00000000800f0000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6350, ts 2412310814019, free_ts 2412280932245
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2604
prep_new_page+0x1b/0x110 mm/page_alloc.c:2610
get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4484
__alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5776
allocate_slab mm/slub.c:1932 [inline]
new_slab+0x9a/0x4e0 mm/slub.c:1995
___slab_alloc+0x39e/0x830 mm/slub.c:3028
__slab_alloc+0x4a/0x90 mm/slub.c:3115
slab_alloc_node mm/slub.c:3206 [inline]
slab_alloc mm/slub.c:3248 [inline]
kmem_cache_alloc+0x134/0x200 mm/slub.c:3253
mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
mempool_alloc+0x149/0x550 mm/mempool.c:393
sg_pool_alloc+0xa4/0xd0 lib/sg_pool.c:67
__sg_alloc_table+0xbd/0x3a0 lib/scatterlist.c:318
sg_alloc_table_chained+0xea/0x1d0 lib/sg_pool.c:133
scsi_alloc_sgtables+0x288/0x940 drivers/scsi/scsi_lib.c:1003
sd_setup_read_write_cmnd drivers/scsi/sd.c:1230 [inline]
sd_init_command+0xbd1/0x2700 drivers/scsi/sd.c:1356
scsi_prepare_cmd drivers/scsi/scsi_lib.c:1576 [inline]
scsi_queue_rq+0x17f0/0x29e0 drivers/scsi/scsi_lib.c:1671
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1471 [inline]
free_pcp_prepare mm/page_alloc.c:1543 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3533
free_unref_page+0xe8/0x750 mm/page_alloc.c:3615
free_the_page mm/page_alloc.c:804 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5852
__free_slab+0xec/0x1d0 mm/slub.c:2020
free_slab mm/slub.c:2035 [inline]
discard_slab mm/slub.c:2041 [inline]
__unfreeze_partials+0x165/0x1a0 mm/slub.c:2527
put_cpu_partial+0xc4/0x120 mm/slub.c:2607
__slab_free+0x1c8/0x290 mm/slub.c:3388
do_slab_free mm/slub.c:3507 [inline]
___cache_free+0x109/0x120 mm/slub.c:3526
qlink_free+0x4d/0x90 mm/kasan/quarantine.c:157
qlist_free_all+0x44/0xb0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x15a/0x180 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:443
kasan_slab_alloc include/linux/kasan.h:217 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550
slab_alloc_node mm/slub.c:3240 [inline]
slab_alloc mm/slub.c:3248 [inline]
__kmalloc+0x11e/0x270 mm/slub.c:4423
kmalloc_array include/linux/slab.h:643 [inline]
kcalloc include/linux/slab.h:672 [inline]
ext4_find_extent+0x370/0xdb0 fs/ext4/extents.c:907
ext4_ext_map_blocks+0x254/0x7250 fs/ext4/extents.c:4103
Memory state around the buggy address:
ffff888112421280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112421300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888112421380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888112421400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112421480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
general protection fault, probably for non-canonical address 0xdffffe00000000e3: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000100000000718-0x000010000000071f]
CPU: 1 PID: 7251 Comm: syz-executor.5 Tainted: G B W 5.15.141-syzkaller-00899-g28e3f5851a99 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:f2fs_release_page+0x23a/0x7c0 fs/f2fs/data.c:3698
Code: 00 4c 03 23 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 56 86 8b ff bb 18 07 00 00 49 03 1c 24 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 3c 05 00 00 44 8b 23 bb 00 00 00 40 be
RSP: 0018:ffffc90001025648 EFLAGS: 00010202
RAX: 00000200000000e3 RBX: 0000100000000718 RCX: ffff88811585bb40
RDX: 0000000000000000 RSI: 0000000000000296 RDI: 00000000ffffffff
RBP: ffffc90001025688 R08: ffffffff81416b8b R09: 0000000000000003
R10: fffffbfff0e5204c R11: dffffc0000000001 R12: ffff8881124213c8
R13: 4000000000002005 R14: dffffc0000000000 R15: ffffea00045e4640
FS: 00007fc0eea056c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556956430 CR3: 0000000173fc2000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
try_to_release_page+0x194/0x1f0 mm/filemap.c:4028
shrink_page_list+0x1fd4/0x5c50 mm/vmscan.c:1762
shrink_inactive_list mm/vmscan.c:2304 [inline]
shrink_list mm/vmscan.c:2549 [inline]
shrink_lruvec+0x17ec/0x4580 mm/vmscan.c:5752
shrink_node_memcgs mm/vmscan.c:5944 [inline]
shrink_node+0x1077/0x24e0 mm/vmscan.c:5974
shrink_zones mm/vmscan.c:6177 [inline]
do_try_to_free_pages+0x5b6/0x1570 mm/vmscan.c:6235
try_to_free_mem_cgroup_pages+0x36c/0x850 mm/vmscan.c:6549
try_charge_memcg+0x48f/0x1550 mm/memcontrol.c:2686
try_charge mm/memcontrol.c:2811 [inline]
charge_memcg+0x6b/0x1a0 mm/memcontrol.c:6814
__mem_cgroup_charge+0x37/0x130 mm/memcontrol.c:6850
mem_cgroup_charge include/linux/memcontrol.h:715 [inline]
__add_to_page_cache_locked+0x2d1/0xa20 mm/filemap.c:892
add_to_page_cache_lru+0x11b/0x2c0 mm/filemap.c:984
pagecache_get_page+0xbe1/0xeb0 mm/filemap.c:1951
grab_cache_page_write_begin+0x5d/0xa0 mm/filemap.c:3788
ext4_da_write_begin+0x5ae/0xc30 fs/ext4/inode.c:3003
generic_perform_write+0x2bc/0x5a0 mm/filemap.c:3834
ext4_buffered_write_iter+0x48a/0x610 fs/ext4/file.c:270
ext4_file_write_iter+0x443/0x1c80
__kernel_write+0x5ab/0xa60 fs/read_write.c:539
__dump_emit+0x261/0x3a0 fs/coredump.c:875
dump_emit+0x381/0x3f0 fs/coredump.c:912
dump_user_range+0x86/0x1c0 fs/coredump.c:949
elf_core_dump+0x3663/0x3e80 fs/binfmt_elf.c:2285
do_coredump+0x1834/0x3050 fs/coredump.c:826
get_signal+0x4c8/0x1630 kernel/signal.c:2882
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
irqentry_exit_to_user_mode+0x9/0x20 kernel/entry/common.c:314
irqentry_exit+0x12/0x40 kernel/entry/common.c:405
exc_page_fault+0x47a/0x830 arch/x86/mm/fault.c:1608
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0xa025ca
Code: Unable to access opcode bytes at RIP 0xa025a0.
RSP: 002b:00000000200003b8 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fc0efdc3050 RCX: 00007fc0efca3ce9
RDX: 0000000020000100 RSI: 00000000200003b0 RDI: 0000000020820080
RBP: 00007fc0efcf047a R08: 0000000020000180 R09: 0000000020000180
R10: 0000000020000140 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000000000b R14: 00007fc0efdc3050 R15: 00007fffdd524638
</TASK>
Modules linked in:
---[ end trace 578baa65e5438bd3 ]---
RIP: 0010:f2fs_release_page+0x23a/0x7c0 fs/f2fs/data.c:3698
Code: 00 4c 03 23 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 56 86 8b ff bb 18 07 00 00 49 03 1c 24 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 3c 05 00 00 44 8b 23 bb 00 00 00 40 be
RSP: 0018:ffffc90001025648 EFLAGS: 00010202
RAX: 00000200000000e3 RBX: 0000100000000718 RCX: ffff88811585bb40
RDX: 0000000000000000 RSI: 0000000000000296 RDI: 00000000ffffffff
RBP: ffffc90001025688 R08: ffffffff81416b8b R09: 0000000000000003
R10: fffffbfff0e5204c R11: dffffc0000000001 R12: ffff8881124213c8
R13: 4000000000002005 R14: dffffc0000000000 R15: ffffea00045e4640
FS: 00007fc0eea056c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555671a838 CR3: 0000000173fc2000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 4c 03 23 add %cl,0x23(%rbx,%rax,1)
4: 4c 89 e0 mov %r12,%rax
7: 48 c1 e8 03 shr $0x3,%rax
b: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
10: 74 08 je 0x1a
12: 4c 89 e7 mov %r12,%rdi
15: e8 56 86 8b ff call 0xff8b8670
1a: bb 18 07 00 00 mov $0x718,%ebx
1f: 49 03 1c 24 add (%r12),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 3c 05 00 00 jne 0x573
37: 44 8b 23 mov (%rbx),%r12d
3a: bb 00 00 00 40 mov $0x40000000,%ebx
3f: be .byte 0xbe