KASAN: use-after-free Read in ext4_put

similar bugs (3):
Kernel	Title	Repro	Fix bisect	Count	Last	Reported	Patched	Status
android-54	KASAN: use-after-free Read in ext4_put_super ext4	C		10	16d	659d	0/2	upstream: reported C repro on 2021/04/17 06:50
linux-4.19	KASAN: use-after-free Write in ext4_put_super ext4	C	error	10	3d06h	133d	0/1	upstream: reported C repro on 2022/09/25 13:27
upstream	KASAN: use-after-free Write in ext4_put_super			1	660d	656d	0/24	auto-closed as invalid on 2021/08/14 16:30
EXT4-fs (loop0): re-mounted. Opts: (null)
EXT4-fs (loop2): re-mounted. Opts: (null)
EXT4-fs (loop0): re-mounted. Opts: (null)
EXT4-fs warning (device loop5): ext4_multi_mount_protect:325: MMP startup interrupted, failing mount
==================================================================
BUG: KASAN: use-after-free in to_kthread kernel/kthread.c:71 [inline]
BUG: KASAN: use-after-free in kthread_stop+0x591/0x640 kernel/kthread.c:551
Read of size 4 at addr ffff8880a05a8164 by task syz-executor.5/7998

CPU: 1 PID: 7998 Comm: syz-executor.5 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
print_req_error: I/O error, dev loop3, sector 0
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429
EXT4-fs (loop0): re-mounted. Opts: (null)
 to_kthread kernel/kthread.c:71 [inline]
 kthread_stop+0x591/0x640 kernel/kthread.c:551
EXT4-fs (loop1): re-mounted. Opts: (null)
 ext4_put_super+0x865/0xf00 fs/ext4/super.c:988
 generic_shutdown_super+0x144/0x370 fs/super.c:446
 kill_block_super+0x95/0xe0 fs/super.c:1161
 deactivate_locked_super+0x6c/0xd0 fs/super.c:319
 deactivate_super+0x7f/0xa0 fs/super.c:350
EXT4-fs (loop0): re-mounted. Opts: (null)
 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
 do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f6d58634a17
RSP: 002b:00007fff22d29278 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6d58634a17
RDX: 00007fff22d2934a RSI: 000000000000000a RDI: 00007fff22d29340
RBP: 00007fff22d29340 R08: 00000000ffffffff R09: 00007fff22d29110
R10: 00005555571d6903 R11: 0000000000000246 R12: 00007f6d5868d5f6
R13: 00007fff22d2a400 R14: 00005555571d6810 R15: 00007fff22d2a440

Allocated by task 2:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
EXT4-fs (loop1): re-mounted. Opts: (null)
 kmem_cache_alloc_node+0x146/0x410 mm/slab.c:3642
 alloc_task_struct_node kernel/fork.c:156 [inline]
 dup_task_struct kernel/fork.c:515 [inline]
 copy_process.part.0+0x17d3/0x71c0 kernel/fork.c:1631
 copy_process kernel/fork.c:1606 [inline]
 _do_fork+0x184/0xc80 kernel/fork.c:2092
 kernel_thread+0x2f/0x40 kernel/fork.c:2154
 create_kthread kernel/kthread.c:255 [inline]
 kthreadd+0x51a/0x770 kernel/kthread.c:592
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Freed by task 18:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758
 __put_task_struct+0x276/0x470 kernel/fork.c:420
 put_task_struct include/linux/sched/task.h:98 [inline]
 delayed_put_task_struct+0x1fb/0x2e0 kernel/exit.c:180
 __rcu_reclaim kernel/rcu/rcu.h:195 [inline]
 rcu_do_batch kernel/rcu/tree.c:2699 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
 rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946
 __do_softirq+0x24d/0x9ff kernel/softirq.c:288

The buggy address belongs to the object at ffff8880a05a8140
 which belongs to the cache task_struct of size 6144
The buggy address is located 36 bytes inside of
 6144-byte region [ffff8880a05a8140, ffff8880a05a9940)
The buggy address belongs to the page:
print_req_error: I/O error, dev loop2, sector 0
page:ffffea0002816a00 count:1 mapcount:0 mapping:ffff8880a05a8140 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffff8880a05a8140 0000000000000000 0000000100000001
raw: ffffea000287b6a0 ffffea00023c21a0 ffff88823f8307c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a05a8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a05a8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
print_req_error: I/O error, dev loop4, sector 0
>ffff8880a05a8100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                                       ^
 ffff8880a05a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880a05a8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================