KASAN: use-after-free Read in ext4_xattr_set

KASAN: use-after-free Read in ext4_xattr_set_entry (3)
Status: upstream: reported on 2020/03/09 05:43
Reported-by: syzbot+15fbdaa8666ea08754f4@syzkaller.appspotmail.com
First crash: 83d, last: 32d

similar bugs (8):
Kernel	Title	Repro	Bisected	Count	Last	Reported	Patched	Status
android-414	KASAN: use-after-free Read in ext4_xattr_set_entry (2)			6	212d	268d	0/1	auto-closed as invalid on 2020/02/28 13:35
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry (2)			1	68d	68d	0/1	upstream: reported on 2020/03/23 03:20
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry			1	673d	673d	0/17	closed as invalid on 2018/07/29 11:55
android-414	KASAN: use-after-free Read in ext4_xattr_set_entry			4	520d	413d	0/1	auto-closed as invalid on 2019/06/26 01:15
linux-4.19	KASAN: use-after-free Read in ext4_xattr_set_entry	syz	fix	10	92d	340d	1/1	fixed on 2020/03/30 09:03
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	C	cause	19	166d	575d	16/17	fixed on 2020/02/14 01:19
android-54	KASAN: use-after-free Read in ext4_xattr_set_entry			3	50d	113d	0/1	upstream: reported on 2020/02/07 21:52
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry	C	fix	9	120d	212d	1/1	fixed on 2020/03/01 21:06

Sample crash report:

EXT4-fs error (device sda1): ext4_xattr_set_entry:1583: inode #15981: comm syz-fuzzer: corrupted xattr entries
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x1863/0x3830 fs/ext4/xattr.c:1714
Read of size 4 at addr ffff888039437ffe by task syz-fuzzer/7011

CPU: 1 PID: 7011 Comm: syz-fuzzer Not tainted 5.7.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1e9/0x30e lib/dump_stack.c:118
 print_address_description+0x74/0x5c0 mm/kasan/report.c:382
 __kasan_report+0x103/0x1a0 mm/kasan/report.c:511
 kasan_report+0x4d/0x80 mm/kasan/common.c:625

The buggy address belongs to the page:
page:ffffea0000e50dc0 refcount:2 mapcount:0 mapping:00000000964a8bf7 index:0x421
def_blk_aops
flags: 0xfffe000000203a(referenced|dirty|lru|active|private)
raw: 00fffe000000203a ffffea00022bab48 ffffea0000e55cc8 ffff88821804eb60
raw: 0000000000000421 ffff888039f180e8 00000002ffffffff ffff88821bb96000
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88821bb96000

Memory state around the buggy address:
 ffff888039437f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888039437f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888039438000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888039438080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888039438100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-smack-root	2020/04/28 06:57	upstream	51184ae3	0ce7569e	.config	log	report			adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, tytso@mit.edu
ci-upstream-kasan-gce-root	2020/03/08 14:27	upstream	c2003765	2e9971bb	.config	log	report			adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, tytso@mit.edu