syzbot

GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
==================================================================
BUG: KASAN: use-after-free in ext4_da_page_release_reservation fs/ext4/inode.c:1670 [inline]
BUG: KASAN: use-after-free in ext4_da_invalidatepage+0xc23/0xe20 fs/ext4/inode.c:3216
Read of size 8 at addr ffff888000c02020 by task syz-executor.3/6482

CPU: 0 PID: 6482 Comm: syz-executor.3 Not tainted 4.19.143-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 ext4_da_page_release_reservation fs/ext4/inode.c:1670 [inline]
 ext4_da_invalidatepage+0xc23/0xe20 fs/ext4/inode.c:3216
 do_invalidatepage mm/truncate.c:165 [inline]
 truncate_cleanup_page+0x3a4/0x580 mm/truncate.c:187
 truncate_inode_pages_range+0x530/0x1b10 mm/truncate.c:367
 ext4_evict_inode+0x4d2/0x1780 fs/ext4/inode.c:249
 evict+0x2ed/0x760 fs/inode.c:559
 iput_final fs/inode.c:1555 [inline]
 iput+0x4f1/0x860 fs/inode.c:1581
 do_unlinkat+0x40b/0x660 fs/namei.c:4071
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d307
Code: 00 66 90 b8 58 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 dd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc4042d438 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045d307
RDX: 00007ffc4042d450 RSI: 00007ffc4042d450 RDI: 00007ffc4042d4e0
RBP: 0000000000002064 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000003 R11: 0000000000000246 R12: 00007ffc4042e570
R13: 0000000001d8da60 R14: 0000000000000000 R15: 00007ffc4042e570

Allocated by task 13750:
 kmem_cache_alloc+0x122/0x370 mm/slab.c:3559
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 alloc_buffer_head+0x20/0x130 fs/buffer.c:3388
 alloc_page_buffers+0x169/0x5c0 fs/buffer.c:830
 create_empty_buffers+0x2c/0x760 fs/buffer.c:1528
 create_page_buffers+0x212/0x350 fs/buffer.c:1645
 __block_write_begin_int+0x22b/0x17b0 fs/buffer.c:1957
 ext4_da_write_begin+0x4e1/0x10e0 fs/ext4/inode.c:3101
 generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3162
 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3287
 ext4_file_write_iter+0x2fe/0xf20 fs/ext4/file.c:272
 call_write_iter include/linux/fs.h:1821 [inline]
 do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
 do_iter_write+0x182/0x5d0 fs/read_write.c:960
 vfs_iter_write+0x70/0xa0 fs/read_write.c:973
 iter_file_splice_write+0x60d/0xbb0 fs/splice.c:750
 do_splice_from fs/splice.c:852 [inline]
 direct_splice_actor+0x115/0x160 fs/splice.c:1025
 splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
 do_splice_direct+0x1a7/0x270 fs/splice.c:1068
 do_sendfile+0x550/0xc30 fs/read_write.c:1447
 __do_sys_sendfile64 fs/read_write.c:1508 [inline]
 __se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 6482:
 __cache_free mm/slab.c:3503 [inline]
 kmem_cache_free+0x7f/0x260 mm/slab.c:3765
 free_buffer_head+0x4a/0xf0 fs/buffer.c:3403
 try_to_free_buffers+0x38b/0x5d0 fs/buffer.c:3318
 ext4_releasepage+0x38b/0x4a0 fs/ext4/inode.c:3415
 try_to_release_page+0x242/0x390 mm/filemap.c:3350
 block_invalidatepage+0x45b/0x4f0 fs/buffer.c:1511
 do_invalidatepage mm/truncate.c:165 [inline]
 truncate_cleanup_page+0x3a4/0x580 mm/truncate.c:187
 truncate_inode_pages_range+0x530/0x1b10 mm/truncate.c:367
 ext4_evict_inode+0x4d2/0x1780 fs/ext4/inode.c:249
 evict+0x2ed/0x760 fs/inode.c:559
 iput_final fs/inode.c:1555 [inline]
 iput+0x4f1/0x860 fs/inode.c:1581
 do_unlinkat+0x40b/0x660 fs/namei.c:4071
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff888000c02000
 which belongs to the cache buffer_head of size 104
The buggy address is located 32 bytes inside of
 104-byte region [ffff888000c02000, ffff888000c02068)
The buggy address belongs to the page:
page:ffffea0000030080 count:1 mapcount:0 mapping:ffff88812c2df380 index:0x0
flags: 0x7ffe0000000100(slab)
raw: 007ffe0000000100 ffffea0001015ec8 ffffea00004db248 ffff88812c2df380
raw: 0000000000000000 ffff888000c02000 0000000100000018 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888000c01f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888000c01f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888000c02000: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
                               ^
 ffff888000c02080: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb
 ffff888000c02100: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb
==================================================================