KASAN: slab-out-of-bounds Write in __ext4_expand_extra

Kernel	Title	Count	Last	Reported	Patched	Status
android-414	KASAN: slab-out-of-bounds Write in __ext4_expand_extra_isize	2	1610d	1685d	0/1	auto-closed as invalid on 2020/03/21 10:22
linux-4.14	KASAN: slab-out-of-bounds Write in __ext4_expand_extra_isize	1	1607d	1607d	0/1	auto-closed as invalid on 2020/03/24 05:12
upstream	KASAN: slab-out-of-bounds Write in __ext4_expand_extra_isize ext4	16	1712d	2055d	15/26	fixed on 2019/12/13 00:31
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc_node mm/slab.c:3304 [inline]
 kmem_cache_alloc_node_trace+0x274/0x720 mm/slab.c:3666
 __do_kmalloc_node mm/slab.c:3688 [inline]
 __kmalloc_node_track_caller+0x3d/0x80 mm/slab.c:3703
 __kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:137
 __alloc_skb+0x10b/0x5f0 net/core/skbuff.c:205
==================================================================
BUG: KASAN: slab-out-of-bounds in memset include/linux/string.h:333 [inline]
BUG: KASAN: slab-out-of-bounds in __ext4_expand_extra_isize+0x175/0x250 fs/ext4/inode.c:5903
Write of size 1091502048 at addr ffff88805c3229a0 by task syz-executor.3/7607

 alloc_skb include/linux/skbuff.h:995 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline]
 netlink_sendmsg+0x97b/0xd70 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:632
 ___sys_sendmsg+0x803/0x920 net/socket.c:2115
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2153
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4598e9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc77fd85c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc77fd85c90 RCX: 00000000004598e9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc77fd866d4
R13: 00000000004c711b R14: 00000000004dc828 R15: 0000000000000007
CPU: 0 PID: 7607 Comm: syz-executor.3 Not tainted 4.19.71 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
 memset+0x24/0x40 mm/kasan/kasan.c:285
 memset include/linux/string.h:333 [inline]
 __ext4_expand_extra_isize+0x175/0x250 fs/ext4/inode.c:5903
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5955 [inline]
 ext4_mark_inode_dirty+0x6f0/0x940 fs/ext4/inode.c:6031
 ext4_unlink fs/ext4/namei.c:3069 [inline]
 ext4_unlink+0xc89/0xff0 fs/ext4/namei.c:3014
 vfs_unlink+0x2d3/0x500 fs/namei.c:3999
 do_unlinkat+0x3f7/0x6d0 fs/namei.c:4062
 __do_sys_unlink fs/namei.c:4109 [inline]
 __se_sys_unlink fs/namei.c:4107 [inline]
 __x64_sys_unlink+0x42/0x50 fs/namei.c:4107
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459637
Code: 00 66 90 b8 58 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 9d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00
kasan: CONFIG_KASAN_INLINE enabled
RSP: 002b:00007fff8e53a538 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000459637
kasan: GPF could be caused by NULL-ptr deref or user memory access
RDX: 00007fff8e53a550 RSI: 00007fff8e53a550 RDI: 00007fff8e53a5e0
general protection fault: 0000 [#1] PREEMPT SMP KASAN
RBP: 00000000000000f4 R08: 0000000000000000 R09: 000000000000000f
CPU: 1 PID: 7598 Comm: syz-executor.0 Not tainted 4.19.71 #0
R10: 000000000000000a R11: 0000000000000246 R12: 00007fff8e53b670
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
R13: 0000000002371940 R14: 0000000000000000 R15: 00007fff8e53b670
RIP: 0010:cpuacct_account_field+0xe4/0x2f0 kernel/sched/cpuacct.c:366

Code: 49 81 fc 80 61 78 88 0f 84 a2 00 00 00 49 be 00 00 00 00 00 fc ff df 49 c1 e7 03 49 8d bc 24 38 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 0f 85 bc 01 00 00 49 8b 9c 24 38 01 00 00 e8 44 66
The buggy address belongs to the page:
RSP: 0018:ffff8880ae907c78 EFLAGS: 00010006
page:ffffea000170c880 count:2 mapcount:0 mapping:ffff8880a6f32b58 index:0x42a
RAX: 0000000000000027 RBX: ffff8880a464a140 RCX: ffff8880a464a9c0
flags: 0x1fffc0000001074(referenced|dirty|lru|active|private)
RDX: 1ffff1101002d52a RSI: ffffffff8879f320 RDI: 0000000000000138
raw: 01fffc0000001074 ffffea000179f408 ffffea000170c8c8 ffff8880a6f32b58
RBP: ffff8880ae907ca8 R08: ffff8880a464a140 R09: ffffed1015d24733
raw: 000000000000042a ffff8880832402a0 00000002ffffffff ffff8880aa1c6c00
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
page dumped because: kasan: bad access detected
R13: 0000000000983b6d R14: dffffc0000000000 R15: 0000000000000010
page->mem_cgroup:ffff8880aa1c6c00
FS:  0000000001d4d940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000

CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Memory state around the buggy address:
CR2: 0000000000000000 CR3: 00000000961f7000 CR4: 00000000001406e0
 ffff88805c809f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 ffff88805c809f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>ffff88805c80a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Call Trace:
                   ^
 <IRQ>
 ffff88805c80a080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 cgroup_account_cputime_field include/linux/cgroup.h:781 [inline]
 task_group_account_field kernel/sched/cputime.c:108 [inline]
 account_system_index_time+0x11d/0x390 kernel/sched/cputime.c:171
 ffff88805c80a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 irqtime_account_process_tick.isra.0+0x386/0x490 kernel/sched/cputime.c:388
==================================================================
 account_process_tick+0x27f/0x350 kernel/sched/cputime.c:483
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
 update_process_times+0x25/0x80 kernel/time/timer.c:1634
 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:164
 tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1274
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x33b/0xdc0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
 smp_apic_timer_interrupt+0x111/0x550 arch/x86/kernel/apic/apic.c:1092
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
 </IRQ>
RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:66
Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01
RSP: 0018:ffff888085757b10 EFLAGS: 00010286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000000020 RCX: 000000001a863f00
RDX: 00000000410effe0 RSI: 0000000000000000 RDI: ffff8880827db180
RBP: ffff888085757b30 R08: ffffed100b901408 R09: ffff88805bf4f0a0
R10: ffffed1013a07e0f R11: ffff88809d03f07f R12: ffff88805bf4f0a0
R13: 00000000410effe0 R14: 0000000000000000 R15: ffff88805bf4f0a0
 memset include/linux/string.h:333 [inline]
 __ext4_expand_extra_isize+0x175/0x250 fs/ext4/inode.c:5903
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5955 [inline]
 ext4_mark_inode_dirty+0x6f0/0x940 fs/ext4/inode.c:6031
 ext4_unlink fs/ext4/namei.c:3069 [inline]
 ext4_unlink+0xc89/0xff0 fs/ext4/namei.c:3014
 vfs_unlink+0x2d3/0x500 fs/namei.c:3999
 do_unlinkat+0x3f7/0x6d0 fs/namei.c:4062
 __do_sys_unlink fs/namei.c:4109 [inline]
 __se_sys_unlink fs/namei.c:4107 [inline]
 __x64_sys_unlink+0x42/0x50 fs/namei.c:4107
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459637
Code: 00 66 90 b8 58 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 9d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe66014868 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000459637
RDX: 00007ffe66014880 RSI: 00007ffe66014880 RDI: 00007ffe66014910
RBP: 000000000000011b R08: 0000000000000000 R09: 0000000000000010
R10: 000000000000000a R11: 0000000000000246 R12: 00007ffe660159a0
R13: 0000000001d4e940 R14: 0000000000000000 R15: 00007ffe660159a0
Modules linked in:
---[ end trace a4ea478059cef643 ]---
general protection fault: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 7607 Comm: syz-executor.3 Tainted: G    B D           4.19.71 #0
RIP: 0010:cpuacct_account_field+0xe4/0x2f0 kernel/sched/cpuacct.c:366
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Code: 49 81 fc 80 61 78 88 0f 84 a2 00 00 00 49 be 00 00 00 00 00 fc ff df 49 c1 e7 03 49 8d bc 24 38 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 0f 85 bc 01 00 00 49 8b 9c 24 38 01 00 00 e8 44 66
RIP: 0010:__rb_insert lib/rbtree.c:131 [inline]
RIP: 0010:rb_insert_color+0x70/0xbd0 lib/rbtree.c:452
RSP: 0018:ffff8880ae907c78 EFLAGS: 00010006
Code: 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 0f 85 ff 06 00 00 49 8b 1c 24 f6 c3 01 0f 85 99 01 00 00 4c 8d 43 08 4c 89 c0 48 c1 e8 03 <42> 80 3c 30 00 0f 85 bf 06 00 00 4c 8b 7b 08 4d 39 e7 0f 84 85 01
RSP: 0018:ffff8880ae807d50 EFLAGS: 00010002
RAX: 0000000000000027 RBX: ffff8880a464a140 RCX: ffff8880a464a9c0
RDX: 1ffff1101002d52a RSI: ffffffff8879f320 RDI: 0000000000000138
RBP: ffff8880ae907ca8 R08: ffff8880a464a140 R09: ffffed1015d24733
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 1ffff1100ffe8f7e
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
RDX: 1ffff11015d04c8c RSI: ffff8880ae825c40 RDI: ffff8880ae826460
R13: 0000000000983b6d R14: dffffc0000000000 R15: 0000000000000010
RBP: ffff8880ae807d90 R08: 0000000000000008 R09: fffffbfff1492942
FS:  0000000001d4d940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
R10: fffffbfff1492941 R11: ffffffff8a494a0b R12: ffff88807ff47be8
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
R13: ffff8880ae826460 R14: dffffc0000000000 R15: ffff88807ff47bf0
CR2: 0000000000000000 CR3: 00000000961f7000 CR4: 00000000001406e0
FS:  0000000002370940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
CR2: 00007fff8e539e2c CR3: 0000000098354000 CR4: 00000000001406f0