KASAN: use-after-free Read in ext4_data_block

KASAN: use-after-free Read in ext4_data_block_valid (2)
Status: auto-closed as invalid on 2020/03/24 07:08
Reported-by: syzbot+0579477810f9dfac24ec@syzkaller.appspotmail.com
First crash: 607d, last: 607d

similar bugs (6):
Kernel	Title	Count	Last	Reported	Patched	Status
linux-4.14	KASAN: use-after-free Read in ext4_data_block_valid	5	421d	709d	0/1	auto-closed as invalid on 2020/09/26 20:10
android-414	KASAN: use-after-free Read in ext4_data_block_valid (2)	6	610d	671d	0/1	auto-closed as invalid on 2020/03/21 21:05
upstream	KASAN: use-after-free Read in ext4_data_block_valid	108	732d	1178d	14/22	fixed on 2019/10/15 23:40
android-414	KASAN: use-after-free Read in ext4_data_block_valid	12	862d	834d	0/1	auto-closed as invalid on 2019/09/11 10:38
linux-4.19	KASAN: use-after-free Read in ext4_data_block_valid	2	668d	730d	0/1	auto-closed as invalid on 2020/01/24 00:27
android-49	KASAN: use-after-free Read in ext4_data_block_valid	21	936d	832d	0/3	auto-closed as invalid on 2019/06/29 18:27

Sample crash report:

==================================================================
BUG: KASAN: use-after-free in ext4_data_block_valid+0x28d/0x2e0 fs/ext4/block_validity.c:210
Read of size 8 at addr ffff8801d4c0dbb0 by task syz-executor.3/2115

CPU: 1 PID: 2115 Comm: syz-executor.3 Not tainted 4.9.202+ #0
 ffff8801a2787730 ffffffff81b55d2b 0000000000000000 ffffea0007530340
 ffff8801d4c0dbb0 0000000000000008 ffffffff817cacfd ffff8801a2787768
 ffffffff8150c321 0000000000000000 ffff8801d4c0dbb0 ffff8801d4c0dbb0
Call Trace:
 [<00000000e4f28c73>] __dump_stack lib/dump_stack.c:15 [inline]
 [<00000000e4f28c73>] dump_stack+0xcb/0x130 lib/dump_stack.c:56
 [<0000000068acdc2a>] print_address_description+0x6f/0x23a mm/kasan/report.c:256
 [<000000006c7fc1b0>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<000000006c7fc1b0>] kasan_report mm/kasan/report.c:413 [inline]
 [<000000006c7fc1b0>] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:397
 [<000000003752d6ac>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:434
 [<0000000024fbd807>] ext4_data_block_valid+0x28d/0x2e0 fs/ext4/block_validity.c:210
 [<00000000ef4012fe>] __check_block_validity.constprop.0+0xc1/0x210 fs/ext4/inode.c:378
 [<000000001da6ec8d>] ext4_map_blocks+0xdb7/0x1710 fs/ext4/inode.c:568
 [<00000000804f5b82>] ext4_getblk+0x307/0x490 fs/ext4/inode.c:943
 [<000000001a7ad699>] ext4_find_entry+0xa43/0x12b0 fs/ext4/namei.c:1433
 [<00000000e8a8c0ca>] ext4_rmdir fs/ext4/namei.c:2919 [inline]
 [<00000000e8a8c0ca>] ext4_rmdir+0x108/0xab0 fs/ext4/namei.c:2901
 [<000000009eacc908>] vfs_rmdir2 fs/namei.c:3932 [inline]
 [<000000009eacc908>] vfs_rmdir2+0x21b/0x410 fs/namei.c:3910
 [<0000000069dd68e9>] do_rmdir+0x2c9/0x3a0 fs/namei.c:3998
 [<00000000185ec9df>] SYSC_rmdir fs/namei.c:4016 [inline]
 [<00000000185ec9df>] SyS_rmdir+0x1b/0x20 fs/namei.c:4014
 [<00000000f09cefcc>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<00000000e1c660c4>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 1:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:512 [inline]
 set_track mm/kasan/kasan.c:524 [inline]
 kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
 add_system_zone+0x2a4/0x540 fs/ext4/block_validity.c:84
 ext4_setup_system_zone+0x303/0x480 fs/ext4/block_validity.c:168
 ext4_fill_super+0x6c62/0xb7a0 fs/ext4/super.c:4191
 mount_bdev+0x2b8/0x360 fs/super.c:1110
 ext4_mount+0x35/0x40 fs/ext4/super.c:5624
 mount_fs+0x27c/0x380 fs/super.c:1216
 vfs_kern_mount.part.0+0xcd/0x4c0 fs/namespace.c:1000
 vfs_kern_mount fs/namespace.c:982 [inline]
 do_new_mount fs/namespace.c:2549 [inline]
 do_mount+0x3c4/0x2970 fs/namespace.c:2871
 SYSC_mount fs/namespace.c:3087 [inline]
 SyS_mount+0xab/0x120 fs/namespace.c:3064
 do_mount_root init/do_mounts.c:366 [inline]
 mount_block_root+0x304/0x6bd init/do_mounts.c:396
 mount_root+0x77/0x7a init/do_mounts.c:541
 prepare_namespace+0x1de/0x21d init/do_mounts.c:601
 kernel_init_freeable+0x3aa/0x3c8 init/main.c:1045
 kernel_init+0x12/0x163 init/main.c:953
 ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375

Freed by task 4414:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:512 [inline]
 set_track mm/kasan/kasan.c:524 [inline]
 kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:186
 ext4_setup_system_zone+0x3c3/0x480 fs/ext4/block_validity.c:150
 ext4_remount+0x7b8/0x1c50 fs/ext4/super.c:5116
 do_remount_sb2+0x340/0x7a0 fs/super.c:835
 do_remount fs/namespace.c:2364 [inline]
 do_mount+0x1368/0x2970 fs/namespace.c:2862
 SYSC_mount fs/namespace.c:3087 [inline]
 SyS_mount+0xab/0x120 fs/namespace.c:3064
 do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801d4c0db98
 which belongs to the cache ext4_system_zone of size 40
The buggy address is located 24 bytes inside of
 40-byte region [ffff8801d4c0db98, ffff8801d4c0dbc0)
The buggy address belongs to the page:
page:ffffea0007530340 count:1 mapcount:0 mapping:          (null) index:0xffff8801d4c0db60
flags: 0x4000000000000200(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d4c0da80: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb
 ffff8801d4c0db00: fb fb fb fc fc fb fb fb fb fb fc fc fb fb fb fb
>ffff8801d4c0db80: fb fc fc fb fb fb fb fb fc fc fc fc fc fc fc fc
                                     ^
 ffff8801d4c0dc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801d4c0dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs (sda1): re-mounted. Opts: noblock_validity,data_err=ignore,sb=0x0000000000000000,lazytime,jqfmt=vfsold,

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-android-49-kasan-gce-root	2019/11/25 07:07	android-4.9	258971b8e1ac	598ca6c8	.config	log	report