KASAN: use-after-free Read in ext4_data_block

Kernel	Title	Count	Last	Reported	Patched	Status
linux-4.14	KASAN: use-after-free Read in ext4_data_block_valid	5	1636d	1925d	0/1	auto-closed as invalid on 2020/09/26 20:10
android-414	KASAN: use-after-free Read in ext4_data_block_valid (2)	6	1825d	1887d	0/1	auto-closed as invalid on 2020/03/21 21:05
upstream	KASAN: use-after-free Read in ext4_data_block_valid ext4	108	1947d	2394d	13/28	fixed on 2019/10/15 23:40
android-414	KASAN: use-after-free Read in ext4_data_block_valid	12	2078d	2049d	0/1	auto-closed as invalid on 2019/09/11 10:38
linux-4.19	KASAN: use-after-free Read in ext4_data_block_valid	2	1883d	1946d	0/1	auto-closed as invalid on 2020/01/24 00:27
android-49	KASAN: use-after-free Read in ext4_data_block_valid	21	2151d	2048d	0/3	auto-closed as invalid on 2019/06/29 18:27

================================================================== BUG: KASAN: use-after-free in ext4_data_block_valid+0x28d/0x2e0 fs/ext4/block_validity.c:210 Read of size 8 at addr ffff8801d4c0dbb0 by task syz-executor.3/2115 CPU: 1 PID: 2115 Comm: syz-executor.3 Not tainted 4.9.202+ #0 ffff8801a2787730 ffffffff81b55d2b 0000000000000000 ffffea0007530340 ffff8801d4c0dbb0 0000000000000008 ffffffff817cacfd ffff8801a2787768 ffffffff8150c321 0000000000000000 ffff8801d4c0dbb0 ffff8801d4c0dbb0 Call Trace: [<00000000e4f28c73>] __dump_stack lib/dump_stack.c:15 [inline] [<00000000e4f28c73>] dump_stack+0xcb/0x130 lib/dump_stack.c:56 [<0000000068acdc2a>] print_address_description+0x6f/0x23a mm/kasan/report.c:256 [<000000006c7fc1b0>] kasan_report_error mm/kasan/report.c:355 [inline] [<000000006c7fc1b0>] kasan_report mm/kasan/report.c:413 [inline] [<000000006c7fc1b0>] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:397 [<000000003752d6ac>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:434 [<0000000024fbd807>] ext4_data_block_valid+0x28d/0x2e0 fs/ext4/block_validity.c:210 [<00000000ef4012fe>] __check_block_validity.constprop.0+0xc1/0x210 fs/ext4/inode.c:378 [<000000001da6ec8d>] ext4_map_blocks+0xdb7/0x1710 fs/ext4/inode.c:568 [<00000000804f5b82>] ext4_getblk+0x307/0x490 fs/ext4/inode.c:943 [<000000001a7ad699>] ext4_find_entry+0xa43/0x12b0 fs/ext4/namei.c:1433 [<00000000e8a8c0ca>] ext4_rmdir fs/ext4/namei.c:2919 [inline] [<00000000e8a8c0ca>] ext4_rmdir+0x108/0xab0 fs/ext4/namei.c:2901 [<000000009eacc908>] vfs_rmdir2 fs/namei.c:3932 [inline] [<000000009eacc908>] vfs_rmdir2+0x21b/0x410 fs/namei.c:3910 [<0000000069dd68e9>] do_rmdir+0x2c9/0x3a0 fs/namei.c:3998 [<00000000185ec9df>] SYSC_rmdir fs/namei.c:4016 [inline] [<00000000185ec9df>] SyS_rmdir+0x1b/0x20 fs/namei.c:4014 [<00000000f09cefcc>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<00000000e1c660c4>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 1: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:512 [inline] set_track mm/kasan/kasan.c:524 [inline] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616 kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554 slab_post_alloc_hook mm/slab.h:417 [inline] slab_alloc_node mm/slub.c:2715 [inline] slab_alloc mm/slub.c:2723 [inline] kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728 add_system_zone+0x2a4/0x540 fs/ext4/block_validity.c:84 ext4_setup_system_zone+0x303/0x480 fs/ext4/block_validity.c:168 ext4_fill_super+0x6c62/0xb7a0 fs/ext4/super.c:4191 mount_bdev+0x2b8/0x360 fs/super.c:1110 ext4_mount+0x35/0x40 fs/ext4/super.c:5624 mount_fs+0x27c/0x380 fs/super.c:1216 vfs_kern_mount.part.0+0xcd/0x4c0 fs/namespace.c:1000 vfs_kern_mount fs/namespace.c:982 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x3c4/0x2970 fs/namespace.c:2871 SYSC_mount fs/namespace.c:3087 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3064 do_mount_root init/do_mounts.c:366 [inline] mount_block_root+0x304/0x6bd init/do_mounts.c:396 mount_root+0x77/0x7a init/do_mounts.c:541 prepare_namespace+0x1de/0x21d init/do_mounts.c:601 kernel_init_freeable+0x3aa/0x3c8 init/main.c:1045 kernel_init+0x12/0x163 init/main.c:953 ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375 Freed by task 4414: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:512 [inline] set_track mm/kasan/kasan.c:524 [inline] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kmem_cache_free+0xbe/0x310 mm/slub.c:2980 ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:186 ext4_setup_system_zone+0x3c3/0x480 fs/ext4/block_validity.c:150 ext4_remount+0x7b8/0x1c50 fs/ext4/super.c:5116 do_remount_sb2+0x340/0x7a0 fs/super.c:835 do_remount fs/namespace.c:2364 [inline] do_mount+0x1368/0x2970 fs/namespace.c:2862 SYSC_mount fs/namespace.c:3087 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3064 do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 entry_SYSCALL_64_after_swapgs+0x5d/0xdb The buggy address belongs to the object at ffff8801d4c0db98 which belongs to the cache ext4_system_zone of size 40 The buggy address is located 24 bytes inside of 40-byte region [ffff8801d4c0db98, ffff8801d4c0dbc0) The buggy address belongs to the page: page:ffffea0007530340 count:1 mapcount:0 mapping: (null) index:0xffff8801d4c0db60 flags: 0x4000000000000200(slab) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d4c0da80: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb ffff8801d4c0db00: fb fb fb fc fc fb fb fb fb fb fc fc fb fb fb fb >ffff8801d4c0db80: fb fc fc fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8801d4c0dc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8801d4c0dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== EXT4-fs (sda1): re-mounted. Opts: noblock_validity,data_err=ignore,sb=0x0000000000000000,lazytime,jqfmt=vfsold,