XFS (loop3): unknown mount option [5vM1zn8G[q=udpS+]. ================================================================== BUG: KASAN: use-after-free in ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:211 Read of size 8 at addr ffff888216237600 by task syz-executor.5/7620 CPU: 0 PID: 7620 Comm: syz-executor.5 Not tainted 4.19.60 #33 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:211 __check_block_validity.constprop.0+0xc1/0x210 fs/ext4/inode.c:402 ext4_map_blocks+0x1085/0x1a10 fs/ext4/inode.c:592 ext4_getblk+0x40b/0x510 fs/ext4/inode.c:966 ext4_bread_batch+0x7f/0x420 fs/ext4/inode.c:1036 ext4_find_entry+0x54e/0x1030 fs/ext4/namei.c:1429 ext4_rmdir fs/ext4/namei.c:2933 [inline] ext4_rmdir+0x1ba/0xc90 fs/ext4/namei.c:2912 vfs_rmdir fs/namei.c:3879 [inline] vfs_rmdir+0x196/0x460 fs/namei.c:3858 do_rmdir+0x39e/0x420 fs/namei.c:3940 __do_sys_rmdir fs/namei.c:3958 [inline] __se_sys_rmdir fs/namei.c:3956 [inline] __x64_sys_rmdir+0x36/0x40 fs/namei.c:3956 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459597 Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 7d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff388af358 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000459597 RDX: 0000000000000000 RSI: 0000000000715698 RDI: 00007fff388b0490 RBP: 000000000000003e R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000006 R11: 0000000000000207 R12: 00007fff388b0490 R13: 0000000001d18940 R14: 0000000000000000 R15: 00007fff388b0490 Allocated by task 1: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc mm/kasan/kasan.c:553 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559 add_system_zone+0x302/0x650 fs/ext4/block_validity.c:85 ext4_setup_system_zone+0x36d/0x510 fs/ext4/block_validity.c:169 ext4_fill_super+0x7154/0xc830 fs/ext4/super.c:4425 mount_bdev+0x304/0x3c0 fs/super.c:1158 ext4_mount+0x35/0x40 fs/ext4/super.c:5936 mount_fs+0xa8/0x32b fs/super.c:1261 vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x53e/0x2bc0 fs/namespace.c:2799 ksys_mount+0xdb/0x150 fs/namespace.c:3015 do_mount_root+0x35/0x1d3 init/do_mounts.c:356 mount_block_root+0x353/0x61d init/do_mounts.c:385 mount_root+0x283/0x2cd init/do_mounts.c:530 prepare_namespace+0x26f/0x2ae init/do_mounts.c:589 kernel_init_freeable+0x5aa/0x5c8 init/main.c:1164 kernel_init+0x12/0x1c1 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 8194: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3765 ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:187 ext4_setup_system_zone+0x450/0x510 fs/ext4/block_validity.c:151 ext4_remount+0x112e/0x22d0 fs/ext4/super.c:5381 do_remount_sb+0x1c4/0x710 fs/super.c:888 do_remount fs/namespace.c:2290 [inline] do_mount+0x170a/0x2bc0 fs/namespace.c:2790 ksys_mount+0xdb/0x150 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xbe/0x150 fs/namespace.c:3026 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8882162375e8 which belongs to the cache ext4_system_zone of size 40 The buggy address is located 24 bytes inside of 40-byte region [ffff8882162375e8, ffff888216237610) The buggy address belongs to the page: page:ffffea0008588dc0 count:1 mapcount:0 mapping:ffff8880a65be0c0 index:0xffff888216237fb9 flags: 0x6fffc0000000100(slab) raw: 06fffc0000000100 ffff88821a12fe38 ffff88821a12fe38 ffff8880a65be0c0 raw: ffff888216237fb9 ffff888216237000 000000010000001c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888216237500: fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb ffff888216237580: fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb fb >ffff888216237600: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888216237680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888216237700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== EXT4-fs (sda1): re-mounted. Opts: noblock_validity,