================================================================== BUG: KASAN: use-after-free in ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:260 Read of size 8 at addr ffff88809ac61d38 by task syz-executor.1/7397 CPU: 0 PID: 7397 Comm: syz-executor.1 Not tainted 4.19.75 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:260 ext4_mb_mark_diskspace_used+0x4a9/0x10d0 fs/ext4/mballoc.c:2966 ext4_mb_new_blocks+0xaa4/0x3c10 fs/ext4/mballoc.c:4555 ext4_ext_map_blocks+0x2b26/0x55c0 fs/ext4/extents.c:4484 ext4_map_blocks+0x990/0x1b20 fs/ext4/inode.c:640 ext4_getblk+0xc4/0x510 fs/ext4/inode.c:976 ext4_bread+0x8f/0x230 fs/ext4/inode.c:1026 ext4_append+0x155/0x370 fs/ext4/namei.c:66 ext4_init_new_dir fs/ext4/namei.c:2611 [inline] ext4_mkdir+0x61b/0xdf0 fs/ext4/namei.c:2658 vfs_mkdir+0x42e/0x690 fs/namei.c:3816 do_mkdirat+0x234/0x2a0 fs/namei.c:3839 __do_sys_mkdir fs/namei.c:3855 [inline] __se_sys_mkdir fs/namei.c:3853 [inline] __x64_sys_mkdir+0x5c/0x80 fs/namei.c:3853 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458e47 Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd c3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad c3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffe93dbefc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 000000000004f27f RCX: 0000000000458e47 RDX: 00007ffe93dbf014 RSI: 00000000000001ff RDI: 00007ffe93dbf010 RBP: 000000000000014e R08: 0000000000000000 R09: 0000000000000004 R10: 0000000000000064 R11: 0000000000000202 R12: 000000000000000c R13: 00007ffe93dbf000 R14: 000000000004f23e R15: 00007ffe93dbf010 Allocated by task 1: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc mm/kasan/kasan.c:553 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559 add_system_zone+0x302/0x650 fs/ext4/block_validity.c:85 ext4_setup_system_zone+0x419/0xac0 fs/ext4/block_validity.c:212 ext4_fill_super+0x7154/0xc830 fs/ext4/super.c:4425 mount_bdev+0x304/0x3c0 fs/super.c:1158 ext4_mount+0x35/0x40 fs/ext4/super.c:5936 mount_fs+0xa8/0x31f fs/super.c:1261 vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2469 [inline] do_mount+0x53e/0x2bc0 fs/namespace.c:2799 ksys_mount+0xdb/0x150 fs/namespace.c:3015 do_mount_root+0x35/0x1d3 init/do_mounts.c:356 mount_block_root+0x353/0x61d init/do_mounts.c:385 mount_root+0x283/0x2cd init/do_mounts.c:530 prepare_namespace+0x26f/0x2ae init/do_mounts.c:589 kernel_init_freeable+0x5aa/0x5c8 init/main.c:1164 kernel_init+0x12/0x1c5 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 10895: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3765 ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:236 ext4_setup_system_zone+0x7f2/0xac0 fs/ext4/block_validity.c:194 ext4_remount+0x112e/0x22d0 fs/ext4/super.c:5381 do_remount_sb+0x1c4/0x710 fs/super.c:888 do_remount fs/namespace.c:2290 [inline] do_mount+0x170a/0x2bc0 fs/namespace.c:2790 ksys_mount+0xdb/0x150 fs/namespace.c:3015 __do_sys_mount fs/namespace.c:3029 [inline] __se_sys_mount fs/namespace.c:3026 [inline] __x64_sys_mount+0xbe/0x150 fs/namespace.c:3026 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809ac61d20 which belongs to the cache ext4_system_zone of size 40 The buggy address is located 24 bytes inside of 40-byte region [ffff88809ac61d20, ffff88809ac61d48) The buggy address belongs to the page: page:ffffea00026b1840 count:1 mapcount:0 mapping:ffff888219c633c0 index:0xffff88809ac61fb9 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffff8880a672ae38 ffff8880a672ae38 ffff888219c633c0 raw: ffff88809ac61fb9 ffff88809ac61000 0000000100000004 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809ac61c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809ac61c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809ac61d00: fc fc fc fc fb fb fb fb fb fc fc fb fb fb fb fb ^ ffff88809ac61d80: fc fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc ffff88809ac61e00: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb ==================================================================