EXT4-fs (sda1): Remounting file system with no journal so ignoring journalled data option ================================================================== BUG: KASAN: use-after-free in ext4_data_block_valid+0x27f/0x2d0 fs/ext4/block_validity.c:211 Read of size 8 at addr ffff888099c11d38 by task syz-executor.0/7521 CPU: 1 PID: 7521 Comm: syz-executor.0 Not tainted 4.14.172-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 ext4_data_block_valid+0x27f/0x2d0 fs/ext4/block_validity.c:211 __check_block_validity.constprop.0+0xba/0x200 fs/ext4/inode.c:410 ext4_map_blocks+0xd96/0x1610 fs/ext4/inode.c:600 ext4_getblk+0x314/0x3f0 fs/ext4/inode.c:980 ext4_bread_batch+0x78/0x340 fs/ext4/inode.c:1050 ext4_find_entry+0x43e/0xca0 fs/ext4/namei.c:1442 ext4_lookup fs/ext4/namei.c:1584 [inline] ext4_lookup+0x10c/0x550 fs/ext4/namei.c:1560 lookup_slow+0x213/0x410 fs/namei.c:1696 mountpoint_last fs/namei.c:2688 [inline] path_mountpoint+0x4e1/0x1980 fs/namei.c:2719 filename_mountpoint+0x16c/0x320 fs/namei.c:2745 SYSC_umount fs/namespace.c:1730 [inline] SyS_umount+0x10a/0x340 fs/namespace.c:1714 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45eea7 RSP: 002b:00007ffc049d5968 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 EXT4-fs (sda1): re-mounted. Opts: usrjquota=,noblock_validity,data=journal, RAX: ffffffffffffffda RBX: 000000000011a2d5 RCX: 000000000045eea7 RDX: 000000000000000c RSI: 0000000000000002 RDI: 00007ffc049d6aa0 RBP: 0000000000000b1d R08: 0000000000000001 R09: 0000000000ce1940 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc049d6aa0 R13: 00007ffc049d6a90 R14: 0000000000000000 R15: 00007ffc049d6aa0 Allocated by task 1: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc+0x127/0x770 mm/slab.c:3552 add_system_zone+0x2ae/0x600 fs/ext4/block_validity.c:85 ext4_setup_system_zone+0x2e2/0x470 fs/ext4/block_validity.c:169 ext4_fill_super+0x72e6/0xb690 fs/ext4/super.c:4364 mount_bdev+0x2bc/0x370 fs/super.c:1134 mount_fs+0x92/0x2a0 fs/super.c:1237 vfs_kern_mount.part.0+0x5b/0x3c0 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0x3c9/0x24f0 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xa8/0x120 fs/namespace.c:3072 do_mount_root+0x30/0x1b0 init/do_mounts.c:366 mount_block_root+0x2c0/0x59d init/do_mounts.c:395 mount_root+0x1c4/0x1f3 init/do_mounts.c:540 prepare_namespace+0x1d6/0x212 init/do_mounts.c:599 kernel_init_freeable+0x509/0x526 init/main.c:1091 kernel_init+0xd/0x15b init/main.c:998 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Freed by task 837: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758 ext4_release_system_zone+0x68/0xe0 fs/ext4/block_validity.c:187 ext4_setup_system_zone+0x3a3/0x470 fs/ext4/block_validity.c:151 ext4_remount+0xf70/0x1d50 fs/ext4/super.c:5313 do_remount_sb+0x150/0x530 fs/super.c:868 do_remount fs/namespace.c:2370 [inline] do_mount+0x12d2/0x24f0 fs/namespace.c:2870 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xa8/0x120 fs/namespace.c:3072 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff888099c11d20 which belongs to the cache ext4_system_zone of size 40 The buggy address is located 24 bytes inside of 40-byte region [ffff888099c11d20, ffff888099c11d48) The buggy address belongs to the page: page:ffffea0002670440 count:1 mapcount:0 mapping:ffff888099c11000 index:0xffff888099c11fb9 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff888099c11000 ffff888099c11fb9 0000000100000003 raw: ffff8880a617b238 ffff8880a617b238 ffff8880a6181dc0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888099c11c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888099c11c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888099c11d00: fc fc fc fc fb fb fb fb fb fc fc fb fb fb fb fb ^ ffff888099c11d80: fc fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc ffff888099c11e00: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb ================================================================== audit: type=1400 audit(1582993328.949:11922): avc: denied { map } for pid=857 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(1582993329.109:11923): avc: denied { map } for pid=861 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1800 audit(1582993329.149:11924): pid=865 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.1" name="file0" dev="sda1" ino=17841 res=0 audit: type=1804 audit(1582993329.149:11925): pid=865 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir872577854/syzkaller.x1lhiU/1047/file0" dev="sda1" ino=17841 res=1 audit: type=1400 audit(1582993329.229:11926): avc: denied { map } for pid=862 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(1582993329.299:11927): avc: denied { map } for pid=867 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0