EXT4-fs (sda1): Remounting file system with no journal so ignoring journalled data option ================================================================== BUG: KASAN: use-after-free in ext4_inode_block_valid+0x33b/0x3b0 fs/ext4/block_validity.c:255 Read of size 8 at addr ffff8880a42bbd38 by task syz-executor.3/11130 CPU: 1 PID: 11130 Comm: syz-executor.3 Not tainted 4.14.228-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430 ext4_inode_block_valid+0x33b/0x3b0 fs/ext4/block_validity.c:255 ext4_mb_mark_diskspace_used+0x42b/0x1440 fs/ext4/mballoc.c:3020 ext4_mb_new_blocks+0xaec/0x3db0 fs/ext4/mballoc.c:4611 ext4_ext_map_blocks+0x2845/0x6b10 fs/ext4/extents.c:4499 ext4_map_blocks+0x675/0x1730 fs/ext4/inode.c:656 ext4_getblk+0x98/0x3f0 fs/ext4/inode.c:992 ext4_bread+0x6c/0x1a0 fs/ext4/inode.c:1042 ext4_append+0x143/0x350 fs/ext4/namei.c:65 ext4_init_new_dir fs/ext4/namei.c:2637 [inline] ext4_mkdir+0x4c9/0xbd0 fs/ext4/namei.c:2684 vfs_mkdir+0x463/0x6e0 fs/namei.c:3849 SYSC_mkdirat fs/namei.c:3872 [inline] SyS_mkdirat+0x1fd/0x270 fs/namei.c:3856 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x465567 RSP: 002b:00007f3414b2cfa8 EFLAGS: 00000213 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 0000000020000280 RCX: 0000000000465567 RDX: 0000000000000004 RSI: 00000000000001ff RDI: 0000000020000040 RBP: 00007f3414b2d040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 R13: 0000000020000040 R14: 00007f3414b2d000 R15: 0000000020002c80 Allocated by task 1: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 kmem_cache_alloc+0x124/0x3c0 mm/slab.c:3552 add_system_zone+0x108/0x650 fs/ext4/block_validity.c:78 ext4_setup_system_zone+0x231/0x8c0 fs/ext4/block_validity.c:206 ext4_fill_super+0x62cc/0xb280 fs/ext4/super.c:4389 mount_bdev+0x2b3/0x360 fs/super.c:1134 mount_fs+0x92/0x2a0 fs/super.c:1237 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046 vfs_kern_mount fs/namespace.c:1036 [inline] do_new_mount fs/namespace.c:2549 [inline] do_mount+0xe53/0x2a00 fs/namespace.c:2879 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xa8/0x120 fs/namespace.c:3072 do_mount_root+0x30/0x1b0 init/do_mounts.c:366 mount_block_root+0x2bc/0x5a3 init/do_mounts.c:395 mount_root+0x1c4/0x1f3 init/do_mounts.c:540 prepare_namespace+0x1d6/0x212 init/do_mounts.c:599 kernel_init_freeable+0x5f7/0x614 init/main.c:1093 kernel_init+0xd/0x15e init/main.c:1000 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Freed by task 11089: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758 ext4_release_system_zone+0x79/0x110 fs/ext4/block_validity.c:230 ext4_setup_system_zone+0x3a9/0x8c0 fs/ext4/block_validity.c:188 ext4_remount+0xfa2/0x1df0 fs/ext4/super.c:5367 do_remount_sb+0x150/0x530 fs/super.c:868 do_remount fs/namespace.c:2370 [inline] do_mount+0x1632/0x2a00 fs/namespace.c:2870 SYSC_mount fs/namespace.c:3095 [inline] SyS_mount+0xa8/0x120 fs/namespace.c:3072 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff8880a42bbd20 which belongs to the cache ext4_system_zone of size 40 The buggy address is located 24 bytes inside of 40-byte region [ffff8880a42bbd20, ffff8880a42bbd48) The buggy address belongs to the page: page:ffffea000290aec0 count:1 mapcount:0 mapping:ffff8880a42bb000 index:0xffff8880a42bbfb9 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880a42bb000 ffff8880a42bbfb9 0000000100000046 raw: ffff8880b11b7338 ffff8880b11b7338 ffff8882395d9c80 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a42bbc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a42bbc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a42bbd00: fc fc fc fc fb fb fb fb fb fc fc fb fb fb fb fb ^ ffff8880a42bbd80: fc fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc ffff8880a42bbe00: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb ================================================================== EXT4-fs (sda1): re-mounted. Opts: noblock_validity,data=writeback,,errors=continue ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table overlayfs: unrecognized mount option "01777777777777777777777" or missing value EXT4-fs (loop2): VFS: Can't find ext4 filesystem audit: type=1800 audit(1617737992.674:34): pid=11169 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed" comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 audit: type=1800 audit(1617737992.724:35): pid=11156 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed" comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=32769 res=0