EXT4-fs error (device loop0): __ext4_get_inode_loc:4316: comm kworker/u4:2: Invalid inode table block 0 in block_group 0 ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:827 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:946 Read of size 4 at addr ffff88811d07e078 by task kworker/u4:2/93 CPU: 0 PID: 93 Comm: kworker/u4:2 Not tainted 5.15.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3a0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x177/0x1c0 mm/kasan/report.c:451 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 ext4_ext_binsearch fs/ext4/extents.c:827 [inline] ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:946 ext4_ext_map_blocks+0x254/0x7250 fs/ext4/extents.c:4103 ext4_map_blocks+0xaa7/0x1e30 fs/ext4/inode.c:645 mpage_map_one_extent fs/ext4/inode.c:2406 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2459 [inline] ext4_writepages+0x15d6/0x3fd0 fs/ext4/inode.c:2827 do_writepages+0x3e8/0x650 mm/page-writeback.c:2364 __writeback_single_inode+0xdf/0xa70 fs/fs-writeback.c:1622 writeback_sb_inodes+0xb2e/0x1910 fs/fs-writeback.c:1905 wb_writeback+0x3b9/0x9e0 fs/fs-writeback.c:2079 wb_do_writeback fs/fs-writeback.c:2222 [inline] wb_workfn+0x3d9/0x1110 fs/fs-writeback.c:2263 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2306 worker_thread+0xad2/0x12a0 kernel/workqueue.c:2453 kthread+0x421/0x510 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the page: page:ffffea0004741f80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11d07e flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea0004742008 ffffea0004742088 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x1100cca(GFP_HIGHUSER_MOVABLE), pid 362, ts 18085874884, free_ts 19878531445 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x15d/0x170 mm/page_alloc.c:2420 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x33e6/0x34c0 mm/page_alloc.c:4159 __alloc_pages+0x38a/0x7b0 mm/page_alloc.c:5421 __alloc_pages_node include/linux/gfp.h:570 [inline] alloc_pages_node include/linux/gfp.h:584 [inline] alloc_pages include/linux/gfp.h:597 [inline] wp_page_copy+0x206/0x1590 mm/memory.c:3016 do_wp_page+0x66c/0xa90 handle_pte_fault mm/memory.c:4612 [inline] __handle_mm_fault mm/memory.c:4729 [inline] handle_mm_fault+0x1f28/0x4350 mm/memory.c:4827 do_user_addr_fault arch/x86/mm/fault.c:1397 [inline] handle_page_fault arch/x86/mm/fault.c:1485 [inline] exc_page_fault+0x23a/0x610 arch/x86/mm/fault.c:1541 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1413 [inline] free_unref_page_prepare+0x7a9/0x7e0 mm/page_alloc.c:3317 free_unref_page_list+0x1aa/0x6d0 mm/page_alloc.c:3433 release_pages+0xe33/0xe90 mm/swap.c:963 free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:320 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu+0xd0/0x180 mm/mmu_gather.c:247 zap_pte_range mm/memory.c:1445 [inline] zap_pmd_range mm/memory.c:1494 [inline] zap_pud_range mm/memory.c:1523 [inline] zap_p4d_range mm/memory.c:1544 [inline] unmap_page_range+0x1a96/0x1ca0 mm/memory.c:1565 unmap_single_vma mm/memory.c:1610 [inline] unmap_vmas+0x389/0x560 mm/memory.c:1642 exit_mmap+0x3b6/0x610 mm/mmap.c:3186 __mmput+0x95/0x300 kernel/fork.c:1118 mmput+0x59/0x70 kernel/fork.c:1139 exit_mm kernel/exit.c:548 [inline] do_exit+0xb6a/0x29e0 kernel/exit.c:859 do_group_exit+0x141/0x310 kernel/exit.c:994 __do_sys_exit_group kernel/exit.c:1005 [inline] __se_sys_exit_group kernel/exit.c:1003 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1003 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Memory state around the buggy address: ffff88811d07df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88811d07df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88811d07e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811d07e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811d07e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs error (device loop0): ext4_map_blocks:725: inode #19: comm kworker/u4:2: lblock 0 mapped to illegal pblock 0 (length 4) EXT4-fs (loop0): Delayed block allocation failed for inode 19 at logical offset 0 with max blocks 4 with error 117 EXT4-fs (loop0): This should not happen!! Data will be lost EXT4-fs error (device loop0): __ext4_get_inode_loc:4316: comm kworker/u4:2: Invalid inode table block 0 in block_group 0