[Android 5.4] KASAN: use-after-free Read in ext4_convert_inline_data_nolock

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 2d5d8240a7cb UPSTREAM: netfilter: nf_tables: release mutex..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=112332a0980000
kernel config: https://syzkaller.appspot.com/x/.config?x=60c0e8be982a03fd
dashboard link: https://syzkaller.appspot.com/bug?extid=bb996ea82568b0593462
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=169040a7180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17484440980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/490caba28d3d/disk-2d5d8240.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e94aa9169464/vmlinux-2d5d8240.xz
kernel image: https://storage.googleapis.com/syzbot-assets/698a9017bfdc/bzImage-2d5d8240.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/c092ae452a28/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/8a0742ff383d/mount_2.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb996e...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:209 [inline]
BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x319/0xd80 fs/ext4/inline.c:1224
Read of size 68 at addr ffff8881dcf4b0cf by task syz-executor794/363

CPU: 0 PID: 363 Comm: syz-executor794 Not tainted 5.4.268-syzkaller-00003-g2d5d8240a7cb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x241 lib/dump_stack.c:118
print_address_description+0x8c/0x600 mm/kasan/report.c:384
__kasan_report+0xf3/0x120 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x272/0x280 mm/kasan/generic.c:191
memcpy+0x25/0x50 mm/kasan/common.c:123
ext4_read_inline_data fs/ext4/inline.c:209 [inline]
ext4_convert_inline_data_nolock+0x319/0xd80 fs/ext4/inline.c:1224
ext4_try_add_inline_entry+0x7ff/0xb20 fs/ext4/inline.c:1349
ext4_add_entry+0x6c2/0x1240 fs/ext4/namei.c:2352
ext4_mkdir+0xc9f/0x1520 fs/ext4/namei.c:2942
vfs_mkdir+0x41f/0x600 fs/namei.c:3916
do_mkdirat+0x1a9/0x2c0 fs/namei.c:3939
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1

The buggy address belongs to the page:
page:ffffea000773d2c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1
flags: 0x8000000000000000()
raw: 8000000000000000 ffffea000773d308 ffffea000773f508 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x100cca(GFP_HIGHUSER_MOVABLE)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891
__alloc_pages include/linux/gfp.h:503 [inline]
__alloc_pages_node include/linux/gfp.h:516 [inline]
alloc_pages_node include/linux/gfp.h:530 [inline]
shmem_alloc_page mm/shmem.c:1503 [inline]
shmem_alloc_and_acct_page+0x492/0x9d0 mm/shmem.c:1528
shmem_getpage_gfp+0xf5d/0x2440 mm/shmem.c:1852
shmem_getpage mm/shmem.c:154 [inline]
shmem_write_begin+0xc9/0x1a0 mm/shmem.c:2447
generic_perform_write+0x2c7/0x560 mm/filemap.c:3450
__generic_file_write_iter+0x224/0x530 mm/filemap.c:3579
generic_file_write_iter+0x455/0x5f0 mm/filemap.c:3611
call_write_iter include/linux/fs.h:1983 [inline]
new_sync_write fs/read_write.c:483 [inline]
__vfs_write+0x5d3/0x750 fs/read_write.c:496
vfs_write+0x206/0x4e0 fs/read_write.c:558
ksys_write+0x199/0x2c0 fs/read_write.c:611
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1176 [inline]
free_pcp_prepare mm/page_alloc.c:1233 [inline]
free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
free_unref_page_list+0x10a/0x590 mm/page_alloc.c:3154
release_pages+0xad8/0xb20 mm/swap.c:842
__pagevec_release+0xc3/0x150 mm/swap.c:862
pagevec_release include/linux/pagevec.h:88 [inline]
shmem_undo_range+0x8a5/0x1ad0 mm/shmem.c:875
shmem_truncate_range mm/shmem.c:997 [inline]
shmem_evict_inode+0x218/0x9a0 mm/shmem.c:1097
evict+0x29b/0x6a0 fs/inode.c:575
__dentry_kill+0x429/0x630 fs/dcache.c:579
dentry_kill+0xb8/0x280 fs/dcache.c:673
dput+0x154/0x2f0 fs/dcache.c:859
__fput+0x443/0x680 fs/file_table.c:294
task_work_run+0x140/0x170 kernel/task_work.c:113
ptrace_notify+0x29e/0x350 kernel/signal.c:2271
ptrace_report_syscall include/linux/tracehook.h:66 [inline]
tracehook_report_syscall_exit include/linux/tracehook.h:129 [inline]
syscall_slow_exit_work+0x167/0x400 arch/x86/entry/common.c:246
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x19d/0x1c0 arch/x86/entry/common.c:300
entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
ffff8881dcf4af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881dcf4b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881dcf4b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8881dcf4b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881dcf4b180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
EXT4-fs error (device loop1): ext4_check_all_de:657: inode #12: block 5: comm syz-executor794: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=124 fake=0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6364d594125d ANDROID: KVM: arm64: wait_for_initramfs for p..
git tree: android14-6.1
console+strace: https://syzkaller.appspot.com/x/log.txt?x=13dc9b80980000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a340f281ebc7608
dashboard link: https://syzkaller.appspot.com/bug?extid=7ffb92f4df72e7e5205e

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a23908980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a2697f180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c3ef718705a0/disk-6364d594.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/876cb2632dab/vmlinux-6364d594.xz
kernel image: https://storage.googleapis.com/syzbot-assets/74d183144c04/bzImage-6364d594.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/258862807123/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/e968d6f6acbb/mount_2.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+7ffb92...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:210 [inline]
BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x311/0xa70 fs/ext4/inline.c:1216
Read of size 68 at addr ffff888122f650cf by task syz-executor296/309

CPU: 1 PID: 309 Comm: syz-executor296 Not tainted 6.1.75-syzkaller-00075-g6364d594125d #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:

<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
memcpy+0x2d/0x70 mm/kasan/shadow.c:65
ext4_read_inline_data fs/ext4/inline.c:210 [inline]
ext4_convert_inline_data_nolock+0x311/0xa70 fs/ext4/inline.c:1216
ext4_try_add_inline_entry+0x7ff/0xb60 fs/ext4/inline.c:1342
ext4_add_entry+0x5e4/0xed0 fs/ext4/namei.c:2409
ext4_mkdir+0x54f/0xce0 fs/ext4/namei.c:3032
vfs_mkdir+0x398/0x570 fs/namei.c:4113
do_mkdirat+0x1eb/0x450 fs/namei.c:4138
__do_sys_mkdir fs/namei.c:4158 [inline]
__se_sys_mkdir fs/namei.c:4156 [inline]
__x64_sys_mkdir+0x6e/0x80 fs/namei.c:4156
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5c062c25a7
Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5c06278038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c062c25a7
RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000580
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000580
R13: 00007f5c062780d0 R14: 0000000000000000 R15: 0000000000000000
</TASK>

The buggy address belongs to the physical page:
page:ffffea00048bd940 refcount:1 mapcount:0 mapping:ffff88811f312ba8 index:0xcd pfn:0x122f65
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 309 Comm: syz-executor296 Not tainted 6.1.75-syzkaller-00075-g6364d594125d #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024

RIP: 0010:dentry_name+0x46a/0x6c0 lib/vsprintf.c:936
Code: fc 48 8b 1b 4c 89 6c 24 20 41 8d 45 ff 89 44 24 10 45 31 e4 4c 8b 6c 24 08 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 e7 00 00 00 44 0f b6 33 31 ff 44 89 f6 e8
RSP: 0018:ffffc90001026d40 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88812366e540 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: ffffc90001026e30 R08: ffffffff84f5b510 R09: ffffc90001026da0
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc900010271b5 R14: 1ffff92000204db0 R15: 0000000000000000
FS: 00007f5c062786c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5c0634557c CR3: 0000000120ac7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
pointer+0xfe/0x1000 lib/vsprintf.c:2446
vsnprintf+0xe5b/0x1c70 lib/vsprintf.c:2809
vprintk_store+0x3bb/0xff0 kernel/printk/printk.c:2156
vprintk_emit+0x103/0x450 kernel/printk/printk.c:2253
vprintk_default+0x26/0x30 kernel/printk/printk.c:2287
vprintk+0x74/0x80 kernel/printk/printk_safe.c:45
_printk+0xd1/0x111 kernel/printk/printk.c:2297
dump_mapping+0x44f/0x460
__dump_page mm/debug.c:112 [inline]
dump_page+0x5e2/0x7f0 mm/debug.c:131
print_address_description mm/kasan/report.c:355 [inline]
print_report+0x3b0/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
memcpy+0x2d/0x70 mm/kasan/shadow.c:65
ext4_read_inline_data fs/ext4/inline.c:210 [inline]
ext4_convert_inline_data_nolock+0x311/0xa70 fs/ext4/inline.c:1216
ext4_try_add_inline_entry+0x7ff/0xb60 fs/ext4/inline.c:1342
ext4_add_entry+0x5e4/0xed0 fs/ext4/namei.c:2409
ext4_mkdir+0x54f/0xce0 fs/ext4/namei.c:3032
vfs_mkdir+0x398/0x570 fs/namei.c:4113
do_mkdirat+0x1eb/0x450 fs/namei.c:4138
__do_sys_mkdir fs/namei.c:4158 [inline]
__se_sys_mkdir fs/namei.c:4156 [inline]
__x64_sys_mkdir+0x6e/0x80 fs/namei.c:4156
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5c062c25a7
Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5c06278038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c062c25a7
RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000580
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000580
R13: 00007f5c062780d0 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dentry_name+0x46a/0x6c0 lib/vsprintf.c:936
Code: fc 48 8b 1b 4c 89 6c 24 20 41 8d 45 ff 89 44 24 10 45 31 e4 4c 8b 6c 24 08 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 e7 00 00 00 44 0f b6 33 31 ff 44 89 f6 e8
RSP: 0018:ffffc90001026d40 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88812366e540 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: ffffc90001026e30 R08: ffffffff84f5b510 R09: ffffc90001026da0
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc900010271b5 R14: 1ffff92000204db0 R15: 0000000000000000
FS: 00007f5c062786c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5c0634557c CR3: 0000000120ac7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: fc cld
1: 48 8b 1b mov (%rbx),%rbx
4: 4c 89 6c 24 20 mov %r13,0x20(%rsp)
9: 41 8d 45 ff lea -0x1(%r13),%eax
d: 89 44 24 10 mov %eax,0x10(%rsp)
11: 45 31 e4 xor %r12d,%r12d
14: 4c 8b 6c 24 08 mov 0x8(%rsp),%r13
19: 48 89 d8 mov %rbx,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 e7 00 00 00 jne 0x11d
36: 44 0f b6 33 movzbl (%rbx),%r14d
3a: 31 ff xor %edi,%edi
3c: 44 89 f6 mov %r14d,%esi
3f: e8 .byte 0xe8