KASAN: use-after-free Read in ext4_data_block_valid (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 258971b8 Merge 4.9.202 into android-4.9-q
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=10fcbd26e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9bd17d9821ccee4f
dashboard link: https://syzkaller.appspot.com/bug?extid=0579477810f9dfac24ec
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+057947...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in ext4_data_block_valid+0x28d/0x2e0
fs/ext4/block_validity.c:210
Read of size 8 at addr ffff8801d4c0dbb0 by task syz-executor.3/2115

CPU: 1 PID: 2115 Comm: syz-executor.3 Not tainted 4.9.202+ #0
ffff8801a2787730 ffffffff81b55d2b 0000000000000000 ffffea0007530340
ffff8801d4c0dbb0 0000000000000008 ffffffff817cacfd ffff8801a2787768
ffffffff8150c321 0000000000000000 ffff8801d4c0dbb0 ffff8801d4c0dbb0
Call Trace:
[<00000000e4f28c73>] __dump_stack lib/dump_stack.c:15 [inline]
[<00000000e4f28c73>] dump_stack+0xcb/0x130 lib/dump_stack.c:56
[<0000000068acdc2a>] print_address_description+0x6f/0x23a
mm/kasan/report.c:256
[<000000006c7fc1b0>] kasan_report_error mm/kasan/report.c:355 [inline]
[<000000006c7fc1b0>] kasan_report mm/kasan/report.c:413 [inline]
[<000000006c7fc1b0>] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:397
[<000000003752d6ac>] __asan_report_load8_noabort+0x14/0x20
mm/kasan/report.c:434
[<0000000024fbd807>] ext4_data_block_valid+0x28d/0x2e0
fs/ext4/block_validity.c:210
[<00000000ef4012fe>] __check_block_validity.constprop.0+0xc1/0x210
fs/ext4/inode.c:378
[<000000001da6ec8d>] ext4_map_blocks+0xdb7/0x1710 fs/ext4/inode.c:568
[<00000000804f5b82>] ext4_getblk+0x307/0x490 fs/ext4/inode.c:943
[<000000001a7ad699>] ext4_find_entry+0xa43/0x12b0 fs/ext4/namei.c:1433
[<00000000e8a8c0ca>] ext4_rmdir fs/ext4/namei.c:2919 [inline]
[<00000000e8a8c0ca>] ext4_rmdir+0x108/0xab0 fs/ext4/namei.c:2901
[<000000009eacc908>] vfs_rmdir2 fs/namei.c:3932 [inline]
[<000000009eacc908>] vfs_rmdir2+0x21b/0x410 fs/namei.c:3910
[<0000000069dd68e9>] do_rmdir+0x2c9/0x3a0 fs/namei.c:3998
[<00000000185ec9df>] SYSC_rmdir fs/namei.c:4016 [inline]
[<00000000185ec9df>] SyS_rmdir+0x1b/0x20 fs/namei.c:4014
[<00000000f09cefcc>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
[<00000000e1c660c4>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 1:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:512 [inline]
set_track mm/kasan/kasan.c:524 [inline]
kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
slab_post_alloc_hook mm/slab.h:417 [inline]
slab_alloc_node mm/slub.c:2715 [inline]
slab_alloc mm/slub.c:2723 [inline]
kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
add_system_zone+0x2a4/0x540 fs/ext4/block_validity.c:84
ext4_setup_system_zone+0x303/0x480 fs/ext4/block_validity.c:168
ext4_fill_super+0x6c62/0xb7a0 fs/ext4/super.c:4191
mount_bdev+0x2b8/0x360 fs/super.c:1110
ext4_mount+0x35/0x40 fs/ext4/super.c:5624
mount_fs+0x27c/0x380 fs/super.c:1216
vfs_kern_mount.part.0+0xcd/0x4c0 fs/namespace.c:1000
vfs_kern_mount fs/namespace.c:982 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x3c4/0x2970 fs/namespace.c:2871
SYSC_mount fs/namespace.c:3087 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3064
do_mount_root init/do_mounts.c:366 [inline]
mount_block_root+0x304/0x6bd init/do_mounts.c:396
mount_root+0x77/0x7a init/do_mounts.c:541
prepare_namespace+0x1de/0x21d init/do_mounts.c:601
kernel_init_freeable+0x3aa/0x3c8 init/main.c:1045
kernel_init+0x12/0x163 init/main.c:953
ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375

Freed by task 4414:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:512 [inline]
set_track mm/kasan/kasan.c:524 [inline]
kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kmem_cache_free+0xbe/0x310 mm/slub.c:2980
ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:186
ext4_setup_system_zone+0x3c3/0x480 fs/ext4/block_validity.c:150
ext4_remount+0x7b8/0x1c50 fs/ext4/super.c:5116
do_remount_sb2+0x340/0x7a0 fs/super.c:835
do_remount fs/namespace.c:2364 [inline]
do_mount+0x1368/0x2970 fs/namespace.c:2862
SYSC_mount fs/namespace.c:3087 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3064
do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801d4c0db98
which belongs to the cache ext4_system_zone of size 40
The buggy address is located 24 bytes inside of
40-byte region [ffff8801d4c0db98, ffff8801d4c0dbc0)
The buggy address belongs to the page:
page:ffffea0007530340 count:1 mapcount:0 mapping: (null)
index:0xffff8801d4c0db60
flags: 0x4000000000000200(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801d4c0da80: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb
ffff8801d4c0db00: fb fb fb fc fc fb fb fb fb fb fc fc fb fb fb fb
> ffff8801d4c0db80: fb fc fc fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff8801d4c0dc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801d4c0dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs (sda1): re-mounted. Opts:
noblock_validity,data_err=ignore,sb=0x0000000000000000,lazytime,jqfmt=vfsold,


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.