[Android 5.15] KASAN: slab-out-of-bounds Read in ext4_search_dir

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 61cfd264993d Revert "ipv4/fib: send notify when delete sou..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=10032214e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=86febd5cba631f80
dashboard link: https://syzkaller.appspot.com/bug?extid=99d2da6cceaf1c89cfd2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ab7d84e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b7b648e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3702cfaee584/disk-61cfd264.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/44bfef6ff1d1/vmlinux-61cfd264.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9b343f870f4b/bzImage-61cfd264.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/aa4831aab431/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/bc03f1e29822/mount_7.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+99d2da...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543
Read of size 1 at addr ffff88811d344d23 by task syz-executor249/296

CPU: 0 PID: 296 Comm: syz-executor249 Not tainted 5.15.137-syzkaller-01792-g61cfd264993d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543
ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1714
__ext4_find_entry+0x2b0/0x1af0 fs/ext4/namei.c:1616
ext4_lookup_entry fs/ext4/namei.c:1771 [inline]
ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1839
__lookup_hash+0x143/0x290 fs/namei.c:1560
filename_create+0x288/0x520 fs/namei.c:3766
do_mkdirat+0xbd/0x450 fs/namei.c:4009
__do_sys_mkdirat fs/namei.c:4034 [inline]
__se_sys_mkdirat fs/namei.c:4032 [inline]
__x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4032
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f010afcec59
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd90ff64a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f010afcec59
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 00000000000014ef R09: 00007ffd90ff64e0
R10: 00000000000014f3 R11: 0000000000000246 R12: 00007ffd90ff64e0
R13: 00007ffd90ff6768 R14: 431bde82d7b634db R15: 00007f010b01703b
</TASK>

Allocated by task 296:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
__kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:466
kasan_slab_alloc include/linux/kasan.h:217 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550
slab_alloc_node mm/slub.c:3240 [inline]
slab_alloc mm/slub.c:3248 [inline]
kmem_cache_alloc+0xf5/0x200 mm/slub.c:3253
kmem_cache_zalloc include/linux/slab.h:723 [inline]
__kernfs_new_node+0xdb/0x700 fs/kernfs/dir.c:593
kernfs_new_node+0x97/0x170 fs/kernfs/dir.c:657
__kernfs_create_file+0x4a/0x270 fs/kernfs/file.c:985
sysfs_add_file_mode_ns+0x273/0x320 fs/sysfs/file.c:317
create_files fs/sysfs/group.c:64 [inline]
internal_create_group+0x573/0xf00 fs/sysfs/group.c:149
internal_create_groups fs/sysfs/group.c:189 [inline]
sysfs_create_groups+0x5b/0x130 fs/sysfs/group.c:215
create_dir lib/kobject.c:100 [inline]
kobject_add_internal+0x8ce/0xd90 lib/kobject.c:263
kobject_add_varg lib/kobject.c:398 [inline]
kobject_init_and_add+0x120/0x190 lib/kobject.c:481
ext4_register_sysfs+0xbf/0x2c0 fs/ext4/sysfs.c:529
ext4_fill_super+0x8a31/0x96e0 fs/ext4/super.c:4940
mount_bdev+0x282/0x3b0 fs/super.c:1387
ext4_mount+0x34/0x40 fs/ext4/super.c:6581
legacy_get_tree+0xf1/0x190 fs/fs_context.c:611
vfs_get_tree+0x88/0x290 fs/super.c:1517
do_new_mount+0x28b/0xad0 fs/namespace.c:2994
path_mount+0x671/0x1070 fs/namespace.c:3324
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount+0x2c4/0x3b0 fs/namespace.c:3522
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3522
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff88811d344c80
which belongs to the cache kernfs_node_cache of size 136
The buggy address is located 27 bytes to the right of
136-byte region [ffff88811d344c80, ffff88811d344d08)
The buggy address belongs to the page:
page:ffffea000474d100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d344
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff8881001bed80
raw: 0000000000000000 0000000000140014 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 296, ts 31140690675, free_ts 0
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2602
prep_new_page+0x1b/0x110 mm/page_alloc.c:2608
get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4482
__alloc_pages+0x206/0x5e0 mm/page_alloc.c:5773
allocate_slab mm/slub.c:1932 [inline]
new_slab+0x9a/0x4e0 mm/slub.c:1995
___slab_alloc+0x39e/0x830 mm/slub.c:3028
__slab_alloc+0x4a/0x90 mm/slub.c:3115
slab_alloc_node mm/slub.c:3206 [inline]
slab_alloc mm/slub.c:3248 [inline]
kmem_cache_alloc+0x134/0x200 mm/slub.c:3253
kmem_cache_zalloc include/linux/slab.h:723 [inline]
__kernfs_new_node+0xdb/0x700 fs/kernfs/dir.c:593
kernfs_new_node+0x97/0x170 fs/kernfs/dir.c:657
__kernfs_create_file+0x4a/0x270 fs/kernfs/file.c:985
sysfs_add_file_mode_ns+0x273/0x320 fs/sysfs/file.c:317
create_files fs/sysfs/group.c:64 [inline]
internal_create_group+0x573/0xf00 fs/sysfs/group.c:149
internal_create_groups fs/sysfs/group.c:189 [inline]
sysfs_create_groups+0x5b/0x130 fs/sysfs/group.c:215
create_dir lib/kobject.c:100 [inline]
kobject_add_internal+0x8ce/0xd90 lib/kobject.c:263
kobject_add_varg lib/kobject.c:398 [inline]
kobject_init_and_add+0x120/0x190 lib/kobject.c:481
page_owner free stack trace missing

Memory state around the buggy address:
ffff88811d344c00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff88811d344c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88811d344d00: 00 fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00
^
ffff88811d344d80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
ffff88811d344e00: fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
EXT4-fs error (device loop0): ext4_find_dest_de:2112: inode #12: block 7: comm syz-executor249: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=3089191003, rec_len=43069, size=56 fake=0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d30b996835c0 Merge branch 'android13-5.10' into branch `an..
git tree: android13-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=135ca73f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=f13aac5231b00224
dashboard link: https://syzkaller.appspot.com/bug?extid=ac107c9fba66d9b8ad08

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165ff267680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1716bdd4e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ba128a3a992/disk-d30b9968.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bbebd4846da7/vmlinux-d30b9968.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3619c8823ed7/bzImage-d30b9968.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/02a88a682944/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/0967766fcd50/mount_7.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+ac107c...@syzkaller.appspotmail.com

EXT4-fs (loop0): Ignoring removed bh option
EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem
EXT4-fs (loop0): 1 truncate cleaned up
EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,resgid=0x000000000000ee00,bh,noload,data_err=ignore,usrjquota=,,errors=continue
==================================================================
BUG: KASAN: slab-out-of-bounds in ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1515
Read of size 1 at addr ffff88811e3b7d23 by task syz-executor203/291

CPU: 0 PID: 291 Comm: syz-executor203 Not tainted 5.10.199-syzkaller-00307-gd30b996835c0 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x81/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:435 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:452
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1515
ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1700
__ext4_find_entry+0x2b0/0x1990 fs/ext4/namei.c:1588
ext4_lookup_entry fs/ext4/namei.c:1743 [inline]
ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1811
__lookup_hash+0x143/0x290 fs/namei.c:1541
filename_create+0x202/0x750 fs/namei.c:3614
user_path_create fs/namei.c:3671 [inline]
do_mkdirat+0xcc/0x2c0 fs/namei.c:3811
__do_sys_mkdirat fs/namei.c:3829 [inline]
__se_sys_mkdirat fs/namei.c:3827 [inline]
__x64_sys_mkdirat+0x7b/0x90 fs/namei.c:3827
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7f27e5470539
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbc113a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f27e5470539

RDX: 0000000000000000 RSI: 0000000020000040 RDI: 00000000ffffff9c

RBP: 00007fffbc113b70 R08: 00000000000014ef R09: 00007f27e54b44ee
R10: 00000000000014f3 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fffbc113b40 R14: 0000000000000001 R15: 00007fffbc113b70

Allocated by task 0:
(stack is not available)

Freed by task 291:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
kasan_slab_free include/linux/kasan.h:220 [inline]
slab_free_hook mm/slub.c:1595 [inline]
slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
slab_free mm/slub.c:3203 [inline]
kfree+0xc3/0x270 mm/slub.c:4191
skb_free_head net/core/skbuff.c:605 [inline]
skb_release_data+0x5c6/0x6f0 net/core/skbuff.c:625
skb_release_all net/core/skbuff.c:679 [inline]
__kfree_skb net/core/skbuff.c:693 [inline]
consume_skb+0xac/0x250 net/core/skbuff.c:850
netlink_broadcast_filtered+0x114e/0x1270 net/netlink/af_netlink.c:1532
netlink_broadcast net/netlink/af_netlink.c:1554 [inline]
nlmsg_multicast include/net/netlink.h:1033 [inline]
nlmsg_notify+0x101/0x1c0 net/netlink/af_netlink.c:2540
rtnl_notify+0x9c/0xd0 net/core/rtnetlink.c:737
inet6_rt_notify+0x3c8/0x550 net/ipv6/route.c:6059
fib6_add_rt2node net/ipv6/ip6_fib.c:1249 [inline]
fib6_add+0x233e/0x3d20 net/ipv6/ip6_fib.c:1475
__ip6_ins_rt net/ipv6/route.c:1300 [inline]
ip6_route_add+0x8a/0x130 net/ipv6/route.c:3761
addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline]
addrconf_add_linklocal+0x5b5/0x9e0 net/ipv6/addrconf.c:3233
addrconf_addr_gen+0x572/0xd00 net/ipv6/addrconf.c:3362
addrconf_dev_config+0x342/0x5a0 net/ipv6/addrconf.c:3414
addrconf_notify+0x8c5/0xe90 net/ipv6/addrconf.c:3647
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0x8c/0xf0 kernel/notifier.c:410
__dev_notify_flags+0x304/0x610
dev_change_flags+0xf0/0x1a0 net/core/dev.c:8582
do_setlink+0xc5c/0x3c10 net/core/rtnetlink.c:2729
__rtnl_newlink net/core/rtnetlink.c:3407 [inline]
rtnl_newlink+0x15f0/0x2000 net/core/rtnetlink.c:3527
rtnetlink_rcv_msg+0x955/0xc50 net/core/rtnetlink.c:5608
netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2497
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5626
netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
netlink_unicast+0x8df/0xac0 net/netlink/af_netlink.c:1348
netlink_sendmsg+0xa46/0xd00 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec net/socket.c:652 [inline]
__sock_sendmsg net/socket.c:664 [inline]
__sys_sendto+0x545/0x700 net/socket.c:2004
__do_sys_sendto net/socket.c:2016 [inline]
__se_sys_sendto net/socket.c:2012 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:2012
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6

The buggy address belongs to the object at ffff88811e3b7800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 291 bytes to the right of
1024-byte region [ffff88811e3b7800, ffff88811e3b7c00)

The buggy address belongs to the page:

page:ffffea000478ec00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e3b0
head:ffffea000478ec00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 291, ts 31169733393, free_ts 0
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2456 [inline]
prep_new_page+0x166/0x180 mm/page_alloc.c:2462
get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254
__alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5346
allocate_slab mm/slub.c:1808 [inline]
new_slab+0x80/0x400 mm/slub.c:1869
new_slab_objects mm/slub.c:2627 [inline]
___slab_alloc+0x302/0x4b0 mm/slub.c:2791
__slab_alloc+0x63/0xa0 mm/slub.c:2831
slab_alloc_node mm/slub.c:2913 [inline]
slab_alloc mm/slub.c:2955 [inline]
__kmalloc_track_caller+0x1f8/0x320 mm/slub.c:4536
__kmalloc_reserve net/core/skbuff.c:143 [inline]
__alloc_skb+0xbc/0x510 net/core/skbuff.c:211
alloc_skb include/linux/skbuff.h:1126 [inline]
nlmsg_new include/net/netlink.h:953 [inline]
rtmsg_fib+0x5de/0xbf0 net/ipv4/fib_semantics.c:522
fib_table_insert+0x1096/0x1eb0 net/ipv4/fib_trie.c:1354
fib_magic net/ipv4/fib_frontend.c:1093 [inline]
fib_add_ifaddr+0x10ae/0x1a40 net/ipv4/fib_frontend.c:1139
fib_netdev_event+0x235/0x5d0 net/ipv4/fib_frontend.c:1477
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0x8c/0xf0 kernel/notifier.c:410
__dev_notify_flags+0x304/0x610
dev_change_flags+0xf0/0x1a0 net/core/dev.c:8582
do_setlink+0xc5c/0x3c10 net/core/rtnetlink.c:2729

page_owner free stack trace missing

Memory state around the buggy address:

ffff88811e3b7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811e3b7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811e3b7d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811e3b7d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811e3b7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs error (device loop0): ext4_find_dest_de:2076: