KASAN: use-after-free Read in ext4_put_super

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9d5c0b3a8e1a Linux 4.14.295
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14c63b1a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=746c079015a92425
dashboard link: https://syzkaller.appspot.com/bug?extid=e1752a7cf45c7511d1de
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12db6b34880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed6fcf5895a2/disk-9d5c0b3a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/341aa3534116/vmlinux-9d5c0b3a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/19ad9d2a9b7f/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e1752a...@syzkaller.appspotmail.com

EXT4-fs (loop0): re-mounted. Opts: (null)
EXT4-fs (loop2): re-mounted. Opts: (null)
EXT4-fs (loop0): re-mounted. Opts: (null)
EXT4-fs warning (device loop5): ext4_multi_mount_protect:325: MMP startup interrupted, failing mount
==================================================================
BUG: KASAN: use-after-free in to_kthread kernel/kthread.c:71 [inline]
BUG: KASAN: use-after-free in kthread_stop+0x591/0x640 kernel/kthread.c:551
Read of size 4 at addr ffff8880a05a8164 by task syz-executor.5/7998

CPU: 1 PID: 7998 Comm: syz-executor.5 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
print_req_error: I/O error, dev loop3, sector 0
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429
EXT4-fs (loop0): re-mounted. Opts: (null)
to_kthread kernel/kthread.c:71 [inline]
kthread_stop+0x591/0x640 kernel/kthread.c:551
EXT4-fs (loop1): re-mounted. Opts: (null)
ext4_put_super+0x865/0xf00 fs/ext4/super.c:988
generic_shutdown_super+0x144/0x370 fs/super.c:446
kill_block_super+0x95/0xe0 fs/super.c:1161
deactivate_locked_super+0x6c/0xd0 fs/super.c:319
deactivate_super+0x7f/0xa0 fs/super.c:350
EXT4-fs (loop0): re-mounted. Opts: (null)
cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
task_work_run+0x11f/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f6d58634a17
RSP: 002b:00007fff22d29278 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6d58634a17
RDX: 00007fff22d2934a RSI: 000000000000000a RDI: 00007fff22d29340
RBP: 00007fff22d29340 R08: 00000000ffffffff R09: 00007fff22d29110
R10: 00005555571d6903 R11: 0000000000000246 R12: 00007f6d5868d5f6
R13: 00007fff22d2a400 R14: 00005555571d6810 R15: 00007fff22d2a440

Allocated by task 2:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
EXT4-fs (loop1): re-mounted. Opts: (null)
kmem_cache_alloc_node+0x146/0x410 mm/slab.c:3642
alloc_task_struct_node kernel/fork.c:156 [inline]
dup_task_struct kernel/fork.c:515 [inline]
copy_process.part.0+0x17d3/0x71c0 kernel/fork.c:1631
copy_process kernel/fork.c:1606 [inline]
_do_fork+0x184/0xc80 kernel/fork.c:2092
kernel_thread+0x2f/0x40 kernel/fork.c:2154
create_kthread kernel/kthread.c:255 [inline]
kthreadd+0x51a/0x770 kernel/kthread.c:592
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Freed by task 18:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758
__put_task_struct+0x276/0x470 kernel/fork.c:420
put_task_struct include/linux/sched/task.h:98 [inline]
delayed_put_task_struct+0x1fb/0x2e0 kernel/exit.c:180
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2699 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946
__do_softirq+0x24d/0x9ff kernel/softirq.c:288

The buggy address belongs to the object at ffff8880a05a8140
which belongs to the cache task_struct of size 6144
The buggy address is located 36 bytes inside of
6144-byte region [ffff8880a05a8140, ffff8880a05a9940)
The buggy address belongs to the page:
print_req_error: I/O error, dev loop2, sector 0
page:ffffea0002816a00 count:1 mapcount:0 mapping:ffff8880a05a8140 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffff8880a05a8140 0000000000000000 0000000100000001
raw: ffffea000287b6a0 ffffea00023c21a0 ffff88823f8307c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8880a05a8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880a05a8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
print_req_error: I/O error, dev loop4, sector 0
>ffff8880a05a8100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8880a05a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a05a8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches