KASAN: use-after-free Read in ext4_da_invalidatepage

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c37da90e Linux 4.19.143
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12f8beed900000
kernel config: https://syzkaller.appspot.com/x/.config?x=d162ec57805c4e4d
dashboard link: https://syzkaller.appspot.com/bug?extid=cd647a1efba1a0345a46
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd647a...@syzkaller.appspotmail.com

GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
==================================================================
BUG: KASAN: use-after-free in ext4_da_page_release_reservation fs/ext4/inode.c:1670 [inline]
BUG: KASAN: use-after-free in ext4_da_invalidatepage+0xc23/0xe20 fs/ext4/inode.c:3216
Read of size 8 at addr ffff888000c02020 by task syz-executor.3/6482

CPU: 0 PID: 6482 Comm: syz-executor.3 Not tainted 4.19.143-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
ext4_da_page_release_reservation fs/ext4/inode.c:1670 [inline]
ext4_da_invalidatepage+0xc23/0xe20 fs/ext4/inode.c:3216
do_invalidatepage mm/truncate.c:165 [inline]
truncate_cleanup_page+0x3a4/0x580 mm/truncate.c:187
truncate_inode_pages_range+0x530/0x1b10 mm/truncate.c:367
ext4_evict_inode+0x4d2/0x1780 fs/ext4/inode.c:249
evict+0x2ed/0x760 fs/inode.c:559
iput_final fs/inode.c:1555 [inline]
iput+0x4f1/0x860 fs/inode.c:1581
do_unlinkat+0x40b/0x660 fs/namei.c:4071
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d307
Code: 00 66 90 b8 58 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 dd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc4042d438 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045d307
RDX: 00007ffc4042d450 RSI: 00007ffc4042d450 RDI: 00007ffc4042d4e0
RBP: 0000000000002064 R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000003 R11: 0000000000000246 R12: 00007ffc4042e570
R13: 0000000001d8da60 R14: 0000000000000000 R15: 00007ffc4042e570

Allocated by task 13750:
kmem_cache_alloc+0x122/0x370 mm/slab.c:3559
kmem_cache_zalloc include/linux/slab.h:699 [inline]
alloc_buffer_head+0x20/0x130 fs/buffer.c:3388
alloc_page_buffers+0x169/0x5c0 fs/buffer.c:830
create_empty_buffers+0x2c/0x760 fs/buffer.c:1528
create_page_buffers+0x212/0x350 fs/buffer.c:1645
__block_write_begin_int+0x22b/0x17b0 fs/buffer.c:1957
ext4_da_write_begin+0x4e1/0x10e0 fs/ext4/inode.c:3101
generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3162
__generic_file_write_iter+0x24b/0x610 mm/filemap.c:3287
ext4_file_write_iter+0x2fe/0xf20 fs/ext4/file.c:272
call_write_iter include/linux/fs.h:1821 [inline]
do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
do_iter_write+0x182/0x5d0 fs/read_write.c:960
vfs_iter_write+0x70/0xa0 fs/read_write.c:973
iter_file_splice_write+0x60d/0xbb0 fs/splice.c:750
do_splice_from fs/splice.c:852 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1025
splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
do_splice_direct+0x1a7/0x270 fs/splice.c:1068
do_sendfile+0x550/0xc30 fs/read_write.c:1447
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 6482:
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x7f/0x260 mm/slab.c:3765
free_buffer_head+0x4a/0xf0 fs/buffer.c:3403
try_to_free_buffers+0x38b/0x5d0 fs/buffer.c:3318
ext4_releasepage+0x38b/0x4a0 fs/ext4/inode.c:3415
try_to_release_page+0x242/0x390 mm/filemap.c:3350
block_invalidatepage+0x45b/0x4f0 fs/buffer.c:1511
do_invalidatepage mm/truncate.c:165 [inline]
truncate_cleanup_page+0x3a4/0x580 mm/truncate.c:187
truncate_inode_pages_range+0x530/0x1b10 mm/truncate.c:367
ext4_evict_inode+0x4d2/0x1780 fs/ext4/inode.c:249
evict+0x2ed/0x760 fs/inode.c:559
iput_final fs/inode.c:1555 [inline]
iput+0x4f1/0x860 fs/inode.c:1581
do_unlinkat+0x40b/0x660 fs/namei.c:4071
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff888000c02000
which belongs to the cache buffer_head of size 104
The buggy address is located 32 bytes inside of
104-byte region [ffff888000c02000, ffff888000c02068)
The buggy address belongs to the page:
page:ffffea0000030080 count:1 mapcount:0 mapping:ffff88812c2df380 index:0x0
flags: 0x7ffe0000000100(slab)
raw: 007ffe0000000100 ffffea0001015ec8 ffffea00004db248 ffff88812c2df380
raw: 0000000000000000 ffff888000c02000 0000000100000018 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff888000c01f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888000c01f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888000c02000: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
^
ffff888000c02080: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb
ffff888000c02100: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.