[xfs?] KASAN: use-after-free Read in xfs_trans_committed_bulk

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=113db82a480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=b2b98cffeb6f569a0bda
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13feac14480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108c260c480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/008771bbcd63/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2b98c...@syzkaller.appspotmail.com

loop0: rw=399361, want=65599, limit=65536
XFS (loop0): metadata I/O error: block 0xffff ("xlog_iodone") error 5 numblks 64
XFS (loop0): xfs_do_force_shutdown(0x2) called from line 1244 of file fs/xfs/xfs_log.c. Return address = 0xffffffff825f6b0b
XFS (loop0): Quotacheck: Unsuccessful (Error -5): Disabling quotas.
==================================================================
BUG: KASAN: use-after-free in xfs_trans_committed_bulk+0x531/0x630 fs/xfs/xfs_trans.c:839
Read of size 8 at addr ffff8880a92d6050 by task kworker/1:1H/2796

CPU: 1 PID: 2796 Comm: kworker/1:1H Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xfs_buf_ioend_work
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
xfs_trans_committed_bulk+0x531/0x630 fs/xfs/xfs_trans.c:839
xlog_cil_committed+0x153/0xf50 fs/xfs/xfs_log_cil.c:600
xlog_state_do_callback+0x3dc/0x790 fs/xfs/xfs_log.c:2815
xfs_log_force_umount+0x2b9/0x430 fs/xfs/xfs_log.c:4055
xfs_do_force_shutdown+0x78/0x200 fs/xfs/xfs_fsops.c:968
xlog_iodone+0x15b/0x1e0 fs/xfs/xfs_log.c:1244
xfs_buf_ioend+0x248/0x640 fs/xfs/xfs_buf.c:1191
process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406

Allocated by task 7991:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc+0x124/0x3c0 mm/slab.c:3552
kmem_zone_alloc+0x7f/0x180 fs/xfs/kmem.c:106
kmem_zone_zalloc fs/xfs/kmem.h:131 [inline]
xfs_buf_item_init+0xa1/0x560 fs/xfs/xfs_buf_item.c:752
_xfs_trans_bjoin+0x3f/0x120 fs/xfs/xfs_trans_buf.c:89
xfs_trans_get_buf_map+0x298/0x710 fs/xfs/xfs_trans_buf.c:177
xfs_trans_get_buf fs/xfs/xfs_trans.h:179 [inline]
xfs_qm_dqalloc+0x5e6/0xa20 fs/xfs/xfs_dquot.c:354
xfs_qm_dqtobp+0x926/0xcf0 fs/xfs/xfs_dquot.c:518
xfs_qm_dqread+0x3a3/0xe50 fs/xfs/xfs_dquot.c:629
xfs_qm_dqget+0x4f4/0x19a0 fs/xfs/xfs_dquot.c:837
xfs_qm_quotacheck_dqadjust+0x96/0x5c0 fs/xfs/xfs_qm.c:1077
xfs_qm_dqusage_adjust+0x321/0xc20 fs/xfs/xfs_qm.c:1206
xfs_bulkstat_ag_ichunk fs/xfs/xfs_itable.c:313 [inline]
xfs_bulkstat+0x72a/0xf60 fs/xfs/xfs_itable.c:498
xfs_qm_quotacheck+0x223/0x790 fs/xfs/xfs_qm.c:1338
xfs_qm_mount_quotas+0xe9/0x570 fs/xfs/xfs_qm.c:1457
xfs_mountfs+0x18be/0x1f40 fs/xfs/xfs_mount.c:979
xfs_fs_fill_super+0xb7a/0x1380 fs/xfs/xfs_super.c:1688
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

Freed by task 7991:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758
xfs_buf_do_callbacks+0x97/0xe0 fs/xfs/xfs_buf_item.c:1039
xfs_buf_iodone_callbacks+0xff/0xea0 fs/xfs/xfs_buf_item.c:1185
xfs_buf_ioend+0x248/0x640 fs/xfs/xfs_buf.c:1191
xfs_buf_submit+0x58a/0x7c0 fs/xfs/xfs_buf.c:1470
xfs_buf_delwri_submit_buffers+0x328/0x9c0 fs/xfs/xfs_buf.c:2036
xfs_buf_delwri_submit+0x76/0x240 fs/xfs/xfs_buf.c:2075
xfs_qm_quotacheck+0x2a7/0x790 fs/xfs/xfs_qm.c:1367
xfs_qm_mount_quotas+0xe9/0x570 fs/xfs/xfs_qm.c:1457
xfs_mountfs+0x18be/0x1f40 fs/xfs/xfs_mount.c:979
xfs_fs_fill_super+0xb7a/0x1380 fs/xfs/xfs_super.c:1688
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

The buggy address belongs to the object at ffff8880a92d6000
which belongs to the cache xfs_buf_item of size 248
The buggy address is located 80 bytes inside of
248-byte region [ffff8880a92d6000, ffff8880a92d60f8)
The buggy address belongs to the page:
page:ffffea0002a4b580 count:1 mapcount:0 mapping:ffff8880a92d6000 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffff8880a92d6000 0000000000000000 000000010000000d
raw: ffff8880b0811248 ffff8880b0811248 ffff8880b17a6200 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8880a92d5f00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880a92d5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880a92d6000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a92d6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
ffff8880a92d6100: fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches