[v6.6] KFENCE: use-after-free read in xfs_inode_item_push

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f34f16e5c632 Linux 6.6.109
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1039dee2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=db229832d67fd565b8f9
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1d84cf343aca/disk-f34f16e5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/613ae177a403/vmlinux-f34f16e5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6b9016970cbc/bzImage-f34f16e5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+db2298...@syzkaller.appspotmail.com

==================================================================
BUG: KFENCE: use-after-free read in xfs_inode_item_push+0x28a/0x2e0 fs/xfs/xfs_inode_item.c:776

Use-after-free read at 0xffff88823bc1c030 (in kfence-#13):
xfs_inode_item_push+0x28a/0x2e0 fs/xfs/xfs_inode_item.c:776
xfsaild_push_item fs/xfs/xfs_trans_ail.c:414 [inline]
xfsaild_push fs/xfs/xfs_trans_ail.c:486 [inline]
xfsaild+0xc58/0x25b0 fs/xfs/xfs_trans_ail.c:671
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

kfence-#13: 0xffff88823bc1c000-0xffff88823bc1c107, size=264, cache=xfs_ili

allocated by task 6181 on cpu 0 at 118.056553s:
kmem_cache_zalloc include/linux/slab.h:711 [inline]
xfs_inode_item_init+0x33/0xc0 fs/xfs/xfs_inode_item.c:871
xfs_trans_ijoin+0xd8/0x120 fs/xfs/libxfs/xfs_trans_inode.c:36
xfs_init_new_inode+0xb9e/0xec0 fs/xfs/xfs_inode.c:901
xfs_qm_qino_alloc+0x473/0x950 fs/xfs/xfs_qm.c:790
xfs_qm_init_quotainos+0x4d5/0x6c0 fs/xfs/xfs_qm.c:1584
xfs_qm_init_quotainfo+0x125/0x10c0 fs/xfs/xfs_qm.c:643
xfs_qm_mount_quotas+0xa0/0x600 fs/xfs/xfs_qm.c:1460
xfs_mountfs+0x1641/0x1d20 fs/xfs/xfs_mount.c:962
xfs_fs_fill_super+0x112f/0x13a0 fs/xfs/xfs_super.c:1738
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2

freed by task 5789 on cpu 1 at 118.649159s:
xfs_inode_free_callback+0x14f/0x1c0 fs/xfs/xfs_icache.c:145
rcu_do_batch kernel/rcu/tree.c:2194 [inline]
rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
handle_softirqs+0x280/0x820 kernel/softirq.c:578
do_softirq+0xed/0x180 kernel/softirq.c:479
__local_bh_enable_ip+0x178/0x1c0 kernel/softirq.c:406
do_ip_getsockopt+0xb56/0x1800 net/ipv4/ip_sockglue.c:1601
ip_getsockopt+0xbc/0x210 net/ipv4/ip_sockglue.c:1773
do_sock_getsockopt+0x368/0x440 net/socket.c:2384
__sys_getsockopt net/socket.c:2413 [inline]
__do_sys_getsockopt net/socket.c:2423 [inline]
__se_sys_getsockopt net/socket.c:2420 [inline]
__x64_sys_getsockopt+0x1d6/0x280 net/socket.c:2420
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2

CPU: 1 PID: 6189 Comm: xfsaild/loop0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:xfs_inode_item_push+0x28a/0x2e0 fs/xfs/xfs_inode_item.c:776
Code: e8 db c5 f3 ff eb 0a e8 c4 8f 59 fe bd 02 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 80 3c 06 00 74 08 48 89 df e8 56 e7 b0 fe <48> 8b 3b 48 83 c7 40 e8 5a 13 4c 07 89 e8 e9 60 fe ff ff 89 e9 80
RSP: 0018:ffffc900033e7c60 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88823bc1c030 RCX: ffff88805aab9e00
RDX: 0000000000000000 RSI: ffffffff8d1b51d0 RDI: 00000000fffffffb
RBP: 0000000000000002 R08: ffff88805aab9e00 R09: 0000000000000002
R10: 00000000fffffff5 R11: 0000000000000000 R12: ffff888078ee9898
R13: 1ffff1100f1dd31b R14: 1ffff11047783806 R15: ffff8880637e16c0
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823bc1c030 CR3: 0000000063810000 CR4: 00000000003506e0
Call Trace:
<TASK>
xfsaild_push_item fs/xfs/xfs_trans_ail.c:414 [inline]
xfsaild_push fs/xfs/xfs_trans_ail.c:486 [inline]
xfsaild+0xc58/0x25b0 fs/xfs/xfs_trans_ail.c:671
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
==================================================================
----------------
Code disassembly (best guess):
0: e8 db c5 f3 ff call 0xfff3c5e0
5: eb 0a jmp 0x11
7: e8 c4 8f 59 fe call 0xfe598fd0
c: bd 02 00 00 00 mov $0x2,%ebp
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 41 80 3c 06 00 cmpb $0x0,(%r14,%rax,1)
20: 74 08 je 0x2a
22: 48 89 df mov %rbx,%rdi
25: e8 56 e7 b0 fe call 0xfeb0e780
* 2a: 48 8b 3b mov (%rbx),%rdi <-- trapping instruction
2d: 48 83 c7 40 add $0x40,%rdi
31: e8 5a 13 4c 07 call 0x74c1390
36: 89 e8 mov %ebp,%eax
38: e9 60 fe ff ff jmp 0xfffffe9d
3d: 89 e9 mov %ebp,%ecx
3f: 80 .byte 0x80


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup