[moderation] [ext4?] KASAN: slab-use-after-free Read in ext4_ext_insert_extent

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ac347a0655db Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=114c3b0f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=88e7ba51eecd9cd6
dashboard link: https://syzkaller.appspot.com/bug?extid=f84cd89a0edee61c1a21
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [adilger...@dilger.ca linux...@vger.kernel.org linux-...@vger.kernel.org linux-...@vger.kernel.org ty...@mit.edu]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/48c6a37320cd/disk-ac347a06.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/75628a930081/vmlinux-ac347a06.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d8714a2a58d/bzImage-ac347a06.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f84cd8...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x2b8b/0x4f00 fs/ext4/extents.c:2156
Read of size 243660 at addr ffff8880227bc854 by task syz-executor.5/8776

CPU: 1 PID: 8776 Comm: syz-executor.5 Not tainted 6.6.0-syzkaller-16039-gac347a0655db #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0x163/0x540 mm/kasan/report.c:475
kasan_report+0x142/0x170 mm/kasan/report.c:588
kasan_check_range+0x27e/0x290 mm/kasan/generic.c:187
__asan_memmove+0x29/0x70 mm/kasan/shadow.c:94
ext4_ext_insert_extent+0x2b8b/0x4f00 fs/ext4/extents.c:2156
ext4_ext_map_blocks+0x207c/0x7150 fs/ext4/extents.c:4306
ext4_map_blocks+0xa2f/0x1cb0 fs/ext4/inode.c:621
_ext4_get_block+0x238/0x6a0 fs/ext4/inode.c:763
ext4_block_write_begin+0x537/0x1840 fs/ext4/inode.c:1053
ext4_write_begin+0x619/0x10b0
generic_perform_write+0x31b/0x630 mm/filemap.c:3918
ext4_buffered_write_iter+0xc6/0x350 fs/ext4/file.c:299
ext4_file_write_iter+0x1dc/0x19b0
call_write_iter include/linux/fs.h:2020 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x792/0xb20 fs/read_write.c:584
ksys_write+0x1a0/0x2c0 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7efcd3e7cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efcd29fe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007efcd3f9bf80 RCX: 00007efcd3e7cae9
RDX: 00000000fffffd9d RSI: 0000000020000440 RDI: 0000000000000008
RBP: 00007efcd3ec847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007efcd3f9bf80 R15: 00007ffedbd179f8
</TASK>

The buggy address belongs to the physical page:
page:ffffea000089ef00 refcount:3 mapcount:1 mapping:ffff88801b0c1f78 index:0x3e pfn:0x227bc
memcg:ffff888026d86000
aops:def_blk_aops ino:700005
flags: 0xfff0000002813c(referenced|uptodate|dirty|lru|active|private|mappedtodisk|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0x0()
raw: 00fff0000002813c ffffea0000c8f548 ffffea0000801888 ffff88801b0c1f78
raw: 000000000000003e ffff88808100d658 0000000300000000 ffff888026d86000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 8772, tgid 8772 (syz-executor.5), ts 2332075647520, free_ts 2330096080070
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1544 [inline]
get_page_from_freelist+0x339a/0x3530 mm/page_alloc.c:3312
__alloc_pages+0x255/0x670 mm/page_alloc.c:4568
alloc_pages_mpol+0x3de/0x640 mm/mempolicy.c:2133
alloc_pages mm/mempolicy.c:2204 [inline]
folio_alloc+0x12a/0x330 mm/mempolicy.c:2211
filemap_alloc_folio+0xde/0x500 mm/filemap.c:974
page_cache_ra_unbounded+0x1f2/0x7c0 mm/readahead.c:247
do_async_mmap_readahead mm/filemap.c:3169 [inline]
filemap_fault+0x74a/0x1670 mm/filemap.c:3223
__do_fault+0x133/0x4e0 mm/memory.c:4265
do_shared_fault mm/memory.c:4692 [inline]
do_fault mm/memory.c:4766 [inline]
do_pte_missing mm/memory.c:3730 [inline]
handle_pte_fault mm/memory.c:5038 [inline]
__handle_mm_fault mm/memory.c:5179 [inline]
handle_mm_fault+0x21d7/0x6650 mm/memory.c:5344
do_user_addr_fault arch/x86/mm/fault.c:1364 [inline]
handle_page_fault arch/x86/mm/fault.c:1505 [inline]
exc_page_fault+0x455/0x860 arch/x86/mm/fault.c:1561
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1137 [inline]
free_unref_page_prepare+0x92a/0xa50 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:234 [inline]
pipe_read+0x6ee/0x13e0 fs/pipe.c:354
call_read_iter include/linux/fs.h:2014 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x78b/0xb00 fs/read_write.c:470
ksys_read+0x1a0/0x2c0 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:
ffff8880227bcf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880227bcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880227bd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880227bd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff8880227bd100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.