KASAN: slab-out-of-bounds Read in blk_mq_rq_ctx_init

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e3d35712 Add linux-next specific files for 20210423
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=11058f59d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e370221d7500b26a
dashboard link: https://syzkaller.appspot.com/bug?extid=232f453c25dcce54f615
CC: [ax...@kernel.dk linux...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+232f45...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in blk_mq_rq_ctx_init+0xe14/0xe90 block/blk-mq.c:281
Read of size 8 at addr ffff88801dd968d8 by task khugepaged/1658

CPU: 1 PID: 1658 Comm: khugepaged Not tainted 5.12.0-rc8-next-20210423-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233
__kasan_report mm/kasan/report.c:419 [inline]
kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436
blk_mq_rq_ctx_init+0xe14/0xe90 block/blk-mq.c:281
__blk_mq_alloc_request+0x387/0x580 block/blk-mq.c:399
blk_mq_submit_bio+0x461/0x17d0 block/blk-mq.c:2219
__submit_bio_noacct_mq block/blk-core.c:1046 [inline]
submit_bio_noacct block/blk-core.c:1079 [inline]
submit_bio_noacct+0xad2/0xf20 block/blk-core.c:1062
submit_bio+0x263/0x5e0 block/blk-core.c:1150
ext4_io_submit+0x181/0x210 fs/ext4/page-io.c:379
ext4_writepages+0x1452/0x3ba0 fs/ext4/inode.c:2820
do_writepages+0xec/0x290 mm/page-writeback.c:2352
__filemap_fdatawrite_range+0x2a5/0x390 mm/filemap.c:413
collapse_file+0x30db/0x39d0 mm/khugepaged.c:1764
khugepaged_scan_file mm/khugepaged.c:2039 [inline]
khugepaged_scan_mm_slot mm/khugepaged.c:2134 [inline]
khugepaged_do_scan mm/khugepaged.c:2218 [inline]
khugepaged+0x2caa/0x5320 mm/khugepaged.c:2263
kthread+0x3b1/0x4a0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Allocated by task 1:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc mm/kasan/common.c:507 [inline]
____kasan_kmalloc mm/kasan/common.c:466 [inline]
__kasan_kmalloc+0x9b/0xd0 mm/kasan/common.c:516
kmalloc include/linux/slab.h:558 [inline]
kzalloc include/linux/slab.h:688 [inline]
device_create_groups_vargs+0x8a/0x280 drivers/base/core.c:3960
device_create+0xdf/0x120 drivers/base/core.c:4020
mon_bin_add+0xb7/0x160 drivers/usb/mon/mon_bin.c:1359
mon_bus_init+0x18e/0x320 drivers/usb/mon/mon_main.c:302
mon_bus_add drivers/usb/mon/mon_main.c:199 [inline]
mon_notify+0x32c/0x490 drivers/usb/mon/mon_main.c:230
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:337 [inline]
blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:325
usb_register_bus drivers/usb/core/hcd.c:928 [inline]
usb_add_hcd.cold+0x3ad/0x1816 drivers/usb/core/hcd.c:2708
vhci_hcd_probe+0x150/0x3a0 drivers/usb/usbip/vhci_hcd.c:1360
platform_probe+0xfc/0x1f0 drivers/base/platform.c:1447
really_probe+0x291/0xf60 drivers/base/dd.c:576
driver_probe_device+0x298/0x410 drivers/base/dd.c:763
__device_attach_driver+0x203/0x2c0 drivers/base/dd.c:870
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
__device_attach+0x228/0x4b0 drivers/base/dd.c:938
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
device_add+0xbe0/0x2100 drivers/base/core.c:3319
platform_device_add+0x363/0x820 drivers/base/platform.c:748
vhci_hcd_init+0x341/0x485 drivers/usb/usbip/vhci_hcd.c:1544
do_one_initcall+0x103/0x650 init/main.c:1251
do_initcall_level init/main.c:1324 [inline]
do_initcalls init/main.c:1340 [inline]
do_basic_setup init/main.c:1360 [inline]
kernel_init_freeable+0x63e/0x6c7 init/main.c:1562
kernel_init+0xd/0x1c0 init/main.c:1449
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

The buggy address belongs to the object at ffff88801dd96000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 216 bytes to the right of
2048-byte region [ffff88801dd96000, ffff88801dd96800)
The buggy address belongs to the page:
page:ffffea0000776400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dd90
head:ffffea0000776400 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011042000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88801dd96780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801dd96800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801dd96880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88801dd96900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801dd96980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.