KASAN: use-after-free Read in ext4_data_block_valid

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: be9b6782 Linux 4.19.60
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10c3adf4600000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3bc2d2906e029ec
dashboard link: https://syzkaller.appspot.com/bug?extid=96d41e743547b0d15ccb
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+96d41e...@syzkaller.appspotmail.com

XFS (loop3): unknown mount option [�5v� M1zn8� G��[�q=��ud���p�S+ ].
==================================================================
BUG: KASAN: use-after-free in ext4_data_block_valid+0x2ef/0x350
fs/ext4/block_validity.c:211
Read of size 8 at addr ffff888216237600 by task syz-executor.5/7620

CPU: 0 PID: 7620 Comm: syz-executor.5 Not tainted 4.19.60 #33
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:211
__check_block_validity.constprop.0+0xc1/0x210 fs/ext4/inode.c:402
ext4_map_blocks+0x1085/0x1a10 fs/ext4/inode.c:592
ext4_getblk+0x40b/0x510 fs/ext4/inode.c:966
ext4_bread_batch+0x7f/0x420 fs/ext4/inode.c:1036
ext4_find_entry+0x54e/0x1030 fs/ext4/namei.c:1429
ext4_rmdir fs/ext4/namei.c:2933 [inline]
ext4_rmdir+0x1ba/0xc90 fs/ext4/namei.c:2912
vfs_rmdir fs/namei.c:3879 [inline]
vfs_rmdir+0x196/0x460 fs/namei.c:3858
do_rmdir+0x39e/0x420 fs/namei.c:3940
__do_sys_rmdir fs/namei.c:3958 [inline]
__se_sys_rmdir fs/namei.c:3956 [inline]
__x64_sys_rmdir+0x36/0x40 fs/namei.c:3956
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459597
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 7d ba fb ff c3
66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 5d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff388af358 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000459597
RDX: 0000000000000000 RSI: 0000000000715698 RDI: 00007fff388b0490
RBP: 000000000000003e R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000006 R11: 0000000000000207 R12: 00007fff388b0490
R13: 0000000001d18940 R14: 0000000000000000 R15: 00007fff388b0490

Allocated by task 1:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
add_system_zone+0x302/0x650 fs/ext4/block_validity.c:85
ext4_setup_system_zone+0x36d/0x510 fs/ext4/block_validity.c:169
ext4_fill_super+0x7154/0xc830 fs/ext4/super.c:4425
mount_bdev+0x304/0x3c0 fs/super.c:1158
ext4_mount+0x35/0x40 fs/ext4/super.c:5936
mount_fs+0xa8/0x32b fs/super.c:1261
vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
do_mount_root+0x35/0x1d3 init/do_mounts.c:356
mount_block_root+0x353/0x61d init/do_mounts.c:385
mount_root+0x283/0x2cd init/do_mounts.c:530
prepare_namespace+0x26f/0x2ae init/do_mounts.c:589
kernel_init_freeable+0x5aa/0x5c8 init/main.c:1164
kernel_init+0x12/0x1c1 init/main.c:1062
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Freed by task 8194:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:187
ext4_setup_system_zone+0x450/0x510 fs/ext4/block_validity.c:151
ext4_remount+0x112e/0x22d0 fs/ext4/super.c:5381
do_remount_sb+0x1c4/0x710 fs/super.c:888
do_remount fs/namespace.c:2290 [inline]
do_mount+0x170a/0x2bc0 fs/namespace.c:2790
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8882162375e8
which belongs to the cache ext4_system_zone of size 40
The buggy address is located 24 bytes inside of
40-byte region [ffff8882162375e8, ffff888216237610)
The buggy address belongs to the page:
page:ffffea0008588dc0 count:1 mapcount:0 mapping:ffff8880a65be0c0
index:0xffff888216237fb9
flags: 0x6fffc0000000100(slab)
raw: 06fffc0000000100 ffff88821a12fe38 ffff88821a12fe38 ffff8880a65be0c0
raw: ffff888216237fb9 ffff888216237000 000000010000001c 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff888216237500: fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb
ffff888216237580: fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb fb
> ffff888216237600: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888216237680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888216237700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs (sda1): re-mounted. Opts: noblock_validity,


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.