[v6.1] KASAN: use-after-free Read in ext4_convert_inline_data_nolock

Hello,

syzbot found the following issue on:

HEAD commit: 0102425ac76b Linux 6.1.24
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=118f0eebc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb976cea3176ce66
dashboard link: https://syzkaller.appspot.com/bug?extid=824b138c39c77ad6775f
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2bbac2ad18f4/disk-0102425a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9000ac7a5566/vmlinux-0102425a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/08367306fcea/bzImage-0102425a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

==================================================================
BUG: KASAN: use-after-free in ext4_read_inline_data fs/ext4/inline.c:200 [inline]
BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x319/0xda0 fs/ext4/inline.c:1205
Read of size 20 at addr ffff88807a5a81a3 by task syz-executor.0/15401

CPU: 1 PID: 15401 Comm: syz-executor.0 Not tainted 6.1.24-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15f/0x4f0 mm/kasan/report.c:395
kasan_report+0x136/0x160 mm/kasan/report.c:495
kasan_check_range+0x27f/0x290 mm/kasan/generic.c:189
memcpy+0x25/0x60 mm/kasan/shadow.c:65
ext4_read_inline_data fs/ext4/inline.c:200 [inline]
ext4_convert_inline_data_nolock+0x319/0xda0 fs/ext4/inline.c:1205
ext4_convert_inline_data+0x4cf/0x610 fs/ext4/inline.c:2066
ext4_fallocate+0x149/0x2160 fs/ext4/extents.c:4702
vfs_fallocate+0x547/0x6b0 fs/open.c:323
ksys_fallocate fs/open.c:346 [inline]
__do_sys_fallocate fs/open.c:354 [inline]
__se_sys_fallocate fs/open.c:352 [inline]
__x64_sys_fallocate+0xb9/0x100 fs/open.c:352
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc41808c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc418dbd168 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007fc4181ac050 RCX: 00007fc41808c169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007fc4180e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffeee318e7f R14: 00007fc418dbd300 R15: 0000000000022000
</TASK>

The buggy address belongs to the physical page:
page:ffffea0001e96a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a5a8
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea000079d708 ffffea0001d36ec8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100cc0(GFP_USER), pid 2, tgid 2 (kthreadd), ts 543524215802, free_ts 558698489427
prep_new_page mm/page_alloc.c:2540 [inline]
get_page_from_freelist+0x32ed/0x3480 mm/page_alloc.c:4292
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5559
__get_free_pages+0x8/0x30 mm/page_alloc.c:5609
kasan_populate_vmalloc_pte+0x2a/0xd0 mm/kasan/shadow.c:271
apply_to_pte_range mm/memory.c:2635 [inline]
apply_to_pmd_range mm/memory.c:2679 [inline]
apply_to_pud_range mm/memory.c:2715 [inline]
apply_to_p4d_range mm/memory.c:2751 [inline]
__apply_to_page_range+0x9c5/0xcc0 mm/memory.c:2785
alloc_vmap_area+0x1977/0x1ac0 mm/vmalloc.c:1642
__get_vm_area_node+0x16c/0x360 mm/vmalloc.c:2501
__vmalloc_node_range+0x394/0x1460 mm/vmalloc.c:3175
alloc_thread_stack_node kernel/fork.c:311 [inline]
dup_task_struct+0x3e5/0x6d0 kernel/fork.c:980
copy_process+0x637/0x4020 kernel/fork.c:2090
kernel_clone+0x222/0x920 kernel/fork.c:2679
kernel_thread+0x152/0x1d0 kernel/fork.c:2739
create_kthread kernel/kthread.c:399 [inline]
kthreadd+0x577/0x740 kernel/kthread.c:746
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1460 [inline]
free_pcp_prepare mm/page_alloc.c:1510 [inline]
free_unref_page_prepare+0xf5e/0x1110 mm/page_alloc.c:3388
free_unref_page+0x98/0x570 mm/page_alloc.c:3484
kasan_depopulate_vmalloc_pte+0x66/0x80 mm/kasan/shadow.c:375
apply_to_pte_range mm/memory.c:2635 [inline]
apply_to_pmd_range mm/memory.c:2679 [inline]
apply_to_pud_range mm/memory.c:2715 [inline]
apply_to_p4d_range mm/memory.c:2751 [inline]
__apply_to_page_range+0x9c5/0xcc0 mm/memory.c:2785
kasan_release_vmalloc+0x96/0xb0 mm/kasan/shadow.c:492
__purge_vmap_area_lazy+0x157c/0x1720 mm/vmalloc.c:1770
drain_vmap_area_work+0x3c/0xd0 mm/vmalloc.c:1799
process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
worker_thread+0xa5f/0x1210 kernel/workqueue.c:2436
kthread+0x268/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Memory state around the buggy address:
ffff88807a5a8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88807a5a8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88807a5a8180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88807a5a8200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88807a5a8280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot has found a reproducer for the following issue on:

HEAD commit: fa74641fb6b9 Linux 6.1.29
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=152e4b72280000
kernel config: https://syzkaller.appspot.com/x/.config?x=fac5c36c2b16009f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12c50236280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d8b7a1280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3e78f005d7f8/disk-fa74641f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6527fcf66401/vmlinux-fa74641f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c5e0d5f8b434/bzImage-fa74641f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0d052a081a48/mount_0.gz
loop0: detected capacity change from 0 to 2048
EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
==================================================================
BUG: KASAN: slab-out-of-bounds in ext4_read_inline_data fs/ext4/inline.c:210 [inline]
BUG: KASAN: slab-out-of-bounds in ext4_convert_inline_data_nolock+0x319/0xda0 fs/ext4/inline.c:1216
Read of size 20 at addr ffff888021fc41a3 by task syz-executor200/3543

CPU: 1 PID: 3543 Comm: syz-executor200 Not tainted 6.1.29-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
ext4_read_inline_data fs/ext4/inline.c:210 [inline]
ext4_convert_inline_data_nolock+0x319/0xda0 fs/ext4/inline.c:1216
ext4_convert_inline_data+0x4cf/0x610 fs/ext4/inline.c:2077
RIP: 0033:0x7fd1575f3059
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbd64e728 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007fd157661720 RCX: 00007fd1575f3059
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000003 R14: 00007fffbd64e760 R15: 000000000000000c
</TASK>

Allocated by task 3397:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x50/0x370 mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
vm_area_dup+0x23/0x1b0 kernel/fork.c:466
dup_mmap kernel/fork.c:644 [inline]
dup_mm+0xa7c/0x1610 kernel/fork.c:1532
copy_mm+0xca/0x160 kernel/fork.c:1581
copy_process+0x19a2/0x4020 kernel/fork.c:2259
kernel_clone+0x222/0x920 kernel/fork.c:2679
__do_sys_clone kernel/fork.c:2820 [inline]
__se_sys_clone kernel/fork.c:2804 [inline]
__x64_sys_clone+0x231/0x280 kernel/fork.c:2804
Freed by task 3398:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0x292/0x510 mm/slub.c:3683
remove_vma mm/mmap.c:144 [inline]
exit_mmap+0x538/0x9f0 mm/mmap.c:3149
__mmput+0x115/0x3c0 kernel/fork.c:1191
exit_mm+0x226/0x300 kernel/exit.c:563
do_exit+0x67e/0x2300 kernel/exit.c:856
do_group_exit+0x202/0x2b0 kernel/exit.c:1019
__do_sys_exit_group kernel/exit.c:1030 [inline]
__se_sys_exit_group kernel/exit.c:1028 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1028
The buggy address belongs to the object at ffff888021fc40d8
which belongs to the cache vm_area_struct of size 152
The buggy address is located 51 bytes to the right of
152-byte region [ffff888021fc40d8, ffff888021fc4170)
page:ffffea000087f100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21fc4
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140007b40
raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3397, tgid 3397 (sshd), ts 46628352006, free_ts 45979203794
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2533
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xa71/0x1080 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x1a5/0x2d0 mm/slub.c:3422
vm_area_dup+0x23/0x1b0 kernel/fork.c:466
dup_mmap kernel/fork.c:644 [inline]
dup_mm+0xa7c/0x1610 kernel/fork.c:1532
copy_mm+0xca/0x160 kernel/fork.c:1581
copy_process+0x19a2/0x4020 kernel/fork.c:2259
kernel_clone+0x222/0x920 kernel/fork.c:2679
__do_sys_clone kernel/fork.c:2820 [inline]
__se_sys_clone kernel/fork.c:2804 [inline]
__x64_sys_clone+0x231/0x280 kernel/fork.c:2804
free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3388
free_unref_page_list+0x107/0x810 mm/page_alloc.c:3530
release_pages+0x2836/0x2b40 mm/swap.c:1055
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261
tlb_finish_mmu+0xce/0x1f0 mm/mmu_gather.c:361
exit_mmap+0x3c3/0x9f0 mm/mmap.c:3139
__mmput+0x115/0x3c0 kernel/fork.c:1191
exit_mm+0x226/0x300 kernel/exit.c:563
do_exit+0x67e/0x2300 kernel/exit.c:856
do_group_exit+0x202/0x2b0 kernel/exit.c:1019
__do_sys_exit_group kernel/exit.c:1030 [inline]
__se_sys_exit_group kernel/exit.c:1028 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1028
ffff888021fc4080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
ffff888021fc4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
>ffff888021fc4180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
^
ffff888021fc4200: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
ffff888021fc4280: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Syzbot creates a file descriptor `r0` corresponding to the bus path and
then fuses this file descriptor with 80 bytes of data. The file
descriptor `r0` is then used to syscall fallocate where the an attempt
is made to fallocate 32kB of memory. During the fallocate, it is checked
whether the descriptor (r0) has inline data in it:

fs/ext4/inline.c:2045

```c
if (!ext4_has_inline_data(inode)) {
ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
return 0;
```

Then it checks what is the length of the inline data and it creates
buffer of it length (80 bytes):


fs/ext4/inline.c:2045

```c
inline_size = ext4_get_inline_size(inode);
buf = kmalloc(inline_size, GFP_NOFS);
```

Then inline data is read in two steps. In the first step, the minimum
size of the inline date is read into the buffer.

```c
raw_inode = ext4_raw_inode(iloc);
memcpy(buffer, (void *)(raw_inode->i_block), cp_len);

```

and in the second step of this data reading, a crash occurs:

```c
memcpy(buffer,
       (void *)IFIRST(header) + le16_to_cpu(entry->e_value_offs), len);
cp_len += len;

```

The failure is caused by read and write operations that run in parallel
and break r0 data. The problem has already been fixed in the upstream
by creating the `BLK_OPEN_RESTRICT_WRITES` flag, which restricts writes
to mounted block devices.
(https://lore.kernel.org/all/[email protected]/)
In my opinion the best approach would be to backport this fix to the
Linux 6.1 tree.

Syzbot report:Reported-by: [email protected]

Best regards,
Norbert Kamiński

For archival purposes, forwarding an incoming command email to
[email protected].

***

Subject: KASAN: use-after-free Read in ext4_convert_inline_data_nolock
Author: [email protected]

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 6f861765464f43a71462d52026fbddfc858239a5

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in ext4_convert_inline_data_nolock
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
==================================================================
BUG: KASAN: slab-use-after-free in ext4_read_inline_data fs/ext4/inline.c:209 [inline]
BUG: KASAN: slab-use-after-free in ext4_convert_inline_data_nolock+0x316/0xe10 fs/ext4/inline.c:1188
Read of size 20 at addr ffff88801735b1a3 by task syz-executor.0/5398

CPU: 1 PID: 5398 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-00022-g6f861765464f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0x15f/0x540 mm/kasan/report.c:475
kasan_report+0x13e/0x170 mm/kasan/report.c:588
kasan_check_range+0x27a/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x25/0x60 mm/kasan/shadow.c:105
ext4_read_inline_data fs/ext4/inline.c:209 [inline]
ext4_convert_inline_data_nolock+0x316/0xe10 fs/ext4/inline.c:1188
ext4_convert_inline_data+0x4d6/0x620 fs/ext4/inline.c:2041
ext4_fallocate+0x14b/0x1f40 fs/ext4/extents.c:4701
vfs_fallocate+0x54d/0x6b0 fs/open.c:324
ksys_fallocate fs/open.c:347 [inline]
__do_sys_fallocate fs/open.c:355 [inline]
__se_sys_fallocate fs/open.c:353 [inline]
__x64_sys_fallocate+0xb9/0x100 fs/open.c:353
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f870a47c959
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f870b28c0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007f870a59bf80 RCX: 00007f870a47c959
RBP: 00007f870a4d8c88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f870a59bf80 R15: 00007fffb2c730b8
</TASK>

Allocated by task 5375:
__kasan_slab_alloc+0x62/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6c/0x3b0 mm/slab.h:763
slab_alloc_node mm/slub.c:3478 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc+0x1b6/0x330 mm/slub.c:3502
getname_flags+0xb8/0x4f0 fs/namei.c:140
do_sys_openat2+0xce/0x1c0 fs/open.c:1434
do_sys_open fs/open.c:1455 [inline]
__do_sys_openat fs/open.c:1471 [inline]
__se_sys_openat fs/open.c:1466 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1466
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

Freed by task 5375:
kasan_save_free_info+0x24/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook mm/slub.c:1826 [inline]
slab_free mm/slub.c:3809 [inline]
kmem_cache_free+0x28f/0x4f0 mm/slub.c:3831
do_sys_openat2+0x176/0x1c0 fs/open.c:1448
do_sys_open fs/open.c:1455 [inline]
__do_sys_openat fs/open.c:1471 [inline]
__se_sys_openat fs/open.c:1466 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1466
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

The buggy address belongs to the object at ffff88801735a200
which belongs to the cache names_cache of size 4096
The buggy address is located 4003 bytes inside of
freed 4096-byte region [ffff88801735a200, ffff88801735b200)
page:ffffea00005cd600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17358
head:ffffea00005cd600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014a4c780 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5375, tgid 5375 (modprobe), ts 75851250888, free_ts 75785638652
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1d2/0x1f0 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1544 [inline]
get_page_from_freelist+0x3376/0x3500 mm/page_alloc.c:3312
__alloc_pages+0x251/0x660 mm/page_alloc.c:4568
alloc_pages_mpol+0x3da/0x640 mm/mempolicy.c:2133
alloc_slab_page+0x6a/0x150 mm/slub.c:1870
allocate_slab mm/slub.c:2017 [inline]
new_slab+0x84/0x2d0 mm/slub.c:2070
___slab_alloc+0xc75/0x1300 mm/slub.c:3223
__slab_alloc mm/slub.c:3322 [inline]
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc+0x213/0x330 mm/slub.c:3502
getname_flags+0xb8/0x4f0 fs/namei.c:140
do_sys_openat2+0xce/0x1c0 fs/open.c:1434
do_sys_open fs/open.c:1455 [inline]
__do_sys_openat fs/open.c:1471 [inline]
__se_sys_openat fs/open.c:1466 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1466
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
free_pages_prepare mm/page_alloc.c:1137 [inline]
free_unref_page_prepare+0x915/0xa30 mm/page_alloc.c:2347
free_unref_page+0x33/0x3e0 mm/page_alloc.c:2487
discard_slab mm/slub.c:2116 [inline]
__unfreeze_partials+0x1dc/0x220 mm/slub.c:2655
put_cpu_partial+0x17b/0x250 mm/slub.c:2731
__slab_free+0x2b2/0x380 mm/slub.c:3679
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x147/0x160 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6c/0x3b0 mm/slab.h:763
slab_alloc_node mm/slub.c:3478 [inline]
kmem_cache_alloc_node+0x1a5/0x380 mm/slub.c:3523
alloc_task_struct_node kernel/fork.c:173 [inline]
dup_task_struct+0x57/0x7d0 kernel/fork.c:1110
copy_process+0x5cd/0x3fb0 kernel/fork.c:2332
kernel_clone+0x219/0x8c0 kernel/fork.c:2907
__do_sys_clone kernel/fork.c:3050 [inline]
__se_sys_clone kernel/fork.c:3034 [inline]
__x64_sys_clone+0x254/0x2a0 kernel/fork.c:3034
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
ffff88801735b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801735b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801735b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801735b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801735b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 6f861765 fs: Block writes to mounted block devices
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=130d0ac1980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6bec0297b0bf5206
dashboard link: https://syzkaller.appspot.com/bug?extid=824b138c39c77ad6775f
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.