KASAN: use-after-free Read in ext4_find_extent (3)

Status: fixed on 2024/01/30 23:26
Subsystems: ext4
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+7ec4ebe875a7076ebb31@syzkaller.appspotmail.com
Fix commit: 6f861765464f fs: Block writes to mounted block devices
First crash: 1139d, last: 953d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: fixed by (bisect log) :
commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <jack@suse.cz>
Date: Wed Nov 1 17:43:10 2023 +0000

  fs: Block writes to mounted block devices

  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
KASAN: use-after-free in ext4_find_extent in v6.9 3 (3) 2024/05/16 00:33
[syzbot] [ext4?] KASAN: use-after-free Read in ext4_find_extent (3) 2 (4) 2024/01/27 21:58
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Read in ext4_find_extent 19 syz, C 2 439d 537d 0/2 upstream: reported C repro on 2025/02/13 21:05
android-5-10 KASAN: use-after-free Read in ext4_find_extent ext4 19 syz, C error inconclusive 145 4h41m 1318d 0/2 upstream: reported C repro on 2022/12/26 07:59
android-6-1 KASAN: use-after-free Read in ext4_find_extent missing-backport 19 syz, C error done 3 647d 1144d 0/2 auto-obsoleted due to no activity on 2025/02/04 04:57
linux-5.15 KASAN: use-after-free Read in ext4_find_extent origin:lts-only 19 syz, C inconclusive 7 35d 1113d 0/3 upstream: reported C repro on 2023/07/19 14:49
linux-6.6 KASAN: use-after-free Read in ext4_find_extent 19 syz, C error 8 222d 223d 0/2 auto-obsoleted due to no activity on 2026/04/15 02:12
upstream KASAN: use-after-free Read in ext4_find_extent ext4 19 2 1750d 1811d 0/29 auto-closed as invalid on 2022/02/17 05:19
android-6-1 KASAN: use-after-free Read in ext4_find_extent (2) origin:lts 19 syz, C 35 23d 431d 0/2 upstream: reported C repro on 2025/05/31 08:45
linux-6.1 KASAN: use-after-free Read in ext4_find_extent origin:upstream missing-backport 19 syz, C done 69 131d 1051d 0/3 upstream: reported C repro on 2023/09/19 00:11
android-5-15 KASAN: use-after-free Read in ext4_find_extent ext4 origin:lts 19 syz, C error 142 2d14h 1318d 0/2 upstream: reported C repro on 2022/12/26 07:59
upstream KASAN: use-after-free Read in ext4_find_extent (2) ext4 19 syz, C error 2 1188d 1313d 22/29 fixed on 2023/06/08 14:41
upstream KASAN: use-after-free Read in ext4_find_extent (4) prio:high ext4 19 syz, C done error 307 129d 583d 0/29 auto-obsoleted due to no activity on 2026/06/22 22:43
android-54 KASAN: slab-out-of-bounds Read in ext4_find_extent ext4 17 syz, C 1 1132d 1318d 0/2 auto-obsoleted due to no activity on 2023/10/08 03:20
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2024/01/09 09:07 25m retest repro upstream OK log
2024/01/09 08:49 31m retest repro upstream OK log
2024/01/09 08:13 30m retest repro upstream OK log
2024/01/09 08:02 33m retest repro upstream OK log
2024/01/09 08:13 18m retest repro upstream OK log
2024/01/09 08:02 22m retest repro upstream OK log
2024/01/09 07:25 25m retest repro upstream OK log
2024/01/09 07:19 20m retest repro upstream OK log
2023/09/27 05:30 15m retest repro upstream report log
2023/09/03 15:05 11m retest repro upstream report log
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2024/01/27 05:33 3h31m bisect fix upstream OK (1) job log
2023/10/30 14:22 1h22m bisect fix upstream OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbe8/0xce0 fs/ext4/extents.c:953
Read of size 4 at addr ffff888073c147e0 by task kworker/u4:5/946

CPU: 0 PID: 946 Comm: kworker/u4:5 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
 ext4_find_extent+0xbe8/0xce0 fs/ext4/extents.c:953
 ext4_ext_map_blocks+0x26b/0x5ae0 fs/ext4/extents.c:4101
 ext4_map_blocks+0x619/0x1770 fs/ext4/inode.c:621
 mpage_map_one_extent fs/ext4/inode.c:2169 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2222 [inline]
 ext4_do_writepages+0x184e/0x3350 fs/ext4/inode.c:2685
 ext4_writepages+0x30c/0x780 fs/ext4/inode.c:2774
 do_writepages+0x1b4/0x690 mm/page-writeback.c:2553
 __writeback_single_inode+0x158/0xe90 fs/fs-writeback.c:1625
 writeback_sb_inodes+0x599/0x1080 fs/fs-writeback.c:1916
 wb_writeback+0x2a5/0xaa0 fs/fs-writeback.c:2092
 wb_do_writeback fs/fs-writeback.c:2239 [inline]
 wb_workfn+0x29c/0xfe0 fs/fs-writeback.c:2279
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2627
 process_scheduled_works kernel/workqueue.c:2700 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001cf0500 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73c14
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5048, tgid 5048 (sshd), ts 46944198017, free_ts 47025991886
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1537
 prep_new_page mm/page_alloc.c:1544 [inline]
 get_page_from_freelist+0xa25/0x36d0 mm/page_alloc.c:3312
 __alloc_pages+0x22e/0x2420 mm/page_alloc.c:4568
 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
 vma_alloc_folio+0xad/0x220 mm/mempolicy.c:2172
 do_anonymous_page mm/memory.c:4172 [inline]
 do_pte_missing mm/memory.c:3729 [inline]
 handle_pte_fault mm/memory.c:5039 [inline]
 __handle_mm_fault+0xe07/0x3d70 mm/memory.c:5180
 handle_mm_fault+0x47a/0xa10 mm/memory.c:5345
 do_user_addr_fault+0x30b/0x1000 arch/x86/mm/fault.c:1364
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x5d/0xc0 arch/x86/mm/fault.c:1561
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1137 [inline]
 free_unref_page_prepare+0x4fa/0xaa0 mm/page_alloc.c:2347
 free_unref_page_list+0xe6/0xb40 mm/page_alloc.c:2533
 release_pages+0x32a/0x14f0 mm/swap.c:1042
 tlb_batch_pages_flush+0x9a/0x190 mm/mmu_gather.c:98
 tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
 tlb_flush_mmu mm/mmu_gather.c:300 [inline]
 tlb_finish_mmu+0x14b/0x6f0 mm/mmu_gather.c:392
 unmap_region.constprop.0+0x2e6/0x3b0 mm/mmap.c:2341
 do_vmi_align_munmap+0xde6/0x1600 mm/mmap.c:2657
 do_vmi_munmap+0x20e/0x450 mm/mmap.c:2725
 __vm_munmap+0x144/0x390 mm/mmap.c:3012
 __do_sys_munmap mm/mmap.c:3029 [inline]
 __se_sys_munmap mm/mmap.c:3026 [inline]
 __x64_sys_munmap+0x62/0x80 mm/mmap.c:3026
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:
 ffff888073c14680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888073c14700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888073c14780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
 ffff888073c14800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888073c14880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbe8/0xce0 fs/ext4/extents.c:953
Read of size 4 at addr ffff888073c147e0 by task kworker/u4:5/946

CPU: 1 PID: 946 Comm: kworker/u4:5 Tainted: G    B              6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
 ext4_find_extent+0xbe8/0xce0 fs/ext4/extents.c:953
 ext4_ext_map_blocks+0x26b/0x5ae0 fs/ext4/extents.c:4101
 ext4_map_blocks+0x619/0x1770 fs/ext4/inode.c:621
 mpage_map_one_extent fs/ext4/inode.c:2169 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2222 [inline]
 ext4_do_writepages+0x184e/0x3350 fs/ext4/inode.c:2685
 ext4_writepages+0x30c/0x780 fs/ext4/inode.c:2774
 do_writepages+0x1b4/0x690 mm/page-writeback.c:2553
 __writeback_single_inode+0x158/0xe90 fs/fs-writeback.c:1625
 writeback_sb_inodes+0x599/0x1080 fs/fs-writeback.c:1916
 wb_writeback+0x2a5/0xaa0 fs/fs-writeback.c:2092
 wb_do_writeback fs/fs-writeback.c:2239 [inline]
 wb_workfn+0x29c/0xfe0 fs/fs-writeback.c:2279
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2627
 process_scheduled_works kernel/workqueue.c:2700 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001cf0500 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73c14
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5048, tgid 5048 (sshd), ts 46944198017, free_ts 47025991886
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1537
 prep_new_page mm/page_alloc.c:1544 [inline]
 get_page_from_freelist+0xa25/0x36d0 mm/page_alloc.c:3312
 __alloc_pages+0x22e/0x2420 mm/page_alloc.c:4568
 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
 vma_alloc_folio+0xad/0x220 mm/mempolicy.c:2172
 do_anonymous_page mm/memory.c:4172 [inline]
 do_pte_missing mm/memory.c:3729 [inline]
 handle_pte_fault mm/memory.c:5039 [inline]
 __handle_mm_fault+0xe07/0x3d70 mm/memory.c:5180
 handle_mm_fault+0x47a/0xa10 mm/memory.c:5345
 do_user_addr_fault+0x30b/0x1000 arch/x86/mm/fault.c:1364
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x5d/0xc0 arch/x86/mm/fault.c:1561
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1137 [inline]
 free_unref_page_prepare+0x4fa/0xaa0 mm/page_alloc.c:2347
 free_unref_page_list+0xe6/0xb40 mm/page_alloc.c:2533
 release_pages+0x32a/0x14f0 mm/swap.c:1042
 tlb_batch_pages_flush+0x9a/0x190 mm/mmu_gather.c:98
 tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
 tlb_flush_mmu mm/mmu_gather.c:300 [inline]
 tlb_finish_mmu+0x14b/0x6f0 mm/mmu_gather.c:392
 unmap_region.constprop.0+0x2e6/0x3b0 mm/mmap.c:2341
 do_vmi_align_munmap+0xde6/0x1600 mm/mmap.c:2657
 do_vmi_munmap+0x20e/0x450 mm/mmap.c:2725
 __vm_munmap+0x144/0x390 mm/mmap.c:3012
 __do_sys_munmap mm/mmap.c:3029 [inline]
 __se_sys_munmap mm/mmap.c:3026 [inline]
 __x64_sys_munmap+0x62/0x80 mm/mmap.c:3026
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:
 ffff888073c14680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888073c14700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888073c14780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
 ffff888073c14800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888073c14880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (31):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/26 07:17 upstream fbafc3e621c3 fb427a07 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-badwrites-root KASAN: use-after-free Read in ext4_find_extent
2023/12/13 17:04 upstream 88035e5694a8 ebcad15c .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: use-after-free Read in ext4_find_extent
2023/11/18 01:13 upstream 6bc40e44f1dd cb976f63 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in ext4_find_extent
2023/11/15 20:35 upstream c42d9eeef8e5 cb976f63 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/28 19:08 upstream 57012c57536f 92476829 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci-upstream-kasan-gce-root KASAN: use-after-free Read in ext4_find_extent
2023/06/23 16:47 upstream 8a28a0b6f1a1 79782afc .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/12/25 21:05 upstream 861deac3b092 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/12/01 09:02 upstream e8f60209d6cf f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/11/22 16:15 upstream c2d5304e6c64 03e12510 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/11/15 18:30 upstream c42d9eeef8e5 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/09/29 03:49 upstream 9ed22ae6be81 d265efd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/09/13 05:14 upstream a747acc0b752 59da8366 .config console log report info ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/08/20 15:00 upstream 9e6c269de404 d216d8a0 .config console log report info ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/08/01 15:11 upstream 5d0c230f1de8 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/08/01 11:05 upstream 5d0c230f1de8 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/08/01 05:41 upstream 5d0c230f1de8 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/31 09:28 upstream 5d0c230f1de8 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/29 19:59 upstream ffabf7c73176 92476829 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/29 18:58 upstream ffabf7c73176 92476829 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/28 03:44 upstream 57012c57536f 92476829 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/24 18:36 upstream 6eaae1980760 b03242d7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/08 17:52 upstream 8689f4f2ea56 668cb1fa .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/07/07 23:32 upstream 5133c9e51de4 668cb1fa .config console log report info ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/06/29 18:14 upstream b19edac5992d 134ddc02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/06/25 07:09 upstream a92b7d26c743 09ffe269 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in ext4_find_extent
2023/06/23 16:09 upstream 8a28a0b6f1a1 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ext4_find_extent
2023/12/10 04:54 upstream b10a3ccaf6e3 28b24332 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ext4_find_extent
2023/10/30 22:08 upstream 14ab6d425e80 b5729d82 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ext4_find_extent
2023/06/29 21:15 upstream b19edac5992d 134ddc02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in ext4_find_extent
2023/06/29 04:02 upstream b19edac5992d ca69c785 .config console log report info ci2-upstream-fs KASAN: slab-use-after-free Read in ext4_find_extent
2023/06/26 19:58 upstream 6995e2de6891 4cd5bb25 .config console log report info ci-qemu-upstream KASAN: out-of-bounds Read in ext4_find_extent
* Struck through repros no longer work on HEAD.