==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:953
Read of size 4 at addr ffff8881206d045c by task kworker/u4:0/8
CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 6.1.25-syzkaller-00099-g35fe0d393f80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:395
kasan_report+0x13c/0x170 mm/kasan/report.c:495
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:953
ext4_ext_map_blocks+0x255/0x71e0 fs/ext4/extents.c:4103
ext4_map_blocks+0xa42/0x1ce0 fs/ext4/inode.c:651
mpage_map_one_extent fs/ext4/inode.c:2421 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2474 [inline]
ext4_writepages+0x178c/0x3fb0 fs/ext4/inode.c:2842
do_writepages+0x385/0x620 mm/page-writeback.c:2472
__writeback_single_inode+0xdc/0xb80 fs/fs-writeback.c:1590
writeback_sb_inodes+0xb33/0x18f0 fs/fs-writeback.c:1881
wb_writeback+0x3b9/0x9f0 fs/fs-writeback.c:2055
wb_do_writeback fs/fs-writeback.c:2198 [inline]
wb_workfn+0x399/0x1030 fs/fs-writeback.c:2238
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296
worker_thread+0xa60/0x1260 kernel/workqueue.c:2443
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
The buggy address belongs to the physical page:
page:ffffea000481b400 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1206d0
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea000481e388 ffffea000481b3c8 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x141cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_WRITE), pid 305, tgid 305 (syz-executor221), ts 20703607314, free_ts 20788875962
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x213/0x220 mm/page_alloc.c:2574
prep_new_page mm/page_alloc.c:2581 [inline]
get_page_from_freelist+0x2527/0x2600 mm/page_alloc.c:4374
__alloc_pages+0x3a1/0x780 mm/page_alloc.c:5651
__folio_alloc+0x15/0x40 mm/page_alloc.c:5683
__folio_alloc_node include/linux/gfp.h:245 [inline]
folio_alloc include/linux/gfp.h:274 [inline]
filemap_alloc_folio include/linux/pagemap.h:474 [inline]
__filemap_get_folio+0x6c0/0x970 mm/filemap.c:1976
pagecache_get_page+0x2f/0x110 mm/folio-compat.c:110
grab_cache_page_write_begin+0x42/0x60 mm/folio-compat.c:122
ext4_write_begin+0x257/0xfb0 fs/ext4/inode.c:1195
ext4_da_write_begin+0x2ff/0x920 fs/ext4/inode.c:2987
generic_perform_write+0x2f9/0x5c0 mm/filemap.c:3765
ext4_buffered_write_iter+0x360/0x640 fs/ext4/file.c:285
ext4_file_write_iter+0x194/0x1cf0
do_iter_write+0x6e6/0xc50 fs/read_write.c:861
vfs_iter_write+0x7c/0xa0 fs/read_write.c:902
iter_file_splice_write+0x7f8/0xf90 fs/splice.c:686
do_splice_from fs/splice.c:764 [inline]
direct_splice_actor+0xff/0x130 fs/splice.c:931
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1486 [inline]
free_pcp_prepare mm/page_alloc.c:1560 [inline]
free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3473
free_unref_page_list+0xf6/0x6c0 mm/page_alloc.c:3615
release_pages+0xf7f/0xfe0 mm/swap.c:1055
__pagevec_release+0x84/0x100 mm/swap.c:1075
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
truncate_inode_pages_range+0x465/0xf10 mm/truncate.c:375
truncate_inode_pages mm/truncate.c:457 [inline]
truncate_inode_pages_final+0x83/0x90 mm/truncate.c:496
ext4_evict_inode+0x657/0x1510 fs/ext4/inode.c:210
evict+0x2a3/0x630 fs/inode.c:664
dispose_list fs/inode.c:697 [inline]
evict_inodes+0x5d1/0x650 fs/inode.c:747
generic_shutdown_super+0x97/0x370 fs/super.c:482
kill_block_super+0x7e/0xe0 fs/super.c:1452
deactivate_locked_super+0xa5/0x110 fs/super.c:334
deactivate_super+0xbe/0xf0 fs/super.c:365
cleanup_mnt+0x485/0x510 fs/namespace.c:1186
__cleanup_mnt+0x19/0x20 fs/namespace.c:1193
task_work_run+0x24d/0x2e0 kernel/task_work.c:179
Memory state around the buggy address:
ffff8881206d0300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881206d0380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881206d0400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8881206d0480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881206d0500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: comm kworker/u4:0: lblock 0 mapped to illegal pblock 0 (length 6)
EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 6 with error 117
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0
EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Corrupt filesystem
EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm kworker/u4:0: mark_inode_dirty error
EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0
EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Corrupt filesystem
EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm kworker/u4:0: mark_inode_dirty error
EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0