Re: [syzbot] [ext4?] KASAN: use-after-free Read in ext4_find_extent (4)

[syzbot <syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com>]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in ext4_find_extent

==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:841 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 fs/ext4/extents.c:956
Read of size 4 at addr ffff88806fbac08c by task kworker/u8:3/49

CPU: 0 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 ext4_ext_binsearch fs/ext4/extents.c:841 [inline]
 ext4_find_extent+0xae6/0xcc0 fs/ext4/extents.c:956
 ext4_ext_map_blocks+0x288/0x6ac0 fs/ext4/extents.c:4208
 ext4_map_create_blocks fs/ext4/inode.c:609 [inline]
 ext4_map_blocks+0x860/0x1740 fs/ext4/inode.c:811
 ext4_convert_unwritten_extents+0x2ae/0x5d0 fs/ext4/extents.c:4976
 ext4_convert_unwritten_io_end_vec+0xff/0x170 fs/ext4/extents.c:5016
 ext4_end_io_end+0xc7/0x410 fs/ext4/page-io.c:199
 ext4_do_flush_completed_IO fs/ext4/page-io.c:290 [inline]
 ext4_end_io_rsv_work+0x262/0x330 fs/ext4/page-io.c:305
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7fdb995cf pfn:0x6fbac
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001899f48 ffffea0001a80508 0000000000000000
raw: 00000007fdb995cf 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 6178, tgid 6178 (udevd), ts 265882608890, free_ts 265892368035
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
 prep_new_page mm/page_alloc.c:1853 [inline]
 get_page_from_freelist+0x2356/0x2430 mm/page_alloc.c:3879
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
 folio_alloc_mpol_noprof mm/mempolicy.c:2435 [inline]
 vma_alloc_folio_noprof+0xe4/0x200 mm/mempolicy.c:2470
 folio_prealloc+0x30/0x180 mm/memory.c:-1
 alloc_anon_folio mm/memory.c:5126 [inline]
 do_anonymous_page mm/memory.c:5183 [inline]
 do_pte_missing mm/memory.c:4360 [inline]
 handle_pte_fault mm/memory.c:6195 [inline]
 __handle_mm_fault+0x2a8b/0x5400 mm/memory.c:6336
 handle_mm_fault+0x2d5/0x7f0 mm/memory.c:6505
 do_user_addr_fault+0x764/0x1380 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
page last free pid 6178 tgid 6178 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 free_unref_folios+0xe5d/0x15f0 mm/page_alloc.c:2958
 folios_put_refs+0x584/0x670 mm/swap.c:1002
 folios_put include/linux/mm.h:1484 [inline]
 folio_batch_move_lru+0x2a5/0x330 mm/swap.c:179
 lru_add_drain_cpu+0x119/0x880 mm/swap.c:648
 lru_add_drain+0x122/0x3e0 mm/swap.c:737
 __folio_batch_release+0x48/0x90 mm/swap.c:1059
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x49e/0x14b0 mm/shmem.c:1119
 shmem_truncate_range mm/shmem.c:1231 [inline]
 shmem_evict_inode+0x272/0xa70 mm/shmem.c:1359
 evict+0x504/0x9c0 fs/inode.c:810
 __dentry_kill+0x209/0x660 fs/dcache.c:669
 dput+0x19f/0x2b0 fs/dcache.c:911
 do_renameat2+0x6b2/0xa50 fs/namei.c:5366
 __do_sys_rename fs/namei.c:5411 [inline]
 __se_sys_rename fs/namei.c:5409 [inline]
 __x64_sys_rename+0x82/0x90 fs/namei.c:5409
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88806fbabf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88806fbac000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88806fbac080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88806fbac100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806fbac180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


Tested on:

commit:         23cb64fb Merge tag 'soc-fixes-6.18-3' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=166c0514580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6e611fe59206f39f
dashboard link: https://syzkaller.appspot.com/bug?extid=ee60e584b5c6bb229126
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12f57692580000