Syzkaller hit 'BUG: unable to handle kernel paging request in ext4_xattr_set_entry' bug.
EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
loop3: detected capacity change from 0 to 1024
EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
BUG: unable to handle page fault for address: ff1100010f590fe4
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
PGD 108c01067 P4D 108c02067 PUD 100175063 PMD 10f58d063 PTE 800000010f590121
Oops: Oops: 0003 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 1396 Comm: syz.3.37 Not tainted 6.12.51 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:memcpy_orig+0x31/0x140 arch/x86/lib/memcpy_64.S:71
Code: 48 83 fa 20 0f 82 86 00 00 00 40 38 fe 7c 35 48 83 ea 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c 8b 56 10 4c 8b 5e 18 48 8d 76 20 <4c> 89 07 4c 89 4f 08 4c 89 57 10 4c 89 5f 18 48 8d 7f 20 73 d4 83
RSP: 0018:ff110000091cf600 EFLAGS: 00010202
RAX: ff1100010f590fe4 RBX: ff110000091cf870 RCX: ffffffffa3d1f0bb
RDX: 00000000000000a1 RSI: ff1100010907f820 RDI: ff1100010f590fe4
RBP: ff1100010f590fe4 R08: ffc6bb6b7fe35abe R09: 2224ff136a5fe2b6
R10: f5fe0ff5c6d9f6e6 R11: 25b2ffc7db754ec3 R12: ff1100010907f800
R13: ff110000091cf7e0 R14: ff1100010f5910c2 R15: 00000000ffffff22
FS: 00007fcfa1195700(0000) GS:ff1100011b100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ff1100010f590fe4 CR3: 00000001028de001 CR4: 0000000000771ef0
PKRU: 00000000
Call Trace:
ext4_xattr_set_entry+0x10ba/0x17e0 fs/ext4/xattr.c:1813
ext4_xattr_ibody_set+0x380/0x570 fs/ext4/xattr.c:2283
ext4_xattr_set_handle+0xa16/0x14d0 fs/ext4/xattr.c:2455
ext4_xattr_set+0x1e1/0x3a0 fs/ext4/xattr.c:2569
__vfs_setxattr+0x13e/0x1b0 fs/xattr.c:200
__vfs_setxattr_noperm+0x106/0x5f0 fs/xattr.c:234
__vfs_setxattr_locked+0x1c0/0x260 fs/xattr.c:295
vfs_setxattr+0x12e/0x330 fs/xattr.c:321
do_setxattr+0x134/0x1e0 fs/xattr.c:629
path_setxattr+0x1da/0x220 fs/xattr.c:658
__do_sys_lsetxattr fs/xattr.c:683 [inline]
__se_sys_lsetxattr fs/xattr.c:679 [inline]
__x64_sys_lsetxattr+0xc1/0x160 fs/xattr.c:679
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcfa13520cd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcfa1194ba8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007fcfa15a1fa0 RCX: 00007fcfa13520cd
RDX: 0000200000000f40 RSI: 0000200000000740 RDI: 0000200000000700
RBP: 00007fcfa13d800a R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000000e1 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcfa15a1fac R14: 00007fcfa15a2038 R15: 00007fcfa1194d40
Modules linked in:
CR2: ff1100010f590fe4
---[ end trace 0000000000000000 ]---
RIP: 0010:memcpy_orig+0x31/0x140 arch/x86/lib/memcpy_64.S:71
Code: 48 83 fa 20 0f 82 86 00 00 00 40 38 fe 7c 35 48 83 ea 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c 8b 56 10 4c 8b 5e 18 48 8d 76 20 <4c> 89 07 4c 89 4f 08 4c 89 57 10 4c 89 5f 18 48 8d 7f 20 73 d4 83
RSP: 0018:ff110000091cf600 EFLAGS: 00010202
RAX: ff1100010f590fe4 RBX: ff110000091cf870 RCX: ffffffffa3d1f0bb
RDX: 00000000000000a1 RSI: ff1100010907f820 RDI: ff1100010f590fe4
RBP: ff1100010f590fe4 R08: ffc6bb6b7fe35abe R09: 2224ff136a5fe2b6
R10: f5fe0ff5c6d9f6e6 R11: 25b2ffc7db754ec3 R12: ff1100010907f800
R13: ff110000091cf7e0 R14: ff1100010f5910c2 R15: 00000000ffffff22
FS: 00007fcfa1195700(0000) GS:ff1100011b100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ff1100010f590fe4 CR3: 00000001028de001 CR4: 0000000000771ef0
PKRU: 00000000
note: syz.3.37[1396] exited with irqs disabled
EXT4-fs error (device loop3): ext4_validate_block_bitmap:440: comm syz-executor: bg 0: block 169: padding at end of block bitmap is not set
EXT4-fs error (device loop3) in ext4_mb_clear_bb:6545: Corrupt filesystem
==================================================================
BUG: KASAN: slab-use-after-free in owner_on_cpu include/linux/sched.h:2185 [inline]
BUG: KASAN: slab-use-after-free in rwsem_can_spin_on_owner kernel/locking/rwsem.c:723 [inline]
BUG: KASAN: slab-use-after-free in rwsem_down_write_slowpath+0x1064/0x1110 kernel/locking/rwsem.c:1111
Read of size 4 at addr ff1100010a11c5f4 by task syz-executor/859
CPU: 1 UID: 0 PID: 859 Comm: syz-executor Tainted: G D 6.12.51 #3
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xcf/0x610 mm/kasan/report.c:481
kasan_report+0xb5/0xe0 mm/kasan/report.c:594
owner_on_cpu include/linux/sched.h:2185 [inline]
rwsem_can_spin_on_owner kernel/locking/rwsem.c:723 [inline]
rwsem_down_write_slowpath+0x1064/0x1110 kernel/locking/rwsem.c:1111
__down_write_common kernel/locking/rwsem.c:1304 [inline]
__down_write kernel/locking/rwsem.c:1313 [inline]
down_write+0x116/0x130 kernel/locking/rwsem.c:1578
inode_lock include/linux/fs.h:815 [inline]
vfs_unlink+0xcf/0x900 fs/namei.c:4458
do_unlinkat+0x48c/0x660 fs/namei.c:4533
__do_sys_unlink fs/namei.c:4581 [inline]
__se_sys_unlink fs/namei.c:4579 [inline]
__x64_sys_unlink+0x40/0x50 fs/namei.c:4579
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcfa13516eb
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd12234e78 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcfa13516eb
RDX: 00007ffd12234eb0 RSI: 00007ffd12234eb0 RDI: 00007ffd12234f40
RBP: 00007ffd12234f40 R08: 0000000000000001 R09: 00007ffd12234d00
R10: 00000000fffffffb R11: 0000000000000206 R12: 00007fcfa13d7bb2
R13: 00007ffd12236050 R14: 0000555583064a80 R15: 00007ffd122370c0
Allocated by task 1395:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4129 [inline]
slab_alloc_node mm/slub.c:4178 [inline]
kmem_cache_alloc_node_noprof+0xe2/0x260 mm/slub.c:4230
alloc_task_struct_node kernel/fork.c:181 [inline]
dup_task_struct kernel/fork.c:1114 [inline]
copy_process+0x3bb/0x6670 kernel/fork.c:2228
kernel_clone+0xc6/0x7a0 kernel/fork.c:2810
__do_sys_clone+0xcf/0x120 kernel/fork.c:2953
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 0:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3a/0x60 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x38/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2374 [inline]
slab_free mm/slub.c:4632 [inline]
kmem_cache_free+0x241/0x4d0 mm/slub.c:4734
put_task_struct include/linux/sched/task.h:145 [inline]
delayed_put_task_struct+0x134/0x180 kernel/exit.c:228
rcu_do_batch kernel/rcu/tree.c:2575 [inline]
rcu_core+0x64c/0x1960 kernel/rcu/tree.c:2831
handle_softirqs+0x15f/0x520 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu kernel/softirq.c:662 [inline]
irq_exit_rcu+0x7f/0xb0 kernel/softirq.c:674
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x70/0x80 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Last potentially related work creation:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
__kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:541
__call_rcu_common.constprop.0+0x73/0x8d0 kernel/rcu/tree.c:3098
put_task_struct_rcu_user+0x60/0xb0 kernel/exit.c:234
finish_task_switch+0x4b1/0x650 kernel/sched/core.c:5252
context_switch kernel/sched/core.c:5346 [inline]
__schedule+0xd69/0x2b80 kernel/sched/core.c:6723
schedule_idle+0x5c/0x90 kernel/sched/core.c:6841
do_idle+0x241/0x3a0 kernel/sched/idle.c:354
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424
start_secondary+0x1bc/0x210 arch/x86/kernel/smpboot.c:314
common_startup_64+0x12c/0x138
The buggy address belongs to the object at ff1100010a11c5c0
which belongs to the cache task_struct of size 5640
The buggy address is located 52 bytes inside of
freed 5640-byte region [ff1100010a11c5c0, ff1100010a11dbc8)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a118
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ff11000100184dc0 ffd4000004510200 0000000000000002
raw: 0000000000000000 0000000000050005 00000001f5000000 0000000000000000
head: 0200000000000040 ff11000100184dc0 ffd4000004510200 0000000000000002
head: 0000000000000000 0000000000050005 00000001f5000000 0000000000000000
head: 0200000000000003 ffd4000004284601 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ff1100010a11c480: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ff1100010a11c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ff1100010a11c580: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
^
ff1100010a11c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ff1100010a11c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 48 83 fa 20 cmp $0x20,%rdx
4: 0f 82 86 00 00 00 jb 0x90
a: 40 38 fe cmp %dil,%sil
d: 7c 35 jl 0x44
f: 48 83 ea 20 sub $0x20,%rdx
13: 48 83 ea 20 sub $0x20,%rdx
17: 4c 8b 06 mov (%rsi),%r8
1a: 4c 8b 4e 08 mov 0x8(%rsi),%r9
1e: 4c 8b 56 10 mov 0x10(%rsi),%r10
22: 4c 8b 5e 18 mov 0x18(%rsi),%r11
26: 48 8d 76 20 lea 0x20(%rsi),%rsi
* 2a: 4c 89 07 mov %r8,(%rdi) <-- trapping instruction
2d: 4c 89 4f 08 mov %r9,0x8(%rdi)
31: 4c 89 57 10 mov %r10,0x10(%rdi)
35: 4c 89 5f 18 mov %r11,0x18(%rdi)
39: 48 8d 7f 20 lea 0x20(%rdi),%rdi
3d: 73 d4 jae 0x13
3f: 83 .byte 0x83