[BUG] f2fs: possible KASAN use-after-free in f2fs_iget on v7.2-rc3

[CJ]

Hi,

I am reporting a possible recurrence of a KASAN use-after-free triggered
by a syzkaller reproducer on Linux 7.2-rc3. The issue is reproducible
with HEAD commit a13c140cc289c0b7b3770bce5b3ad42ab35074aa.

The reproducer mounts a crafted F2FS filesystem image and invokes
open_by_handle_at() with a malformed file handle. This reaches
f2fs_nfs_get_inode() and f2fs_iget(), where the inode and its extent
cache are initialized and validated.

The archived target crash report shows a use-after-free read in
sanity_check_inode(), called from do_read_inode() and f2fs_iget(). The
affected object belongs to the f2fs_extent_tree cache. It was allocated
by f2fs_init_extent_tree() and freed by f2fs_destroy_extent_tree()
during inode eviction.

This looks like an extent-tree lifetime issue in an f2fs_iget() error
path. A stale extent_tree pointer may remain accessible after a failed
inode lookup causes the inode and its extent tree to be evicted.

This appears related to the following previously reported issue, which
was originally observed on Linux 5.15:

https://syzkaller.appspot.com/bug?extid=0b1e85354f790743db08

Reproducer:

syz reproducer: https://pastebin.com/raw/LGCbYiqL

console output: https://pastebin.com/raw/FzSecFbT
kernel config: https://pastebin.com/raw/PZsF562V

Kernel:

HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full)
tested tag: v7.2-rc3

Let me know if you need more details or testing.

Best regards