[BUG] general protection fault in __lookup_mnt with crafted ext4 image and bind mount

[ZW Tang]

Hi,

I am reporting a general protection fault in __lookup_mnt() triggered
by a syzkaller C reproducer on Linux 7.1.0-rc5.

The reproducer mounts a crafted ext4 image on a loop device, enters
the mounted directory, creates and writes to a file, performs a bind
mount involving the loop device, and then continues with file I/O
operations. The crash happens in the VFS mount lookup path, followed
by additional crashes in timer/ext4 writeback paths, which look like
secondary effects after the first memory corruption.

Reproducer:
C reproducer:https://pastebin.com/0bseRsBn
console output: https://pastebin.com/zpfwbgYA
kernel config: https://pastebin.com/raw/fUwrL2uz

Kernel:
HEAD commit: e7ae89a0c97c
git tree: torvalds/linux
kernel version: 7.1.0-rc5 #2 PREEMPT(lazy) (QEMU Ubuntu 24.10)

Crash:
EXT4-fs (loop3): mounted filesystem
00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode:
none.
operation not supported error, dev loop0, sector 0 op
0x9:(WRITE_ZEROES) flags 0x10000800 phys_seg 0 prio class 2
Oops: general protection fault, kernel NULL pointer dereference 0x1:
0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 2102 Comm: syz-executor Not tainted 7.1.0-rc5 #2
PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010+0x0/0x10

A later crash shows memory corruption / wild-memory-access while
handling ext4 writeback and inline-data/xattr destruction:

Oops: general protection fault, probably for non-canonical address
0xed0157dfdffff115: 0000 [#2] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x680adefeffff88a8-0x680adefeffff88af]
RIP: 0010+0xb6/0x440

Call Trace:
<TASK>
ext4_xattr_set_entry+0x12c2/0x17e0
ext4_xattr_ibody_set+0x380/0x570
ext4_destroy_inline_data_nolock+0x253/0x550
ext4_destroy_inline_data+0x78/0xd0
ext4_do_writepages+0x579/0x3580
ext4_writepages+0x2d7/0x590
do_writepages+0x1f6/0x500
filemap_writeback+0x1de/0x260
ext4_alloc_da_blocks+0x176/0x1d0
ext4_release_file+0x15b/0x320
__fput+0x3e9/0xb50
task_work_run+0x161/0x240
exit_to_user_mode_loop+0xf6/0x540
do_syscall_64+0x3be/0x5b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>

The first reported crash title is general protection fault in
__lookup_mnt, so I am reporting this primarily as a VFS/mount
namespace issue. However, the reproducer uses a crafted ext4 image and
the later crash reaches ext4_xattr_set_entry() through inline-data
destruction and writeback, so the issue may involve an interaction
between VFS mount lookup/lifetime handling and ext4 error/writeback
paths for malformed images.

Thanks.