KASAN: use-after-free Read in ext4_xattr_list_entries (2)

Status: upstream: reported on 2026/06/09 21:03
Subsystems: ext4
Labels: actionable prio:high
[Documentation on labels]
Reported-by: syzbot+3fbf2337de43f5581aec@syzkaller.appspotmail.com
First crash: 149d, last: 17d
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
ef33d515 repro-c Reproduced: ✅ ❓ KASAN: use-after-free Read in ext4_xattr_list_entries (2) 2026/08/07 13:51 2026/08/07 19:11 2026/08/07 21:11 e4ef95d6
3d7b2494 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ ❓ KASAN: use-after-free Read in ext4_xattr_list_entries (2) 2026/06/09 20:18 2026/06/09 20:18 2026/06/09 21:13 c36c07f6
b34af3c3 moderation Actionable: ✅ ❓ KASAN: use-after-free Read in ext4_xattr_list_entries (2) 2026/06/09 20:16 2026/06/09 20:16 2026/06/09 21:02 c36c07f6
662933c2 assessment-security 💥 KASAN: use-after-free Read in ext4_xattr_list_entries (2) 2026/06/04 00:00 2026/06/04 00:00 2026/06/04 00:00 62fe1528
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [ext4?] KASAN: use-after-free Read in ext4_xattr_list_entries (2) 0 (1) 2026/06/09 21:03
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ext4_xattr_list_entries ext4 19 4 293d 385d 0/29 auto-obsoleted due to no activity on 2026/04/10 00:23
linux-6.1 KASAN: use-after-free Read in ext4_xattr_list_entries origin:upstream 19 syz, C error 15 260d 285d 0/3 upstream: reported C repro on 2026/01/18 01:47
android-6-1 KASAN: use-after-free Read in ext4_xattr_list_entries 19 syz, C inconclusive 6 9d20h 107d 0/2 upstream: reported C repro on 2026/07/14 23:26

Sample crash report:
loop0: detected capacity change from 0 to 2048
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
loop0: detected capacity change from 2048 to 64
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_list_entries+0x302/0x3d0 fs/ext4/xattr.c:735
Read of size 4 at addr ffff8880537c2014 by task syz.0.0/5314

CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 ext4_xattr_list_entries+0x302/0x3d0 fs/ext4/xattr.c:735
 ext4_xattr_ibody_list fs/ext4/xattr.c:804 [inline]
 ext4_listxattr+0x229/0x680 fs/ext4/xattr.c:829
 vfs_listxattr fs/xattr.c:516 [inline]
 listxattr+0x19d/0x380 fs/xattr.c:941
 filename_listxattr fs/xattr.c:974 [inline]
 path_listxattrat+0x1a3/0x3f0 fs/xattr.c:1001
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f100e39e2d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f100f205fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
RAX: ffffffffffffffda RBX: 00007f100e625fa0 RCX: 00007f100e39e2d9
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000200000000740
RBP: 00007f100e435888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f100e626038 R14: 00007f100e625fa0 R15: 00007ffeb5877a18
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x537c2
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 ffffea00014df0c8 ffff88801fa418b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5314, tgid 5313 (syz.0.0), ts 87628462215
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2505
 shmem_alloc_folio mm/shmem.c:1936 [inline]
 shmem_alloc_and_add_folio+0x43e/0xf60 mm/shmem.c:1978
 shmem_get_folio_gfp+0x5da/0x16d0 mm/shmem.c:2531
 shmem_get_folio mm/shmem.c:2637 [inline]
 shmem_write_begin+0x16c/0x330 mm/shmem.c:3268
 generic_perform_write+0x2d5/0x8f0 mm/filemap.c:4374
 shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3443
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x612/0xba0 fs/read_write.c:687
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5314 tgid 5313 ts 87629076814 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_unref_folios+0xdc2/0x14e0 mm/page_alloc.c:3022
 folios_put_refs+0x9e9/0xb30 mm/folio.c:1036
 folio_batch_release include/linux/folio_batch.h:101 [inline]
 shmem_undo_range+0x4e6/0x15d0 mm/shmem.c:1161
 shmem_truncate_range mm/shmem.c:1289 [inline]
 shmem_evict_inode+0x247/0xae0 mm/shmem.c:1420
 evict+0x624/0xb50 fs/inode.c:822
 dentry_kill+0x1b9/0x880 fs/dcache.c:826
 finish_dput+0x1a/0x260 fs/dcache.c:1001
 __fput+0x660/0xa50 fs/file_table.c:520
 fput_close_sync+0x11f/0x240 fs/file_table.c:618
 __do_sys_close fs/open.c:1560 [inline]
 __se_sys_close fs/open.c:1545 [inline]
 __x64_sys_close+0x7e/0x110 fs/open.c:1545
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880537c1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880537c1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880537c2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                         ^
 ffff8880537c2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880537c2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/13 09:50 upstream 24a19b953e2a 5a1eeac4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/08/20 16:26 upstream a4ff2be345d0 1e72964b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/08/04 04:43 upstream 848acc8ffe1b 9451e17e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/07/24 02:44 upstream d326f83e819c 544adce9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/07/05 15:08 upstream 7404ce516372 fcece630 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/06/07 13:40 upstream 8e65320d91cd cc095639 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/06/02 20:37 upstream 6f3ed7fec72f 62fe1528 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ext4_xattr_list_entries
2026/07/25 05:36 upstream e2a936998ab2 492bab15 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in ext4_xattr_list_entries
* Struck through repros no longer work on HEAD.