syzbot


WARNING in ext4_xattr_block_set

Status: fixed on 2025/11/14 12:22
Reported-by: syzbot+b1aa832f28aa881188a3@syzkaller.appspotmail.com
Fix commit: 720a66fdaa6c ext4: validate ea_ino and size in check_xattrs
First crash: 78d, last: 55d
Fix bisection: fixed by (bisect log) :
commit 720a66fdaa6ce3d68e5ad4a469fd428a8d7ce571
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date: Tue Sep 23 13:32:45 2025 +0000

  ext4: validate ea_ino and size in check_xattrs

  
Bug presence (1)
Date Name Commit Repro Result
2025/11/07 upstream (ToT) da32d155f4a8 C Didn't crash
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in ext4_xattr_block_set (3) ext4 -1 C error 73 47d 78d 29/29 fixed on 2025/10/29 21:02
upstream WARNING in ext4_xattr_block_set ext4 -1 C error 57 1019d 1125d 22/29 fixed on 2023/02/24 13:50
upstream WARNING in ext4_xattr_block_set (2) ext4 -1 C error 32 937d 1001d 22/29 fixed on 2023/07/01 16:05
linux-6.1 WARNING in ext4_xattr_block_set origin:upstream missing-backport -1 C 47 28d 77d 0/3 upstream: reported C repro on 2025/09/18 02:40

Sample crash report:
loop2: detected capacity change from 0 to 512
EXT4-fs (loop2): orphan cleanup on readonly fs
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7826 at fs/ext4/xattr.c:1923 ext4_xattr_block_set+0x2a7a/0x32a0 fs/ext4/xattr.c:1923
Modules linked in:
CPU: 0 PID: 7826 Comm: syz.2.749 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:ext4_xattr_block_set+0x2a7a/0x32a0 fs/ext4/xattr.c:1923
Code: ff 48 8b 5c 24 18 48 8d 7b 28 be 08 00 00 00 e8 5c c4 9a ff f0 80 63 28 fd eb 1b e8 c0 6a 43 ff e9 2f f1 ff ff e8 b6 6a 43 ff <0f> 0b e9 72 d7 ff ff e8 aa 6a 43 ff 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900038b72a0 EFLAGS: 00010283
RAX: ffffffff8242201a RBX: ffffc900038b75a8 RCX: 0000000000080000
RDX: ffffc9000d7bc000 RSI: 00000000000126a3 RDI: 00000000000126a4
RBP: ffffc900038b7490 R08: 00000000ffffffc3 R09: 00000000ffffffc3
R10: ffff88807e86a400 R11: ffff88807e86a020 R12: 0000000000000000
R13: 1ffff92000716eb6 R14: 1ffff92000716eb5 R15: ffffc900038b75b0
FS:  00007ff84ea0f6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffd88f0000 CR3: 000000001a7c1000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 ext4_xattr_move_to_block fs/ext4/xattr.c:2674 [inline]
 ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
 ext4_expand_extra_isize_ea+0x10ea/0x19e0 fs/ext4/xattr.c:2841
 __ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
 __ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
 ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
 evict+0x486/0x870 fs/inode.c:705
 ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
 __ext4_fill_super fs/ext4/super.c:5608 [inline]
 ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
 get_tree_bdev+0x3e4/0x510 fs/super.c:1591
 vfs_get_tree+0x8c/0x280 fs/super.c:1764
 do_new_mount+0x24b/0xa40 fs/namespace.c:3377
 do_mount fs/namespace.c:3717 [inline]
 __do_sys_mount fs/namespace.c:3926 [inline]
 __se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff84db9066a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff84ea0ee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ff84ea0eef0 RCX: 00007ff84db9066a
RDX: 0000200000000180 RSI: 0000200000000000 RDI: 00007ff84ea0eeb0
RBP: 0000200000000180 R08: 00007ff84ea0eef0 R09: 000000000080078b
R10: 000000000080078b R11: 0000000000000246 R12: 0000200000000000
R13: 00007ff84ea0eeb0 R14: 000000000000047e R15: 0000200000000680
 </TASK>

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/09 15:43 linux-6.6.y e617101e5626 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/09 15:40 linux-6.6.y e617101e5626 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/09 15:39 linux-6.6.y e617101e5626 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/06 09:24 linux-6.6.y f34f16e5c632 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/06 09:23 linux-6.6.y f34f16e5c632 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/03 16:00 linux-6.6.y f34f16e5c632 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/03 15:58 linux-6.6.y f34f16e5c632 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/02 09:05 linux-6.6.y 147338df3487 267f56c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/02 09:05 linux-6.6.y 147338df3487 267f56c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/01 09:17 linux-6.6.y 147338df3487 65a0eece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/10/01 09:17 linux-6.6.y 147338df3487 65a0eece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/23 07:33 linux-6.6.y af1544b5d072 0ac7291c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/23 07:32 linux-6.6.y af1544b5d072 0ac7291c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/20 09:24 linux-6.6.y af1544b5d072 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/20 09:24 linux-6.6.y af1544b5d072 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/20 07:36 linux-6.6.y af1544b5d072 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/20 07:36 linux-6.6.y af1544b5d072 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/18 04:51 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/18 04:50 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/16 08:03 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/16 07:44 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/16 07:26 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
2025/09/16 07:25 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in ext4_xattr_block_set
* Struck through repros no longer work on HEAD.