syzbot

 sign-in | mailing list | source | docs
🐞 Open [73]
🐞 Fixed [22]
🐞 Invalid [336]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in ext4_search_dir

Status: auto-obsoleted due to no activity on 2025/02/18 14:16
Reported-by: syzbot+a133fb1e9618ba1cc23d@syzkaller.appspotmail.com
First crash: 314d, last: 145d
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 KASAN: slab-out-of-bounds Read in ext4_search_dir origin:upstream missing-backport C done 6 105d 464d 0/2 auto-obsoleted due to no activity on 2025/02/18 18:03
linux-5.15 KASAN: use-after-free Read in ext4_search_dir C done 5 140d 618d 3/3 fixed on 2024/11/08 17:20
upstream KASAN: use-after-free Read in ext4_search_dir prio:low ext4 C error done 20 413d 654d 25/28 fixed on 2024/02/21 18:23
android-6-1 KASAN: use-after-free Read in ext4_search_dir missing-backport origin:upstream C error 29 9d21h 490d 0/2 upstream: reported C repro on 2023/10/22 16:55
android-5-10 KASAN: slab-out-of-bounds Read in ext4_search_dir C error 21 100d 464d 0/2 upstream: reported C repro on 2023/11/17 09:38
linux-6.1 KASAN: use-after-free Read in ext4_search_dir origin:upstream missing-backport C done 1 154d 615d 0/3 upstream: reported C repro on 2023/06/18 19:29
upstream KASAN: use-after-free Read in ext4_search_dir (2) ext4 C 5 164d 188d 28/28 fixed on 2024/10/22 11:57
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/02/18 14:02 13m retest repro android12-5.4 OK log
2024/12/10 10:03 12m retest repro android12-5.4 error
2024/10/01 06:40 6m retest repro android12-5.4 report log
2024/07/23 05:45 5m retest repro android12-5.4 report log
2024/05/14 05:06 9m retest repro android12-5.4 report log

Sample crash report:
EXT4-fs error (device loop3): ext4_find_dest_de:2063: inode #12: block 7: comm syz-executor.3: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=1660078826, rec_len=60141, size=56 fake=0
EXT4-fs error (device loop3): ext4_xattr_block_get:544: inode #19: comm syz-executor.3: corrupted xattr block 128
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504
Read of size 1 at addr ffff8881ee15900a by task syz-executor.3/397

CPU: 0 PID: 397 Comm: syz-executor.3 Not tainted 5.4.268-syzkaller-00001-g8322246edffa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504
 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1698
 __ext4_find_entry+0x2a9/0x1b50 fs/ext4/namei.c:1577
 ext4_lookup_entry fs/ext4/namei.c:1730 [inline]
 ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1798
 lookup_open fs/namei.c:3308 [inline]
 do_last fs/namei.c:3421 [inline]
 path_openat+0x159a/0x3480 fs/namei.c:3634
 do_filp_open+0x20b/0x450 fs/namei.c:3664

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/30 04:03 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/30 04:03 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/30 04:02 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/20 21:21 android12-5.4 51cf29fc2bfc c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/15 16:54 android12-5.4 51cf29fc2bfc 94b087b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/30 05:05 android12-5.4 2d5d8240a7cb f10afd69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/30 05:05 android12-5.4 2d5d8240a7cb f10afd69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/28 00:58 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:03 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:02 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:01 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:01 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/18 19:42 android12-5.4 2d5d8240a7cb af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/15 06:45 android12-5.4 d0d34dcb02cc c8349e48 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
* Struck through repros no longer work on HEAD.