KASAN: use-after-free Read in ext4_xattr_set

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry (3)	19	C		error	1	1387d	1872d	0/1	upstream: reported C repro on 2020/10/28 15:08
android-5-15	KASAN: out-of-bounds Read in ext4_xattr_set_entry (2) origin:lts	19	C			34	8h16m	164d	0/2	upstream: reported C repro on 2025/07/03 01:48
android-414	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	19				6	2235d	2291d	0/1	auto-closed as invalid on 2020/02/28 13:35
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	19				1	2092d	2092d	0/1	auto-closed as invalid on 2020/07/21 03:20
linux-4.19	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	19	C		done	7	1553d	2011d	1/1	fixed on 2021/10/13 07:23
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry ext4	19				1	2696d	2696d	0/29	closed as invalid on 2018/07/29 11:55
upstream	KASAN: out-of-bounds Read in ext4_xattr_set_entry ext4	24	C	error		5074	1h50m	448d	0/29	upstream: reported C repro on 2024/09/22 00:16
android-414	KASAN: use-after-free Read in ext4_xattr_set_entry	19				4	2543d	2436d	0/1	auto-closed as invalid on 2019/06/26 01:15
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (5) ext4	19				2	1237d	1295d	0/29	auto-obsoleted due to no activity on 2022/11/22 17:19
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (3) ext4	19				4	1987d	2106d	0/29	auto-closed as invalid on 2020/11/02 08:32
linux-4.19	KASAN: use-after-free Read in ext4_xattr_set_entry	19	syz		done	10	2115d	2363d	1/1	fixed on 2020/03/30 09:03
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (4) ext4	24	C	error	done	21	1391d	1778d	20/29	fixed on 2022/03/28 10:17
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (2) ext4	19	C	done		19	2189d	2598d	15/29	fixed on 2020/02/14 01:19
linux-6.1	KASAN: out-of-bounds Read in ext4_xattr_set_entry missing-backport origin:lts-only	19	C		inconclusive	609	1d14h	939d	0/3	upstream: reported C repro on 2023/05/19 08:42
android-5-10	KASAN: out-of-bounds Read in ext4_xattr_set_entry	19	C		inconclusive	42	7d07h	816d	0/2	upstream: reported C repro on 2023/09/20 02:40
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry	19	C		done	9	2143d	2235d	1/1	fixed on 2020/03/01 21:06

================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x1bbe/0x3b60 fs/ext4/xattr.c:1734 Read of size 4 at addr ffff8881a68e5ffe by task syz-fuzzer/324 CPU: 0 PID: 324 Comm: syz-fuzzer Not tainted 5.4.56-syzkaller-00005-g8555f0d9d303 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x14a/0x1ce lib/dump_stack.c:118 print_address_description+0x93/0x620 mm/kasan/report.c:374 __kasan_report+0x16d/0x1e0 mm/kasan/report.c:506 kasan_report+0x36/0x60 mm/kasan/common.c:634 check_memory_region_inline mm/kasan/generic.c:181 [inline] check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:191 memmove+0x25/0x50 mm/kasan/common.c:113 ext4_xattr_set_entry+0x1bbe/0x3b60 fs/ext4/xattr.c:1734 ext4_xattr_ibody_set fs/ext4/xattr.c:2239 [inline] ext4_xattr_set_handle+0xdc3/0x1ed0 fs/ext4/xattr.c:2395 ext4_initxattrs+0xa2/0x100 fs/ext4/xattr_security.c:43 security_inode_init_security+0x27c/0x3c0 security/security.c:996 __ext4_new_inode+0x46ea/0x5cc0 fs/ext4/ialloc.c:1163 ext4_mkdir+0x41e/0x1530 fs/ext4/namei.c:2879 vfs_mkdir2+0x448/0x620 fs/namei.c:3934 do_mkdirat+0x1e7/0x310 fs/namei.c:3963 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4b3cdb Code: ff e9 69 ff ff ff cc cc cc cc cc cc cc cc cc e8 bb a1 f8 ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 RSP: 002b:000000c018d593e0 EFLAGS: 00000206 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 000000c00002e800 RCX: 00000000004b3cdb RDX: 00000000000001c0 RSI: 000000c010fea0e0 RDI: ffffffffffffff9c RBP: 000000c018d59438 R08: 0000000000872c01 R09: 0000000000000001 R10: 000000c010fea0e0 R11: 0000000000000206 R12: ffffffffffffffff R13: 0000000000000008 R14: 0000000000000007 R15: 0000000000000100 The buggy address belongs to the page: page:ffffea00069a3940 refcount:2 mapcount:0 mapping:ffff8881da449a60 index:0x3f9 def_blk_aops flags: 0x8000000000002032(referenced|lru|active|private) raw: 8000000000002032 ffffea000734cf08 ffffea00069a2d88 ffff8881da449a60 raw: 00000000000003f9 ffff8881d3dd1f18 00000002ffffffff ffff8881da940000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8881da940000 Memory state around the buggy address: ffff8881a68e5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881a68e5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881a68e6000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881a68e6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881a68e6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Manager
2020/08/06 21:44	https://android.googlesource.com/kernel/common android-5.4	8555f0d9d303	4ca1c0ea	.config	console log	report	ci2-android-5-4-kasan
2020/07/03 07:11	https://android.googlesource.com/kernel/common android-5.4	93dc81bbbde5	f30c14bf	.config	console log	report	ci2-android-5-4-kasan
2020/06/04 10:16	https://android.googlesource.com/kernel/common android-5.4	788fe852d3be	b0d1c0d5	.config	console log	report	ci2-android-5-4-kasan
2020/04/10 07:32	https://android.googlesource.com/kernel/common android-5.4	4be750f34531	a8c6a3f8	.config	console log	report	ci2-android-5-4-kasan
2020/02/11 02:27	https://android.googlesource.com/kernel/common android-5.4	2d40d7b36ae9	d9e55b05	.config	console log	report	ci2-android-5-4-kasan
2020/02/07 21:51	https://android.googlesource.com/kernel/common android-5.4	9204f620c2a9	06150bf1	.config	console log	report	ci2-android-5-4-kasan

Crashes (6):

Assets (help?)