================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504 Read of size 1 at addr ffff8881dcecd6e3 by task syz-executor424/362 CPU: 0 PID: 362 Comm: syz-executor424 Not tainted 5.4.268-syzkaller-00012-gd0d34dcb02cc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1698 __ext4_find_entry+0x2a9/0x1b50 fs/ext4/namei.c:1577 ext4_lookup_entry fs/ext4/namei.c:1730 [inline] ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1798 lookup_open fs/namei.c:3308 [inline] do_last fs/namei.c:3421 [inline] path_openat+0x159a/0x3480 fs/namei.c:3634 do_filp_open+0x20b/0x450 fs/namei.c:3664 do_sys_open+0x39c/0x810 fs/open.c:1113 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 The buggy address belongs to the page: page:ffffea000773b340 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 flags: 0x8000000000000000() raw: 8000000000000000 ffffea000773b388 ffffea000773b308 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffff8881dcecd580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881dcecd600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881dcecd680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881dcecd700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881dcecd780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs error (device loop0): ext4_find_dest_de:2063: inode #12: block 5: comm syz-executor424: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=1375716473, rec_len=40042, size=56 fake=0