================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x25d4/0x2e40 fs/ext4/xattr.c:1605 Read of size 4 at addr ffff8881817f0083 by task syz-executor5/13142 CPU: 1 PID: 13142 Comm: syz-executor5 Not tainted 4.14.87+ #21 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x11b lib/dump_stack.c:53 print_address_description+0x60/0x22b mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409 ext4_xattr_set_entry+0x25d4/0x2e40 fs/ext4/xattr.c:1605 ext4_xattr_ibody_set+0x73/0x280 fs/ext4/xattr.c:2245 ext4_xattr_set_handle+0x6a6/0xdc0 fs/ext4/xattr.c:2401 ext4_initxattrs+0xb8/0x110 fs/ext4/xattr_security.c:43 security_inode_init_security+0x228/0x310 security/security.c:493 __ext4_new_inode+0x3473/0x48e0 fs/ext4/ialloc.c:1166 ext4_mkdir+0x234/0xb40 fs/ext4/namei.c:2625 vfs_mkdir2+0x3cb/0x640 fs/namei.c:3883 SYSC_mkdirat fs/namei.c:3912 [inline] SyS_mkdirat+0x126/0x220 fs/namei.c:3896 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x457679 RSP: 002b:00007f96a8cfec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000457679 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000380 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f96a8cff6d4 R13: 00000000004bd03f R14: 00000000004d4fa8 R15: 00000000ffffffff The buggy address belongs to the page: page:ffffea000605fc00 count:0 mapcount:-127 mapping: (null) index:0x1 flags: 0x4000000000000000() raw: 4000000000000000 0000000000000000 0000000000000001 00000000ffffff80 raw: ffffea0006074420 ffffea0006071420 0000000000000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881817eff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881817f0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881817f0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881817f0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881817f0180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================