================================================================== BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x42e/0x4a0 fs/ext4/namei.c:3704 Read of size 4 at addr ffff88811885d000 by task syz-executor.5/784 CPU: 1 PID: 784 Comm: syz-executor.5 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3c0 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 ext4_rename_dir_prepare+0x42e/0x4a0 fs/ext4/namei.c:3704 ext4_cross_rename fs/ext4/namei.c:4212 [inline] ext4_rename2+0x1f37/0x45a0 fs/ext4/namei.c:4296 vfs_rename+0x95e/0xde0 fs/namei.c:4389 do_renameat2+0x83e/0x1190 fs/namei.c:4536 __do_sys_renameat2 fs/namei.c:4571 [inline] __se_sys_renameat2 fs/namei.c:4568 [inline] __x64_sys_renameat2+0xbf/0xd0 fs/namei.c:4568 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 RIP: 0033:0x7f2b079de0f9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2afe32e168 EFLAGS: 00000246 ORIG_RAX: 000000000000013c RAX: ffffffffffffffda RBX: 00007f2b07afe1f0 RCX: 00007f2b079de0f9 RDX: 0000000000000004 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 00007f2b07a39ae9 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd3adea55f R14: 00007f2afe32e300 R15: 0000000000022000 The buggy address belongs to the page: page:ffffea0004621740 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11885d flags: 0x8000000000000000() raw: 8000000000000000 ffffea0004639d48 ffffea0004388b88 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102800(GFP_NOWAIT|__GFP_NOWARN|__GFP_HARDWALL), pid 762, ts 977400772322, free_ts 977403188017 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2386 [inline] prep_new_page mm/page_alloc.c:2392 [inline] get_page_from_freelist+0x755/0x810 mm/page_alloc.c:4073 __alloc_pages_nodemask+0x3b6/0x890 mm/page_alloc.c:5160 __alloc_pages include/linux/gfp.h:529 [inline] __alloc_pages_node include/linux/gfp.h:542 [inline] alloc_pages_node include/linux/gfp.h:556 [inline] alloc_pages include/linux/gfp.h:575 [inline] __get_free_pages+0xe/0x30 mm/page_alloc.c:5203 tlb_next_batch mm/mmu_gather.c:29 [inline] __tlb_remove_page_size+0x175/0x300 mm/mmu_gather.c:83 __tlb_remove_page include/asm-generic/tlb.h:442 [inline] zap_pte_range mm/memory.c:1329 [inline] zap_pmd_range mm/memory.c:1444 [inline] zap_pud_range mm/memory.c:1473 [inline] zap_p4d_range mm/memory.c:1494 [inline] unmap_page_range+0x1280/0x2070 mm/memory.c:1516 unmap_single_vma mm/memory.c:1562 [inline] unmap_vmas+0x3d4/0x5b0 mm/memory.c:1594 exit_mmap+0x2f9/0x5c0 mm/mmap.c:3341 __mmput+0x95/0x2c0 kernel/fork.c:1133 mmput+0x4b/0x50 kernel/fork.c:1154 exit_mm+0x5cd/0x790 kernel/exit.c:489 do_exit+0x5f2/0x2340 kernel/exit.c:800 do_group_exit+0x13a/0x300 kernel/exit.c:910 get_signal+0xe17/0x1440 kernel/signal.c:2780 arch_do_signal+0x8e/0x650 arch/x86/kernel/signal.c:805 exit_to_user_mode_loop+0xa3/0xe0 kernel/entry/common.c:161 exit_to_user_mode_prepare kernel/entry/common.c:191 [inline] syscall_exit_to_user_mode+0x77/0xa0 kernel/entry/common.c:266 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1332 [inline] free_pcp_prepare+0x18c/0x1c0 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3293 [inline] free_unref_page mm/page_alloc.c:3347 [inline] free_the_page mm/page_alloc.c:5219 [inline] __free_pages+0x390/0x570 mm/page_alloc.c:5228 free_pages+0x7c/0x90 mm/page_alloc.c:5239 tlb_batch_list_free mm/mmu_gather.c:61 [inline] tlb_finish_mmu+0x123/0x1f0 mm/mmu_gather.c:329 exit_mmap+0x319/0x5c0 mm/mmap.c:3343 __mmput+0x95/0x2c0 kernel/fork.c:1133 mmput+0x4b/0x50 kernel/fork.c:1154 exit_mm+0x5cd/0x790 kernel/exit.c:489 do_exit+0x5f2/0x2340 kernel/exit.c:800 do_group_exit+0x13a/0x300 kernel/exit.c:910 get_signal+0xe17/0x1440 kernel/signal.c:2780 arch_do_signal+0x8e/0x650 arch/x86/kernel/signal.c:805 exit_to_user_mode_loop+0xa3/0xe0 kernel/entry/common.c:161 exit_to_user_mode_prepare kernel/entry/common.c:191 [inline] syscall_exit_to_user_mode+0x77/0xa0 kernel/entry/common.c:266 do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Memory state around the buggy address: ffff88811885cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88811885cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88811885d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811885d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811885d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================