================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:953 Read of size 4 at addr ffff8881206d045c by task kworker/u4:0/8 CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 6.1.25-syzkaller-00099-g35fe0d393f80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:395 kasan_report+0x13c/0x170 mm/kasan/report.c:495 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 ext4_ext_binsearch fs/ext4/extents.c:837 [inline] ext4_find_extent+0xbab/0xdb0 fs/ext4/extents.c:953 ext4_ext_map_blocks+0x255/0x71e0 fs/ext4/extents.c:4103 ext4_map_blocks+0xa42/0x1ce0 fs/ext4/inode.c:651 mpage_map_one_extent fs/ext4/inode.c:2421 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2474 [inline] ext4_writepages+0x178c/0x3fb0 fs/ext4/inode.c:2842 do_writepages+0x385/0x620 mm/page-writeback.c:2472 __writeback_single_inode+0xdc/0xb80 fs/fs-writeback.c:1590 writeback_sb_inodes+0xb33/0x18f0 fs/fs-writeback.c:1881 wb_writeback+0x3b9/0x9f0 fs/fs-writeback.c:2055 wb_do_writeback fs/fs-writeback.c:2198 [inline] wb_workfn+0x399/0x1030 fs/fs-writeback.c:2238 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296 worker_thread+0xa60/0x1260 kernel/workqueue.c:2443 kthread+0x26d/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 The buggy address belongs to the physical page: page:ffffea000481b400 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1206d0 flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea000481e388 ffffea000481b3c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x141cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_WRITE), pid 305, tgid 305 (syz-executor221), ts 20703607314, free_ts 20788875962 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x213/0x220 mm/page_alloc.c:2574 prep_new_page mm/page_alloc.c:2581 [inline] get_page_from_freelist+0x2527/0x2600 mm/page_alloc.c:4374 __alloc_pages+0x3a1/0x780 mm/page_alloc.c:5651 __folio_alloc+0x15/0x40 mm/page_alloc.c:5683 __folio_alloc_node include/linux/gfp.h:245 [inline] folio_alloc include/linux/gfp.h:274 [inline] filemap_alloc_folio include/linux/pagemap.h:474 [inline] __filemap_get_folio+0x6c0/0x970 mm/filemap.c:1976 pagecache_get_page+0x2f/0x110 mm/folio-compat.c:110 grab_cache_page_write_begin+0x42/0x60 mm/folio-compat.c:122 ext4_write_begin+0x257/0xfb0 fs/ext4/inode.c:1195 ext4_da_write_begin+0x2ff/0x920 fs/ext4/inode.c:2987 generic_perform_write+0x2f9/0x5c0 mm/filemap.c:3765 ext4_buffered_write_iter+0x360/0x640 fs/ext4/file.c:285 ext4_file_write_iter+0x194/0x1cf0 do_iter_write+0x6e6/0xc50 fs/read_write.c:861 vfs_iter_write+0x7c/0xa0 fs/read_write.c:902 iter_file_splice_write+0x7f8/0xf90 fs/splice.c:686 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0xff/0x130 fs/splice.c:931 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1486 [inline] free_pcp_prepare mm/page_alloc.c:1560 [inline] free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3473 free_unref_page_list+0xf6/0x6c0 mm/page_alloc.c:3615 release_pages+0xf7f/0xfe0 mm/swap.c:1055 __pagevec_release+0x84/0x100 mm/swap.c:1075 pagevec_release include/linux/pagevec.h:71 [inline] folio_batch_release include/linux/pagevec.h:135 [inline] truncate_inode_pages_range+0x465/0xf10 mm/truncate.c:375 truncate_inode_pages mm/truncate.c:457 [inline] truncate_inode_pages_final+0x83/0x90 mm/truncate.c:496 ext4_evict_inode+0x657/0x1510 fs/ext4/inode.c:210 evict+0x2a3/0x630 fs/inode.c:664 dispose_list fs/inode.c:697 [inline] evict_inodes+0x5d1/0x650 fs/inode.c:747 generic_shutdown_super+0x97/0x370 fs/super.c:482 kill_block_super+0x7e/0xe0 fs/super.c:1452 deactivate_locked_super+0xa5/0x110 fs/super.c:334 deactivate_super+0xbe/0xf0 fs/super.c:365 cleanup_mnt+0x485/0x510 fs/namespace.c:1186 __cleanup_mnt+0x19/0x20 fs/namespace.c:1193 task_work_run+0x24d/0x2e0 kernel/task_work.c:179 Memory state around the buggy address: ffff8881206d0300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881206d0380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881206d0400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881206d0480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881206d0500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: comm kworker/u4:0: lblock 0 mapped to illegal pblock 0 (length 6) EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 6 with error 117 EXT4-fs (loop0): This should not happen!! Data will be lost EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0 EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0 EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Corrupt filesystem EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm kworker/u4:0: mark_inode_dirty error EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 EXT4-fs (loop0): This should not happen!! Data will be lost EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0 EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0 EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Corrupt filesystem EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm kworker/u4:0: mark_inode_dirty error EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 EXT4-fs (loop0): This should not happen!! Data will be lost EXT4-fs error (device loop0): __ext4_get_inode_loc:4492: comm kworker/u4:0: Invalid inode table block 790638693 in block_group 0