==================================================================
BUG: KASAN: slab-use-after-free in ext4_ext_binsearch fs/ext4/extents.c:840 [inline]
BUG: KASAN: slab-use-after-free in ext4_find_extent+0x94c/0xb0c fs/ext4/extents.c:955
Read of size 4 at addr ffff0000c6a56a3c by task kworker/u8:7/1976
CPU: 0 UID: 0 PID: 1976 Comm: kworker/u8:7 Not tainted 6.14.0-rc6-syzkaller-ga5618886fdab #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: writeback wb_workfn (flush-7:4)
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x198/0x550 mm/kasan/report.c:521
kasan_report+0xd8/0x138 mm/kasan/report.c:634
__asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
ext4_ext_binsearch fs/ext4/extents.c:840 [inline]
ext4_find_extent+0x94c/0xb0c fs/ext4/extents.c:955
ext4_ext_map_blocks+0x2b0/0x6600 fs/ext4/extents.c:4205
ext4_map_create_blocks fs/ext4/inode.c:516 [inline]
ext4_map_blocks+0x710/0x15d0 fs/ext4/inode.c:702
mpage_map_one_extent fs/ext4/inode.c:2219 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2272 [inline]
ext4_do_writepages+0x195c/0x318c fs/ext4/inode.c:2735
ext4_writepages+0x198/0x308 fs/ext4/inode.c:2824
do_writepages+0x304/0x7d0 mm/page-writeback.c:2687
__writeback_single_inode+0x15c/0x15a4 fs/fs-writeback.c:1680
writeback_sb_inodes+0x650/0x1088 fs/fs-writeback.c:1976
wb_writeback+0x3e0/0xe9c fs/fs-writeback.c:2156
wb_do_writeback fs/fs-writeback.c:2303 [inline]
wb_workfn+0x38c/0x1048 fs/fs-writeback.c:2343
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Allocated by task 1976:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4115 [inline]
slab_alloc_node mm/slub.c:4164 [inline]
kmem_cache_alloc_node_noprof+0x264/0x420 mm/slub.c:4216
__alloc_skb+0x1e0/0x420 net/core/skbuff.c:596
alloc_skb include/linux/skbuff.h:1331 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
nsim_dev_trap_report_work+0x1f8/0x9b4 drivers/net/netdevsim/dev.c:851
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Freed by task 1976:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x64/0x8c mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4609 [inline]
kmem_cache_free+0x198/0x554 mm/slub.c:4711
kfree_skbmem+0x15c/0x1ec
__kfree_skb net/core/skbuff.c:1115 [inline]
consume_skb+0xb8/0x130 net/core/skbuff.c:1346
nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline]
nsim_dev_trap_report_work+0x680/0x9b4 drivers/net/netdevsim/dev.c:851
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
The buggy address belongs to the object at ffff0000c6a56a00
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 60 bytes inside of
freed 240-byte region [ffff0000c6a56a00, ffff0000c6a56af0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106a56
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000000 ffff0000c1be18c0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c6a56900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c6a56980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff0000c6a56a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c6a56a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff0000c6a56b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:3203!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 UID: 0 PID: 1976 Comm: kworker/u8:7 Tainted: G B 6.14.0-rc6-syzkaller-ga5618886fdab #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: writeback wb_workfn (flush-7:4)
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ext4_split_extent_at+0xfb8/0x1008 fs/ext4/extents.c:3203
lr : ext4_split_extent_at+0xfb8/0x1008 fs/ext4/extents.c:3203
sp : ffff8000a06b6300
x29: ffff8000a06b6440 x28: dfff800000000000 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000001 x24: ffff0000c6a50698
x23: 1fffe00018d4a0d3 x22: 0000000000000000 x21: 0000000000000000
x20: ffff0000c6a50694 x19: ffff0000d3b0cd00 x18: 0000000000000008
x17: 0000000000000000 x16: ffff80008b732588 x15: ffff7000140d6c81
x14: 1ffff000140d6c80 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff7000140d6c81 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000cbed9e80 x7 : 0000000000000000 x6 : ffff800080b2a810
x5 : 000000000000043b x4 : 0000000000000010 x3 : ffff80008107979c
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
ext4_split_extent_at+0xfb8/0x1008 fs/ext4/extents.c:3203 (P)
ext4_split_extent+0x290/0x604 fs/ext4/extents.c:3403
ext4_split_convert_extents fs/ext4/extents.c:3740 [inline]
ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3912 [inline]
ext4_ext_map_blocks+0x1a80/0x6600 fs/ext4/extents.c:4271
ext4_map_create_blocks fs/ext4/inode.c:516 [inline]
ext4_map_blocks+0x710/0x15d0 fs/ext4/inode.c:702
mpage_map_one_extent fs/ext4/inode.c:2219 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2272 [inline]
ext4_do_writepages+0x195c/0x318c fs/ext4/inode.c:2735
ext4_writepages+0x198/0x308 fs/ext4/inode.c:2824
do_writepages+0x304/0x7d0 mm/page-writeback.c:2687
__writeback_single_inode+0x15c/0x15a4 fs/fs-writeback.c:1680
writeback_sb_inodes+0x650/0x1088 fs/fs-writeback.c:1976
wb_writeback+0x3e0/0xe9c fs/fs-writeback.c:2156
wb_do_writeback fs/fs-writeback.c:2303 [inline]
wb_workfn+0x38c/0x1048 fs/fs-writeback.c:2343
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: 97ee03ed f94017ea 17fffe86 97d8a13d (d4210000)
---[ end trace 0000000000000000 ]---