================================================================== BUG: KASAN: use-after-free in ext4_xattr_delete_inode+0xcd0/0xce0 fs/ext4/xattr.c:2904 Read of size 4 at addr ffff888064a71000 by task syz-executor.0/3600 CPU: 0 PID: 3600 Comm: syz-executor.0 Not tainted 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 print_address_description+0x63/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 ext4_xattr_delete_inode+0xcd0/0xce0 fs/ext4/xattr.c:2904 ext4_evict_inode+0xcb7/0x1100 fs/ext4/inode.c:299 evict+0x2a4/0x620 fs/inode.c:587 d_delete_notify include/linux/fsnotify.h:261 [inline] vfs_rmdir+0x33c/0x460 fs/namei.c:4162 do_rmdir+0x368/0x670 fs/namei.c:4210 __do_sys_unlinkat fs/namei.c:4390 [inline] __se_sys_unlinkat fs/namei.c:4384 [inline] __x64_sys_unlinkat+0xdc/0xf0 fs/namei.c:4384 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f56c315a687 Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe6b21bcb8 EFLAGS: 00000207 ORIG_RAX: 0000000000000107 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007f56c315a687 RDX: 0000000000000200 RSI: 00007ffe6b21ce60 RDI: 00000000ffffff9c RBP: 00007f56c31b7636 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffe6b21ce60 R13: 00007f56c31b7636 R14: 000000000003fe76 R15: 0000000000000008 Allocated by task 3596: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x8e/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x53/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3220 [inline] slab_alloc mm/slub.c:3228 [inline] kmem_cache_alloc+0xf3/0x280 mm/slub.c:3233 kmem_cache_zalloc include/linux/slab.h:711 [inline] __kernfs_new_node+0xdb/0x750 fs/kernfs/dir.c:593 kernfs_new_node+0x136/0x230 fs/kernfs/dir.c:669 __kernfs_create_file+0x45/0x2e0 fs/kernfs/file.c:985 sysfs_add_file_mode_ns+0x308/0x3e0 fs/sysfs/file.c:317 create_files fs/sysfs/group.c:64 [inline] internal_create_group+0x573/0xf00 fs/sysfs/group.c:149 netdev_queue_add_kobject net/core/net-sysfs.c:1672 [inline] netdev_queue_update_kobjects+0x1a8/0x3f0 net/core/net-sysfs.c:1711 register_queue_kobjects net/core/net-sysfs.c:1772 [inline] netdev_register_kobject+0x263/0x310 net/core/net-sysfs.c:2018 register_netdevice+0x108c/0x1720 net/core/dev.c:10357 __rtnl_newlink net/core/rtnetlink.c:3503 [inline] rtnl_newlink+0x16c7/0x2070 net/core/rtnetlink.c:3549 rtnetlink_rcv_msg+0x993/0xee0 net/core/rtnetlink.c:5629 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1356 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1924 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x564/0x720 net/socket.c:2058 __do_sys_sendto net/socket.c:2070 [inline] __se_sys_sendto net/socket.c:2066 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2066 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff888064a71000 which belongs to the cache kernfs_node_cache of size 168 The buggy address is located 0 bytes inside of 168-byte region [ffff888064a71000, ffff888064a710a8) The buggy address belongs to the page: page:ffffea0001929c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888064a710e8 pfn:0x64a71 flags: 0xfff000000