==================================================================
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2601 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x2f43/0x3fb0 fs/ext4/extents.c:2939
Read of size 4 at addr ffff88812590adb8 by task syz-executor199/289
CPU: 0 PID: 289 Comm: syz-executor199 Not tainted 6.1.141-syzkaller-00039-g145c7fad733f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
print_address_description+0x71/0x210 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:427
kasan_report+0x122/0x150 mm/kasan/report.c:531
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
ext4_ext_rm_leaf fs/ext4/extents.c:2601 [inline]
ext4_ext_remove_space+0x2f43/0x3fb0 fs/ext4/extents.c:2939
ext4_ext_truncate+0x200/0x320 fs/ext4/extents.c:4469
ext4_truncate+0x9a6/0xf90 fs/ext4/inode.c:4291
ext4_evict_inode+0xcc3/0x1460 fs/ext4/inode.c:286
evict+0x493/0x890 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x620/0x670 fs/inode.c:1860
do_unlinkat+0x375/0x6b0 fs/namei.c:4396
__do_sys_unlink fs/namei.c:4437 [inline]
__se_sys_unlink fs/namei.c:4435 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4435
x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1f18f72d17
Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdcb3f67b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f18f72d17
RDX: 00007ffdcb3f67e0 RSI: 00007ffdcb3f6870 RDI: 00007ffdcb3f6870
RBP: 00007ffdcb3f6870 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffdcb3f7960
R13: 000055558e0a7700 R14: 431bde82d7b634db R15: 00007ffdcb3f89f0
The buggy address belongs to the physical page:
page:ffffea0004964280 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12590a
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea00049642c8 ffffea0004964248 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x141cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_WRITE), pid 291, tgid 291 (syz-executor199), ts 27184833871, free_ts 27270323832
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2637
prep_new_page+0x1c/0x110 mm/page_alloc.c:2644
get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4539
__alloc_pages+0x19e/0x3a0 mm/page_alloc.c:5850
__folio_alloc+0x12/0x40 mm/page_alloc.c:5882
__folio_alloc_node include/linux/gfp.h:245 [inline]
folio_alloc include/linux/gfp.h:274 [inline]
filemap_alloc_folio include/linux/pagemap.h:513 [inline]
__filemap_get_folio+0x6ec/0x980 mm/filemap.c:2018
pagecache_get_page+0x2b/0x110 mm/folio-compat.c:110
grab_cache_page_write_begin+0x43/0x60 mm/folio-compat.c:122
ext4_write_begin+0x24b/0xf70 fs/ext4/inode.c:1221
ext4_da_write_begin+0x3e1/0x8b0 fs/ext4/inode.c:3001
generic_perform_write+0x2f6/0x6d0 mm/filemap.c:3882
ext4_buffered_write_iter+0x36f/0x660 fs/ext4/file.c:285
ext4_file_write_iter+0x18f/0x13d0 fs/ext4/file.c:-1
call_write_iter include/linux/fs.h:2282 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5db/0xca0 fs/read_write.c:584
ksys_write+0x140/0x240 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:646
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1545 [inline]
free_pcp_prepare mm/page_alloc.c:1619 [inline]
free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3581
free_unref_page_list+0xba/0x7c0 mm/page_alloc.c:3729
release_pages+0xad1/0xb20 mm/swap.c:1043
__pagevec_release+0x71/0xe0 mm/swap.c:1063
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
truncate_inode_pages_range+0x309/0xcc0 mm/truncate.c:374
truncate_inode_pages mm/truncate.c:456 [inline]
truncate_pagecache+0x6c/0x90 mm/truncate.c:762
ext4_setattr+0xf9b/0x1a50 fs/ext4/inode.c:5626
notify_change+0xcc3/0xf80 fs/attr.c:499
do_truncate fs/open.c:66 [inline]
do_sys_ftruncate+0x58f/0x7f0 fs/open.c:194
__do_sys_ftruncate fs/open.c:205 [inline]
__se_sys_ftruncate fs/open.c:203 [inline]
__x64_sys_ftruncate+0x60/0x70 fs/open.c:203
x64_sys_call+0x2f9/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:78
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff88812590ac80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88812590ad00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88812590ad80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88812590ae00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88812590ae80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 122335406689760, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 122335406681453, count = 8312
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 122335406681440, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 121364300206800, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 121364300179828, count = 26988
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 121364300179824, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 71640814284976, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 71640814276675, count = 8306
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 128647289814690, count = 0
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 128647289814688, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 16930761131024, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 16930761098271, count = 32767
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 16930761098256, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 260798975181680, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 260798975157224, count = 24457
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 260798975157216, count = 16
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 79530314483168, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 79530314466445, count = 16724
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 79530314466432, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280749113632192, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280749113615476, count = 16725
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280749113615472, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 153765273996672, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 153765273994311, count = 2376
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 231108506848584, count = 2
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 231108506848576, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280947903696816, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280947903692800, count = 4032
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 280947903692800, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1911033888, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1911029760, count = 4132
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 39874476394304, count = 16
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 274877906944, count = 64
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 3, count = 0
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 0, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 0, count = 17
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 4096, count = 0
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 4096, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 34681860946928, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 34681860915200, count = 31743
------------[ cut here ]------------
WARNING: CPU: 0 PID: 289 at fs/ext4/mballoc.c:1777 mb_free_blocks+0xe72/0x1290 fs/ext4/mballoc.c:1777
Modules linked in:
CPU: 0 PID: 289 Comm: syz-executor199 Tainted: G B 6.1.141-syzkaller-00039-g145c7fad733f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:mb_free_blocks+0xe72/0x1290 fs/ext4/mballoc.c:1777
Code: e4 13 c8 ff 48 8b 33 48 8b bd 78 ff ff ff e8 25 45 00 00 48 81 c4 a8 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 ee b9 83 ff <0f> 0b eb e5 e8 e5 b9 83 ff eb de 48 8b 85 60 ff ff ff 42 80 3c 28
RSP: 0018:ffffc90000e47480 EFLAGS: 00010293
RAX: ffffffff81ec3d82 RBX: 0000000000000000 RCX: ffff88810e4f1440
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000e47550 R08: dffffc0000000000 R09: ffffed10237d2490
R10: ffffed10237d2490 R11: 1ffff110237d248f R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88811af1b000 R15: ffffc90000e47650
FS: 000055558e09e380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdcb3f4f18 CR3: 00000001226fd000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ext4_mb_clear_bb fs/ext4/mballoc.c:6120 [inline]
ext4_free_blocks+0x163a/0x2100 fs/ext4/mballoc.c:6273
ext4_remove_blocks fs/ext4/extents.c:2525 [inline]
ext4_ext_rm_leaf fs/ext4/extents.c:2691 [inline]
ext4_ext_remove_space+0x1b7d/0x3fb0 fs/ext4/extents.c:2939
ext4_ext_truncate+0x200/0x320 fs/ext4/extents.c:4469
ext4_truncate+0x9a6/0xf90 fs/ext4/inode.c:4291
ext4_evict_inode+0xcc3/0x1460 fs/ext4/inode.c:286
evict+0x493/0x890 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x620/0x670 fs/inode.c:1860
do_unlinkat+0x375/0x6b0 fs/namei.c:4396
__do_sys_unlink fs/namei.c:4437 [inline]
__se_sys_unlink fs/namei.c:4435 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4435
x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1f18f72d17
Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdcb3f67b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f18f72d17
RDX: 00007ffdcb3f67e0 RSI: 00007ffdcb3f6870 RDI: 00007ffdcb3f6870
RBP: 00007ffdcb3f6870 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffdcb3f7960
R13: 000055558e0a7700 R14: 431bde82d7b634db R15: 00007ffdcb3f89f0
---[ end trace 0000000000000000 ]---
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1174405120, count = 2
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1174405120, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 544, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 0, count = 545
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 2218327690496, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 2218327671558, count = 18952
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 2218327671552, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1121003364096, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1121003363331, count = 772
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 1121003363328, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 5501886949632, count = 16
EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor199: Freeing blocks not in datazone - block = 5501886927874, count = 21763
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.