================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x172/0x1ed6 fs/ext4/xattr.c:1593 Read of size 4 at addr ffffffe0058bb004 by task syz-executor.0/6817 CPU: 1 PID: 6817 Comm: syz-executor.0 Not tainted 5.15.0-rc1-syzkaller-00001-g64a19591a293 #0 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:112 Allocated by task 4113: (stack is not available) Freed by task 4113: (stack is not available) The buggy address belongs to the object at ffffffe0058bb000 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 4 bytes inside of 232-byte region [ffffffe0058bb000, ffffffe0058bb0e8) The buggy address belongs to the page: page:ffffffcf0216aec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffe0058bb280 pfn:0x85abb flags: 0xffe000000000200(slab|node=0|zone=0|lastcpupid=0x7ff) raw: 0ffe000000000200 ffffffcf022a7808 ffffffcf022c7508 ffffffe007de0500 raw: ffffffe0058bb280 00000000000c000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 3322, ts 1837554489100, free_ts 1836024898100 page_owner allocation stack trace missing page_owner free stack trace missing Memory state around the buggy address: ffffffe0058baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffe0058baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffe0058bb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffffffe0058bb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffffffe0058bb100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ================================================================== EXT4-fs error (device vda): ext4_xattr_set_entry:1596: inode #656: comm syz-executor.0: corrupted xattr entries EXT4-fs error (device vda): ext4_xattr_set_entry:1596: inode #656: comm syz-executor.0: corrupted xattr entries