================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1544 Read of size 1 at addr ffff888134557900 by task syz.9.999/4324 CPU: 0 PID: 4324 Comm: syz.9.999 Not tainted 5.15.167-syzkaller-android13-5.15.167_r00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1c0 lib/dump_stack.c:106 print_address_description+0x87/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:444 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1544 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1718 __ext4_find_entry+0x2b0/0x1af0 fs/ext4/namei.c:1617 ext4_find_entry+0x24f/0x3a0 fs/ext4/namei.c:1751 ext4_rmdir+0x1b8/0xa80 fs/ext4/namei.c:3207 vfs_rmdir+0x324/0x470 fs/namei.c:4149 incfs_kill_sb+0x113/0x230 fs/incfs/vfs.c:1989 deactivate_locked_super+0xad/0x110 fs/super.c:335 deactivate_super+0xbe/0xf0 fs/super.c:366 cleanup_mnt+0x45c/0x510 fs/namespace.c:1143 __cleanup_mnt+0x19/0x20 fs/namespace.c:1150 task_work_run+0x129/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xc48/0x2ca0 kernel/exit.c:880 do_group_exit+0x141/0x310 kernel/exit.c:1002 get_signal+0x7a3/0x1630 kernel/signal.c:2904 arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:307 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:280 RIP: 00fb:0x294e66b3c7c44cb4 Code: Unable to access opcode bytes at RIP 0x294e66b3c7c44c8a. RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: ce3d5c200518e753 RAX: 6d02b596a6d6b2c6 RBX: 46b00e13ac8c17fa RCX: 1d6d567492f1521e RDX: eb30e365dd53f3a0 RSI: c553273f825e1cf7 RDI: b331ef28487276fd RBP: 9c8c87e20081ee76 R08: cf9d780a350b4549 R09: c7e58b697db8ef3d R10: d68d02d45a22dc24 R11: 19b4d49ef33da9ed R12: 39cb75b6fa6cb3d1 R13: a8d7b5dbf29d588f R14: 9b8908dcbb4f02b4 R15: 107b9d1451766018 Allocated by task 4838: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:466 kasan_slab_alloc include/linux/kasan.h:217 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550 slab_alloc_node mm/slub.c:3240 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0xf5/0x200 mm/slub.c:3253 kmem_cache_alloc_node include/linux/slab.h:474 [inline] __alloc_skb+0xbe/0x550 net/core/skbuff.c:416 alloc_skb include/linux/skbuff.h:1183 [inline] pfkey_send_acquire+0x60a/0x3030 net/key/af_key.c:3186 km_query+0x6e/0xe0 net/xfrm/xfrm_state.c:2247 xfrm_state_find+0x20fc/0x2f70 net/xfrm/xfrm_state.c:1164 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2393 [inline] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2438 [inline] xfrm_resolve_and_create_bundle+0x65a/0x2b70 net/xfrm/xfrm_policy.c:2731 xfrm_lookup_with_ifid+0x833/0x20d0 net/xfrm/xfrm_policy.c:3065 xfrm_lookup net/xfrm/xfrm_policy.c:3194 [inline] xfrm_lookup_route+0x3b/0x160 net/xfrm/xfrm_policy.c:3205 ip_route_output_flow+0x1ef/0x310 net/ipv4/route.c:2887 udp_sendmsg+0x17b1/0x2aa0 net/ipv4/udp.c:1245 inet_sendmsg+0xa1/0xc0 net/ipv4/af_inet.c:832 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485 __sys_sendmmsg+0x2bf/0x530 net/socket.c:2571 __do_sys_sendmmsg net/socket.c:2600 [inline] __se_sys_sendmmsg net/socket.c:2597 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2597 x64_sys_call+0x81d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4838: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749 slab_free mm/slub.c:3519 [inline] kmem_cache_free+0x116/0x2e0 mm/slub.c:3535 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] kfree_skb_reason net/core/skbuff.c:778 [inline] kfree_skb+0xc2/0x360 net/core/skbuff.c:792 pfkey_broadcast+0x2dd/0x2f0 net/key/af_key.c:266 pfkey_send_acquire+0x2306/0x3030 net/key/af_key.c:3262 km_query+0x6e/0xe0 net/xfrm/xfrm_state.c:2247 xfrm_state_find+0x20fc/0x2f70 net/xfrm/xfrm_state.c:1164 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2393 [inline] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2438 [inline] xfrm_resolve_and_create_bundle+0x65a/0x2b70 net/xfrm/xfrm_policy.c:2731 xfrm_lookup_with_ifid+0x833/0x20d0 net/xfrm/xfrm_policy.c:3065 xfrm_lookup net/xfrm/xfrm_policy.c:3194 [inline] xfrm_lookup_route+0x3b/0x160 net/xfrm/xfrm_policy.c:3205 ip_route_output_flow+0x1ef/0x310 net/ipv4/route.c:2887 udp_sendmsg+0x17b1/0x2aa0 net/ipv4/udp.c:1245 inet_sendmsg+0xa1/0xc0 net/ipv4/af_inet.c:832 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485 __sys_sendmmsg+0x2bf/0x530 net/socket.c:2571 __do_sys_sendmmsg net/socket.c:2600 [inline] __se_sys_sendmmsg net/socket.c:2597 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2597 x64_sys_call+0x81d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff8881345578c0 which belongs to the cache skbuff_head_cache of size 248 The buggy address is located 64 bytes inside of 248-byte region [ffff8881345578c0, ffff8881345579b8) The buggy address belongs to the page: page:ffffea0004d155c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x134557 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 0000000000000000 dead000000000122 ffff8881081b2d80 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4838, ts 228741879535, free_ts 228664142626 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2605 prep_new_page+0x1b/0x110 mm/page_alloc.c:2611 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4485 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5779 allocate_slab mm/slub.c:1932 [inline] new_slab+0x9a/0x4e0 mm/slub.c:1995 ___slab_alloc+0x39e/0x830 mm/slub.c:3028 __slab_alloc+0x4a/0x90 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0x134/0x200 mm/slub.c:3253 kmem_cache_alloc_node include/linux/slab.h:474 [inline] __alloc_skb+0xbe/0x550 net/core/skbuff.c:416 alloc_skb include/linux/skbuff.h:1183 [inline] alloc_skb_with_frags+0xa6/0x680 net/core/skbuff.c:6194 sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2536 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2553 __ip_append_data+0x2390/0x3730 net/ipv4/ip_output.c:1102 ip_make_skb+0x1a2/0x420 net/ipv4/ip_output.c:1647 udp_sendmsg+0x1ccb/0x2aa0 net/ipv4/udp.c:1274 inet_sendmsg+0xa1/0xc0 net/ipv4/af_inet.c:832 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1472 [inline] free_pcp_prepare mm/page_alloc.c:1544 [inline] free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3534 free_unref_page+0xe8/0x750 mm/page_alloc.c:3616 free_the_page mm/page_alloc.c:805 [inline] __free_pages+0x61/0xf0 mm/page_alloc.c:5855 __vunmap+0x7bc/0x8f0 mm/vmalloc.c:2652 free_work+0x5b/0x80 mm/vmalloc.c:96 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472 kthread+0x421/0x510 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Memory state around the buggy address: ffff888134557800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc ffff888134557880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff888134557900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888134557980: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc ffff888134557a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================