================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543 Read of size 1 at addr ffff8881299f0900 by task syz.4.1656/5463 CPU: 0 PID: 5463 Comm: syz.4.1656 Not tainted 6.1.93-syzkaller-00101-g04212acc42d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:348 ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1722 __ext4_find_entry+0x2b0/0x1af0 fs/ext4/namei.c:1616 ext4_lookup_entry fs/ext4/namei.c:1771 [inline] ext4_lookup+0x176/0x740 fs/ext4/namei.c:1839 lookup_one_qstr_excl+0x143/0x290 fs/namei.c:1604 filename_create+0x28e/0x530 fs/namei.c:3878 do_mkdirat+0xbd/0x450 fs/namei.c:4122 __do_sys_mkdirat fs/namei.c:4147 [inline] __se_sys_mkdirat fs/namei.c:4145 [inline] __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4145 x64_sys_call+0x6c6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:259 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f145737c797 Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f145810fe68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f145810fef0 RCX: 00007f145737c797 RDX: 00000000000001ff RSI: 0000000020000080 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000080 R13: 00007f145810feb0 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 101: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333 kasan_slab_alloc include/linux/kasan.h:202 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768 slab_alloc_node mm/slub.c:3421 [inline] slab_alloc mm/slub.c:3429 [inline] __kmem_cache_alloc_lru mm/slub.c:3436 [inline] kmem_cache_alloc+0x175/0x2c0 mm/slub.c:3445 kmem_cache_zalloc include/linux/slab.h:682 [inline] __alloc_file+0x29/0x2a0 fs/file_table.c:138 alloc_empty_file+0x95/0x180 fs/file_table.c:187 path_openat+0xec/0x2d60 fs/namei.c:3770 do_filp_open+0x230/0x480 fs/namei.c:3811 do_sys_openat2+0x151/0x890 fs/open.c:1341 do_sys_open fs/open.c:1357 [inline] __do_sys_openat fs/open.c:1373 [inline] __se_sys_openat fs/open.c:1368 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1368 x64_sys_call+0x6bf/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 13: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1745 [inline] slab_free_freelist_hook mm/slub.c:1771 [inline] slab_free mm/slub.c:3684 [inline] kmem_cache_free+0x291/0x510 mm/slub.c:3706 file_free_rcu+0x9f/0xb0 fs/file_table.c:51 rcu_do_batch+0x534/0xb80 kernel/rcu/tree.c:2296 rcu_core+0x4ee/0xf10 kernel/rcu/tree.c:2556 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2573 handle_softirqs+0x1db/0x650 kernel/softirq.c:617 run_ksoftirqd+0x28/0x30 kernel/softirq.c:994 smpboot_thread_fn+0x466/0x8d0 kernel/smpboot.c:164 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Last potentially related work creation: kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496 __call_rcu_common kernel/rcu/tree.c:2806 [inline] call_rcu+0xee/0x1340 kernel/rcu/tree.c:2925 file_free fs/file_table.c:59 [inline] __fput+0x69d/0x870 fs/file_table.c:333 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x24d/0x2e0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x94/0xa0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:303 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Second to last potentially related work creation: kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:486 kasan_record_aux_stack+0xe/0x10 mm/kasan/generic.c:491 task_work_add+0x87/0x3a0 kernel/task_work.c:48 fput+0xea/0x1b0 fs/file_table.c:376 filp_close+0x105/0x150 fs/open.c:1458 close_fd+0x287/0x2f0 fs/file.c:665 __do_sys_close fs/open.c:1471 [inline] __se_sys_close fs/open.c:1469 [inline] __x64_sys_close+0x3b/0x90 fs/open.c:1469 x64_sys_call+0x3d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:4 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff8881299f0900 which belongs to the cache filp of size 264 The buggy address is located 0 bytes inside of 264-byte region [ffff8881299f0900, ffff8881299f0a08) The buggy address belongs to the physical page: page:ffffea0004a67c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1299f0 head:ffffea0004a67c00 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881002b3b00 raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 317, tgid 317 (udevd), ts 258914912950, free_ts 252829636614 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x213/0x220 mm/page_alloc.c:2590 prep_new_page+0x1b/0x110 mm/page_alloc.c:2597 get_page_from_freelist+0x27ea/0x2870 mm/page_alloc.c:4425 __alloc_pages+0x3a1/0x780 mm/page_alloc.c:5714 alloc_slab_page+0x6c/0xf0 allocate_slab mm/slub.c:1962 [inline] new_slab+0x90/0x3e0 mm/slub.c:2015 ___slab_alloc+0x6f9/0xb80 mm/slub.c:3203 __slab_alloc+0x5d/0xa0 mm/slub.c:3302 slab_alloc_node mm/slub.c:3387 [inline] slab_alloc mm/slub.c:3429 [inline] __kmem_cache_alloc_lru mm/slub.c:3436 [inline] kmem_cache_alloc+0x1b9/0x2c0 mm/slub.c:3445 kmem_cache_zalloc include/linux/slab.h:682 [inline] __alloc_file+0x29/0x2a0 fs/file_table.c:138 alloc_empty_file+0x95/0x180 fs/file_table.c:187 path_openat+0xec/0x2d60 fs/namei.c:3770 do_filp_open+0x230/0x480 fs/namei.c:3811 do_sys_openat2+0x151/0x890 fs/open.c:1341 do_sys_open fs/open.c:1357 [inline] __do_sys_openat fs/open.c:1373 [inline] __se_sys_openat fs/open.c:1368 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1368 x64_sys_call+0x6bf/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1498 [inline] free_pcp_prepare mm/page_alloc.c:1572 [inline] free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3498 free_unref_page_list+0xf1/0x7b0 mm/page_alloc.c:3646 release_pages+0xf7f/0xfe0 mm/swap.c:1063 free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:315 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu mm/mmu_gather.c:261 [inline] tlb_finish_mmu+0x1e0/0x3f0 mm/mmu_gather.c:361 exit_mmap+0x460/0xbe0 mm/mmap.c:3348 __mmput+0x95/0x310 kernel/fork.c:1298 mmput+0x56/0x170 kernel/fork.c:1321 exit_mm kernel/exit.c:566 [inline] do_exit+0xb29/0x2b80 kernel/exit.c:862 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1034 x64_sys_call+0x610/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff8881299f0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881299f0880: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881299f0900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881299f0980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881299f0a00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== EXT4-fs error (device loop4): ext4_find_dest_de:2112: inode #12: block 7: comm syz.4.1656: bad entry in directory: directory entry overrun - offset=0, inode=1793120026, rec_len=34652, size=56 fake=0