EXT4-fs error (device sda1): ext4_xattr_set_entry:1603: inode #17661: comm syz-fuzzer: corrupted xattr entries ================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x1987/0x39e0 fs/ext4/xattr.c:1734 Read of size 4 at addr ffff888049159ffe by task syz-fuzzer/9203 CPU: 0 PID: 9203 Comm: syz-fuzzer Not tainted 5.4.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fb/0x318 lib/dump_stack.c:118 print_address_description+0x75/0x5c0 mm/kasan/report.c:374 __kasan_report+0x14b/0x1c0 mm/kasan/report.c:506 kasan_report+0x26/0x50 mm/kasan/common.c:634 check_memory_region_inline mm/kasan/generic.c:182 [inline] check_memory_region+0x2cf/0x2e0 mm/kasan/generic.c:192 memmove+0x28/0x60 mm/kasan/common.c:113 ext4_xattr_set_entry+0x1987/0x39e0 fs/ext4/xattr.c:1734 ext4_xattr_ibody_set fs/ext4/xattr.c:2236 [inline] ext4_xattr_set_handle+0xd9d/0x1eb0 fs/ext4/xattr.c:2392 ext4_initxattrs+0xb8/0x110 fs/ext4/xattr_security.c:43 security_inode_init_security+0x237/0x310 security/security.c:996 ext4_init_security+0x34/0x40 fs/ext4/xattr_security.c:57 __ext4_new_inode+0x446c/0x5650 fs/ext4/ialloc.c:1160 ext4_mkdir+0x3f5/0x1450 fs/ext4/namei.c:2763 vfs_mkdir+0x43f/0x610 fs/namei.c:3807 do_mkdirat+0x1d7/0x320 fs/namei.c:3830 __do_sys_mkdirat fs/namei.c:3841 [inline] __se_sys_mkdirat fs/namei.c:3839 [inline] __x64_sys_mkdirat+0x7b/0x90 fs/namei.c:3839 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x47fd44 Code: ff ff cc cc cc cc e8 9b 40 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 RSP: 002b:000000c420325228 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fd44 RDX: 00000000000001c0 RSI: 000000c42931e180 RDI: ffffffffffffff9c RBP: 000000c420325288 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000001000000 R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000000 The buggy address belongs to the page: page:ffffea0001245640 refcount:2 mapcount:0 mapping:ffff8880a2985520 index:0x471 def_blk_aops flags: 0x1fffc000000203a(referenced|dirty|lru|active|private) raw: 01fffc000000203a ffffea0001163d08 ffffea0001200408 ffff8880a2985520 raw: 0000000000000471 ffff888094fa3a80 00000002ffffffff ffff88809161e000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff88809161e000 Memory state around the buggy address: ffff888049159f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888049159f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88804915a000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88804915a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88804915a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================