================================================================== EXT4-fs error (device sda1): ext4_expand_extra_isize_ea:2727: inode #16689: comm syz-executor0: corrupted in-inode xattr BUG: KASAN: use-after-free in memset include/linux/string.h:337 [inline] BUG: KASAN: use-after-free in __ext4_expand_extra_isize+0x16c/0x240 fs/ext4/inode.c:5923 Write of size 2147483615 at addr ffff8880876f22a0 by task rs:main Q:Reg/7959 CPU: 1 PID: 7959 Comm: rs:main Q:Reg Not tainted 5.0.0-rc2+ #32 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1db/0x2d0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x123/0x190 mm/kasan/generic.c:191 memset+0x24/0x40 mm/kasan/common.c:113 memset include/linux/string.h:337 [inline] __ext4_expand_extra_isize+0x16c/0x240 fs/ext4/inode.c:5923 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5975 [inline] ext4_mark_inode_dirty+0x827/0xb80 fs/ext4/inode.c:6051 ext4_dirty_inode+0x8f/0xc0 fs/ext4/inode.c:6085 __mark_inode_dirty+0xab5/0x1590 fs/fs-writeback.c:2122 mark_inode_dirty_sync include/linux/fs.h:2129 [inline] dquot_claim_block include/linux/quotaops.h:355 [inline] ext4_da_update_reserve_space+0x58d/0x9b0 fs/ext4/inode.c:378 ext4_ext_map_blocks+0x3a06/0x60a0 fs/ext4/extents.c:4464 ext4_map_blocks+0x9b1/0x1bb0 fs/ext4/inode.c:636 mpage_map_one_extent fs/ext4/inode.c:2480 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2533 [inline] ext4_writepages+0x2383/0x41a0 fs/ext4/inode.c:2885 do_writepages+0x99/0x1a0 mm/page-writeback.c:2335 __filemap_fdatawrite_range+0x352/0x470 mm/filemap.c:411 file_write_and_wait_range+0x9a/0x100 mm/filemap.c:730 ext4_sync_file+0x5d9/0x14d0 fs/ext4/fsync.c:119 vfs_fsync_range+0x144/0x230 fs/sync.c:197 generic_write_sync include/linux/fs.h:2786 [inline] ext4_file_write_iter+0x67f/0x1410 fs/ext4/file.c:270 call_write_iter include/linux/fs.h:1862 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x764/0xb40 fs/read_write.c:487 vfs_write+0x20c/0x580 fs/read_write.c:549 ksys_write+0x105/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f5d0ff8f19d Code: d1 20 00 00 75 10 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 be fa ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 07 fb ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007f5d0e530000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000000000f5 RCX: 00007f5d0ff8f19d RDX: 00000000000000f5 RSI: 000000000151aa90 RDI: 0000000000000005 RBP: 000000000151aa90 R08: 000000000151ab75 R09: 00007f5d0f90c3f7 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f5d0e530480 R14: 0000000000000002 R15: 000000000151a890 The buggy address belongs to the page: page:ffffea00021dbc80 count:2 mapcount:0 mapping:ffff888219e12ad8 index:0x427 def_blk_aops flags: 0x1fffc000000203a(referenced|dirty|lru|active|private) raw: 01fffc000000203a ffffea00020e43c8 ffffea000212ce48 ffff888219e12ad8 raw: 0000000000000427 ffff888080509498 00000002ffffffff ffff8880a940cb00 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8880a940cb00 Memory state around the buggy address: ffff8880877fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880877fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888087800000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888087800080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888087800100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== kasan: CONFIG_KASAN_INLINE enabled kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8071 Comm: syz-fuzzer Tainted: G B 5.0.0-rc2+ #32 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__rb_insert lib/rbtree.c:131 [inline] RIP: 0010:rb_insert_color_cached+0x14c/0x1330 lib/rbtree.c:469 Code: df 4c 89 e2 48 c1 ea 03 80 3c 02 00 0f 85 0b 09 00 00 49 8b 1c 24 f6 c3 01 0f 85 f3 01 00 00 4c 8d 43 08 4c 89 c2 48 c1 ea 03 <80> 3c 02 00 0f 85 b7 08 00 00 48 8b 7b 08 4c 39 e7 0f 84 16 02 00 RSP: 0000:ffff888093b66e10 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff110110a1ef4 RDX: 0000000000000001 RSI: ffff8880ae72cef0 RDI: ffff88808520c698 RBP: ffff888093b67068 R08: 0000000000000008 R09: ffff88808520c690 R10: 00000000000003cf R11: 0000000000000001 R12: ffff88808850f798 R13: ffff88808520c698 R14: 1ffff1101276cdc8 R15: ffff888093b67040 FS: 000000c420026068(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000b CR3: 0000000093424000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __enqueue_entity+0x14f/0x230 kernel/sched/fair.c:556 enqueue_entity+0x321/0x20b0 kernel/sched/fair.c:3911 enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133 enqueue_task kernel/sched/core.c:730 [inline] activate_task+0x11d/0x470 kernel/sched/core.c:751 ttwu_activate kernel/sched/core.c:1643 [inline] ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702 ttwu_queue kernel/sched/core.c:1847 [inline] try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057 wake_up_state+0xb/0x10 kernel/sched/core.c:2135 signal_wake_up_state+0x24/0x60 kernel/signal.c:712 signal_wake_up include/linux/sched/signal.h:389 [inline] zap_process+0x29b/0x420 fs/coredump.c:326 zap_threads fs/coredump.c:345 [inline] coredump_wait fs/coredump.c:424 [inline] do_coredump+0xaeb/0x40d3 fs/coredump.c:589 get_signal+0x9ef/0x19b0 kernel/signal.c:2511 do_signal+0x91/0x1ea0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162 prepare_exit_to_usermode+0x32e/0x3b0 arch/x86/entry/common.c:197 retint_user+0x8/0x18 RIP: 0033:0xb Code: Bad RIP value. RSP: 002b:000000c42002f9b0 EFLAGS: 00010282 RAX: 000000c420000480 RBX: 000000c42002fa68 RCX: 000000c420026000 RDX: 000000c420000300 RSI: 000000c42002fa68 RDI: 000000c420028000 RBP: 000000c42002fa58 R08: 000000c420035f18 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000430120 R13: 00000000000000f1 R14: 0000000000000011 R15: 0000000000000000 Modules linked in: ---[ end trace a028912814962883 ]--- RIP: 0010:__rb_insert lib/rbtree.c:131 [inline] RIP: 0010:rb_insert_color_cached+0x14c/0x1330 lib/rbtree.c:469 Code: df 4c 89 e2 48 c1 ea 03 80 3c 02 00 0f 85 0b 09 00 00 49 8b 1c 24 f6 c3 01 0f 85 f3 01 00 00 4c 8d 43 08 4c 89 c2 48 c1 ea 03 <80> 3c 02 00 0f 85 b7 08 00 00 48 8b 7b 08 4c 39 e7 0f 84 16 02 00 RSP: 0000:ffff888093b66e10 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff110110a1ef4 RDX: 0000000000000001 RSI: ffff8880ae72cef0 RDI: ffff88808520c698 RBP: ffff888093b67068 R08: 0000000000000008 R09: ffff88808520c690 R10: 00000000000003cf R11: 0000000000000001 R12: ffff88808850f798 R13: ffff88808520c698 R14: 1ffff1101276cdc8 R15: ffff888093b67040 FS: 000000c420026068(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000b CR3: 0000000093424000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400