loop3: detected capacity change from 0 to 512 EXT4-fs (loop3): 1 truncate cleaned up EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. EXT4-fs error (device loop3): ext4_find_dest_de:2112: inode #12: block 7: comm syz-executor.3: bad entry in directory: rec_len is too small for name_len - offset=0, inode=122849872, rec_len=24, size=52 fake=0 EXT4-fs (loop3): Remounting filesystem read-only EXT4-fs error (device loop3): ext4_lookup:1859: inode #12: comm syz-executor.3: deleted inode referenced: 13 ================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543 Read of size 1 at addr ffff888139ac8355 by task syz-executor.3/8644 CPU: 0 PID: 8644 Comm: syz-executor.3 Not tainted 6.1.78-syzkaller-00021-g1a72e2f692ac #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:348 ext4_search_dir+0xf7/0x1b0 fs/ext4/namei.c:1543 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1722 __ext4_find_entry+0x2b0/0x1af0 fs/ext4/namei.c:1616 ext4_lookup_entry fs/ext4/namei.c:1771 [inline] ext4_lookup+0x176/0x740 fs/ext4/namei.c:1839 lookup_one_qstr_excl+0x143/0x290 fs/namei.c:1604 filename_create+0x28e/0x530 fs/namei.c:3878 do_mkdirat+0xbd/0x450 fs/namei.c:4122 __do_sys_mkdirat fs/namei.c:4147 [inline] __se_sys_mkdirat fs/namei.c:4145 [inline] __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4145 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd65887bba7 Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd6595ecef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007fd6595ecf80 RCX: 00007fd65887bba7 RDX: 00000000000001ff RSI: 0000000020000480 RDI: 00000000ffffff9c RBP: 0000000020000440 R08: 00000000200014c0 R09: 0000000000000000 R10: 0000000020000440 R11: 0000000000000246 R12: 0000000020000480 R13: 00007fd6595ecf40 R14: 0000000000000000 R15: 0000000020000580 The buggy address belongs to the physical page: page:ffffea0004e6b200 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x139ac8 flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea0004858648 ffffea0004cdce88 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100cc0(GFP_USER), pid 1380, tgid 1380 (syz-executor.0), ts 338517735261, free_ts 351905652729 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x213/0x220 mm/page_alloc.c:2590 prep_new_page+0x1b/0x110 mm/page_alloc.c:2597 get_page_from_freelist+0x27ea/0x2870 mm/page_alloc.c:4425 __alloc_pages+0x3a1/0x780 mm/page_alloc.c:5712 __alloc_pages_node include/linux/gfp.h:236 [inline] alloc_pages_node include/linux/gfp.h:259 [inline] alloc_pages include/linux/gfp.h:270 [inline] __get_free_pages+0xe/0x30 mm/page_alloc.c:5762 kasan_populate_vmalloc_pte+0x39/0x130 mm/kasan/shadow.c:271 apply_to_pte_range mm/memory.c:2660 [inline] apply_to_pmd_range mm/memory.c:2704 [inline] apply_to_pud_range mm/memory.c:2740 [inline] apply_to_p4d_range mm/memory.c:2776 [inline] __apply_to_page_range+0x8dd/0xbe0 mm/memory.c:2810 apply_to_page_range+0x3b/0x50 mm/memory.c:2829 kasan_populate_vmalloc+0x65/0x70 mm/kasan/shadow.c:318 alloc_vmap_area+0x1961/0x1aa0 mm/vmalloc.c:1653 __get_vm_area_node+0x171/0x370 mm/vmalloc.c:2512 __vmalloc_node_range+0x36e/0x1540 mm/vmalloc.c:3194 __vmalloc_node mm/vmalloc.c:3299 [inline] vzalloc+0x78/0x90 mm/vmalloc.c:3372 alloc_counters+0x62/0x520 net/ipv4/netfilter/ip_tables.c:801 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:823 [inline] get_entries net/ipv4/netfilter/ip_tables.c:1024 [inline] do_ipt_get_ctl+0xec9/0x1840 net/ipv4/netfilter/ip_tables.c:1662 nf_getsockopt+0x26c/0x290 net/netfilter/nf_sockopt.c:116 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1498 [inline] free_pcp_prepare mm/page_alloc.c:1572 [inline] free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3498 free_unref_page+0xb2/0x5c0 mm/page_alloc.c:3594 free_the_page mm/page_alloc.c:798 [inline] __free_pages+0x61/0xf0 mm/page_alloc.c:5801 free_pages+0x7c/0x90 mm/page_alloc.c:5812 kasan_depopulate_vmalloc_pte+0x6a/0x90 mm/kasan/shadow.c:375 apply_to_pte_range mm/memory.c:2660 [inline] apply_to_pmd_range mm/memory.c:2704 [inline] apply_to_pud_range mm/memory.c:2740 [inline] apply_to_p4d_range mm/memory.c:2776 [inline] __apply_to_page_range+0x8dd/0xbe0 mm/memory.c:2810 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2843 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:492 __purge_vmap_area_lazy+0x152c/0x1680 mm/vmalloc.c:1781 drain_vmap_area_work+0x3e/0xd0 mm/vmalloc.c:1810 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Memory state around the buggy address: ffff888139ac8200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888139ac8280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888139ac8300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888139ac8380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888139ac8400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs (loop3): unmounting filesystem.