EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 1125298482696, count = 2309 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 1125298482688, count = 16 ================================================================== BUG: KASAN: use-after-free in ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline] BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:-1 [inline] BUG: KASAN: use-after-free in ext4_ext_remove_space+0x2196/0x3fb0 fs/ext4/extents.c:2939 Read of size 2 at addr ffff888125ccfff8 by task syz-executor184/289 CPU: 0 PID: 289 Comm: syz-executor184 Not tainted 6.1.141-syzkaller-00039-g145c7fad733f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106 print_address_description+0x71/0x210 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:427 kasan_report+0x122/0x150 mm/kasan/report.c:531 __asan_report_load2_noabort+0x14/0x20 mm/kasan/report_generic.c:349 ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:-1 [inline] ext4_ext_remove_space+0x2196/0x3fb0 fs/ext4/extents.c:2939 ext4_ext_truncate+0x200/0x320 fs/ext4/extents.c:4469 ext4_truncate+0x9a6/0xf90 fs/ext4/inode.c:4291 ext4_evict_inode+0xcc3/0x1460 fs/ext4/inode.c:286 evict+0x493/0x890 fs/inode.c:705 iput_final fs/inode.c:1834 [inline] iput+0x620/0x670 fs/inode.c:1860 do_unlinkat+0x375/0x6b0 fs/namei.c:4396 __do_sys_unlink fs/namei.c:4437 [inline] __se_sys_unlink fs/namei.c:4435 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4435 x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7f7439dd17 Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffec7187988 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7f7439dd17 RDX: 00007ffec71879b0 RSI: 00007ffec7187a40 RDI: 00007ffec7187a40 RBP: 00007ffec7187a40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffec7188b30 R13: 000055558197a700 R14: 431bde82d7b634db R15: 00007ffec7189bc0 The buggy address belongs to the physical page: page:ffffea00049733c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x125ccf flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea000496d348 ffffea0004973388 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x8140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO|__GFP_CMA), pid 235, tgid 235 (sshd-session), ts 18134372733, free_ts 18217491400 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2637 prep_new_page+0x1c/0x110 mm/page_alloc.c:2644 get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4539 __alloc_pages+0x19e/0x3a0 mm/page_alloc.c:5850 __folio_alloc+0x12/0x40 mm/page_alloc.c:5882 __folio_alloc_node include/linux/gfp.h:245 [inline] folio_alloc include/linux/gfp.h:274 [inline] alloc_page_vma include/linux/gfp.h:283 [inline] do_anonymous_page mm/memory.c:4283 [inline] handle_pte_fault mm/memory.c:5169 [inline] __handle_mm_fault mm/memory.c:5313 [inline] handle_mm_fault+0x18ef/0x2640 mm/memory.c:5453 do_user_addr_fault+0x905/0x1050 arch/x86/mm/fault.c:1323 handle_page_fault arch/x86/mm/fault.c:1466 [inline] exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1522 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:608 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1545 [inline] free_pcp_prepare mm/page_alloc.c:1619 [inline] free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3581 free_unref_page_list+0xba/0x7c0 mm/page_alloc.c:3729 release_pages+0xad1/0xb20 mm/swap.c:1043 free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:315 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu mm/mmu_gather.c:261 [inline] tlb_finish_mmu+0x1aa/0x370 mm/mmu_gather.c:361 unmap_region+0x28d/0x2e0 mm/mmap.c:2402 do_mas_align_munmap+0xb94/0x11b0 mm/mmap.c:2668 do_mas_munmap+0x241/0x2b0 mm/mmap.c:2726 __vm_munmap+0x19f/0x2f0 mm/mmap.c:3025 __do_sys_munmap mm/mmap.c:3051 [inline] __se_sys_munmap mm/mmap.c:3047 [inline] __x64_sys_munmap+0x6b/0x80 mm/mmap.c:3047 x64_sys_call+0x8a/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff888125ccfe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888125ccff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888125ccff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888125cd0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888125cd0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 222012823440768, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 222012823430084, count = 10693 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 222012823430080, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 218647504839552, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 218647504824773, count = 14789 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 218647504824768, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 217521920164768, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 217521920139065, count = 25713 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 7520499, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 50 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 5622896, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 5622896, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 365072220160, count = 19360 EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 122485813664448, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 122485813636191, count = 28265 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 122485813636176, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 119221520883152, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 119221520853343, count = 29810 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 128043312927952, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 128043312903026, count = 24927 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 128043312903024, count = 16 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 111502425311936, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 111502425285740, count = 26207 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 111502425285728, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 427080822384, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 427080810496, count = 11892 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 427080810496, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 128039222760672, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 128039222736242, count = 24436 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 17120, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 17080, count = 44 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 17072, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 11313183003184, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 11313183002638, count = 560 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 11313183002624, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 269369712, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 269369600, count = 121 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 241359600322640, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 241359600310888, count = 11767 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 241359600310880, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 23358442856240, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 23358442847562, count = 8679 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 124512128020848, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 124512128006302, count = 14552 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 124512128006288, count = 16 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 1074685984, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 1074664128, count = 21861 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 70596377466213, count = 9616 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 123580929138768, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 123580929109548, count = 29228 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 123580929109536, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 115974441376928, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 115974441368167, count = 8762 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 115974441368160, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79639237082080, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79639237063280, count = 18804 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 158484544893984, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 158484544880640, count = 13353 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 16494824303657, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 16494824303648, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 175299090190496, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 175299090186416, count = 4083 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 105710275750928, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 105710275727347, count = 23593 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 225180222885104, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 225180222865457, count = 19660 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 225180222865456, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 257285720908000, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 257285720898952, count = 9063 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 257285720898944, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 216058329844368, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 216058329825744, count = 18627 EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76211819659664, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76211819642962, count = 16709 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76211819642960, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79454198344592, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79454198320201, count = 24404 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79454198320192, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 109342622014576, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 109342621985908, count = 28672 EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79168952816080, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79168952808845, count = 7247 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 79168952808832, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76896325978656, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76896325976113, count = 2559 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 76896325976112, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 67675800986032, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 67675800967605, count = 18432 EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs (loop0): unmounting filesystem. EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22683881344, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22683879752, count = 1608 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22683879744, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22599593726080, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22599593707658, count = 18433 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 22599593707648, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 211671176013313, count = 5 EXT4-fs error (device loop0): ext4_free_blocks:6210: comm syz-executor184: Freeing blocks not in datazone - block = 211671176013312, count = 16