================================================================== BUG: KASAN: use-after-free in ext4_xattr_delete_inode+0xd3d/0xd50 fs/ext4/xattr.c:2951 Read of size 4 at addr ffff88811fc27000 by task syz-executor/480 CPU: 1 PID: 480 Comm: syz-executor Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x184/0x200 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x163/0x550 mm/kasan/report.c:488 kasan_report+0x15f/0x190 mm/kasan/report.c:601 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:380 ext4_xattr_delete_inode+0xd3d/0xd50 fs/ext4/xattr.c:2951 ext4_evict_inode+0xc85/0x1290 fs/ext4/inode.c:268 evict+0x2a7/0x640 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput+0x648/0x880 fs/inode.c:1767 d_delete_notify include/linux/fsnotify.h:326 [inline] vfs_rmdir+0x411/0x540 fs/namei.c:4227 do_rmdir+0x364/0x4b0 fs/namei.c:4273 __do_sys_unlinkat fs/namei.c:4449 [inline] __se_sys_unlinkat fs/namei.c:4443 [inline] __x64_sys_unlinkat+0xdf/0xf0 fs/namei.c:4443 x64_sys_call+0x2562/0x2cf0 arch/x86/include/generated/asm/syscalls_64.h:264 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x50/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7ffa4a67c6c7 Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd48e61268 EFLAGS: 00000207 ORIG_RAX: 0000000000000107 RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007ffa4a67c6c7 RDX: 0000000000000200 RSI: 00007ffd48e62410 RDI: 00000000ffffff9c RBP: 00007ffa4a6c8336 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffd48e62410 R13: 00007ffa4a6c8336 R14: 000000000000a366 R15: 0000000000000007 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7ffa4a7b0 pfn:0x11fc27 flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea000480bcc8 ffffea000480bb88 0000000000000000 raw: 00000007ffa4a7b0 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 491, tgid 491 (syz-executor), ts 41897667309, free_ts 41905167165 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x224/0x250 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x21ce/0x2250 mm/page_alloc.c:3402 __alloc_pages_noprof+0x3ad/0x800 mm/page_alloc.c:4660 __folio_alloc_noprof+0x10/0x70 mm/page_alloc.c:4692 wp_page_copy mm/memory.c:3291 [inline] do_wp_page+0x143b/0x2f80 mm/memory.c:3683 handle_pte_fault mm/memory.c:5396 [inline] __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0x1b92/0x2160 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x3f6/0x700 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:623 page last free pid 491 tgid 491 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_folios+0x79d/0x11c0 mm/page_alloc.c:2614 folios_put_refs+0x696/0x7b0 mm/swap.c:1024 free_pages_and_swap_cache+0x2e2/0x620 mm/swap_state.c:329 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x431/0x6f0 mm/mmu_gather.c:373 tlb_finish_mmu+0xd7/0x1f0 mm/mmu_gather.c:465 exit_mmap+0x48a/0xb00 mm/mmap.c:3354 __mmput+0x95/0x310 kernel/fork.c:1346 mmput+0x5a/0x70 kernel/fork.c:1368 exit_mm kernel/exit.c:565 [inline] do_exit+0xa8a/0x29c0 kernel/exit.c:861 do_group_exit+0x21b/0x2d0 kernel/exit.c:1023 __do_sys_exit_group kernel/exit.c:1034 [inline] __se_sys_exit_group kernel/exit.c:1032 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1032 x64_sys_call+0x273b/0x2cf0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x50/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e Memory state around the buggy address: ffff88811fc26f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88811fc26f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88811fc27000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811fc27080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811fc27100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_xattr_inode_iget:440: comm syz-executor: inode #1: comm syz-executor: iget: illegal inode # EXT4-fs error (device loop0): ext4_xattr_inode_iget:445: comm syz-executor: error while reading EA inode 1 err=-117 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_xattr_inode_iget:440: comm syz-executor: inode #1: comm syz-executor: iget: illegal inode # EXT4-fs error (device loop0): ext4_xattr_inode_iget:445: comm syz-executor: error while reading EA inode 1 err=-117