EXT4-fs error (device loop3): ext4_xattr_inode_iget:389: comm syz.3.19: inode #1: comm syz.3.19: iget: illegal inode #
EXT4-fs error (device loop3): ext4_xattr_inode_iget:394: comm syz.3.19: error while reading EA inode 1 err=-117
EXT4-fs (loop3): 1 orphan inode deleted
EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue
==================================================================
BUG: KASAN: use-after-free in add_dirent_to_buf+0x2a1/0x650 fs/ext4/namei.c:2025
Write of size 251 at addr ffff8881d4bddf14 by task syz.3.19/3236

CPU: 1 PID: 3236 Comm: syz.3.19 Not tainted 5.8.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x7c/0xb0 lib/dump_stack.c:118
 print_address_description.constprop.8.cold.10+0x9/0x456 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold.11+0x1f/0x37 mm/kasan/report.c:530
 check_memory_region_inline mm/kasan/generic.c:186 [inline]
 check_memory_region+0x1c1/0x1e0 mm/kasan/generic.c:192
 memcpy+0x38/0x60 mm/kasan/common.c:106
 add_dirent_to_buf+0x2a1/0x650 fs/ext4/namei.c:2025
 make_indexed_dir+0x98d/0xc90 fs/ext4/namei.c:2153
 ext4_add_entry+0x8f2/0xb50 fs/ext4/namei.c:2260
 ext4_add_nondir+0x8a/0x220 fs/ext4/namei.c:2589
 ext4_symlink+0x70d/0xca0 fs/ext4/namei.c:3382
 vfs_symlink fs/namei.c:3953 [inline]
 vfs_symlink+0x2d6/0x4c0 fs/namei.c:3939
 do_symlinkat+0x176/0x1b0 fs/namei.c:3980
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f857348d169
Code: Bad RIP value.
RSP: 002b:00007f8572eff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 00007f85736a5fa0 RCX: 00007f857348d169
RDX: 0000000000000000 RSI: 0000400000000cc0 RDI: 0000400000000dc0
RBP: 00007f857350e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f85736a5fa0 R15: 00007ffc7f810ab8

The buggy address belongs to the page:
page:ffffea000752f740 refcount:3 mapcount:0 mapping:000000007786cc22 index:0x3f
mapping->a_ops:def_blk_aops
flags: 0x10000000000202a(referenced|dirty|active|private)
raw: 010000000000202a dead000000000100 dead000000000122 ffff8881ede26e20
raw: 000000000000003f ffff8881d81c8d98 00000003ffffffff ffff8881ddcdc000
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8881ddcdc000
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2218 [inline]
 prep_new_page+0x21e/0x320 mm/page_alloc.c:2224
 get_page_from_freelist+0x110e/0x4610 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x278/0x710 mm/page_alloc.c:4844
 pagecache_get_page+0x15e/0x510 mm/filemap.c:1642
 find_or_create_page include/linux/pagemap.h:348 [inline]
 grow_dev_page fs/buffer.c:975 [inline]
 grow_buffers fs/buffer.c:1044 [inline]
 __getblk_slow fs/buffer.c:1071 [inline]
 __getblk_gfp+0x1dd/0x800 fs/buffer.c:1355
 sb_getblk include/linux/buffer_head.h:325 [inline]
 ext4_getblk+0x123/0x3b0 fs/ext4/inode.c:840
 ext4_bread+0x5a/0x280 fs/ext4/inode.c:883
 ext4_append+0x132/0x330 fs/ext4/namei.c:67
 make_indexed_dir+0x265/0xc90 fs/ext4/namei.c:2096
 ext4_add_entry+0x8f2/0xb50 fs/ext4/namei.c:2260
 ext4_add_nondir+0x8a/0x220 fs/ext4/namei.c:2589
 ext4_symlink+0x70d/0xca0 fs/ext4/namei.c:3382
 vfs_symlink fs/namei.c:3953 [inline]
 vfs_symlink+0x2d6/0x4c0 fs/namei.c:3939
 do_symlinkat+0x176/0x1b0 fs/namei.c:3980
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1213 [inline]
 free_pcp_prepare+0x3d8/0x4c0 mm/page_alloc.c:1248
 free_unref_page_prepare mm/page_alloc.c:3098 [inline]
 free_unref_page_list+0xd4/0x4f0 mm/page_alloc.c:3167
 release_pages+0x980/0x1200 mm/swap.c:911
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
 tlb_flush_mmu+0xc1/0x540 mm/mmu_gather.c:249
 tlb_finish_mmu+0x84/0x370 mm/mmu_gather.c:328
 exit_mmap+0x26d/0x450 mm/mmap.c:3152
 __mmput kernel/fork.c:1093 [inline]
 mmput+0xcd/0x3a0 kernel/fork.c:1114
 exit_mm kernel/exit.c:482 [inline]
 do_exit+0x8c6/0x28e0 kernel/exit.c:792
 do_group_exit+0xeb/0x2d0 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x35/0x40 kernel/exit.c:912
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881d4bddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881d4bddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881d4bde000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff8881d4bde080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881d4bde100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================