================================================================== BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2627 [inline] BUG: KASAN: use-after-free in ext4_ext_remove_space+0x276c/0x37c8 fs/ext4/extents.c:2965 Read of size 4 at addr ffff0000eb4f7c18 by task syz-executor/7255 CPU: 1 UID: 0 PID: 7255 Comm: syz-executor Not tainted 6.16.0-rc7-syzkaller-00099-g82af5ea7c611 #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x220 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:480 kasan_report+0xb0/0x110 mm/kasan/report.c:593 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 ext4_ext_rm_leaf fs/ext4/extents.c:2627 [inline] ext4_ext_remove_space+0x276c/0x37c8 fs/ext4/extents.c:2965 ext4_ext_truncate+0x134/0x1d0 fs/ext4/extents.c:4484 ext4_truncate+0x9c4/0xfe0 fs/ext4/inode.c:4574 ext4_evict_inode+0x9b4/0x104c fs/ext4/inode.c:261 evict+0x414/0x928 fs/inode.c:810 iput_final fs/inode.c:1898 [inline] iput+0x6e4/0x83c fs/inode.c:1924 do_unlinkat+0x338/0x4dc fs/namei.c:4666 __do_sys_unlinkat fs/namei.c:4700 [inline] __se_sys_unlinkat fs/namei.c:4693 [inline] __arm64_sys_unlinkat+0xdc/0xf8 fs/namei.c:4693 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff84a53 pfn:0x12b4f7 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffdffc3810748 fffffdffc3ad1048 0000000000000000 raw: 0000000ffff84a53 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000eb4f7b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000eb4f7b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000eb4f7c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000eb4f7c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000eb4f7d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 273782572858304, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 273782572851170, count = 7137 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 272815534122992, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 272815534121981, count = 1021 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 272815534121968, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 258592800269856, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 258592800244265, count = 25599 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 30787360, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 30787360, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 665719930944, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 35960128, count = 0 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 1 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 10158080, count = 64 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 2014339661824, count = 18208 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081187984, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081161784, count = 26214 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081161776, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 35615789060944, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 35615789052718, count = 8240 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 35615789052704, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 52983528372272, count = 14438 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 52983528372272, count = 16 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 125844310049456, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 125844310025057, count = 24415 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 125844310025056, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111266315333216, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111266315318838, count = 14384 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111266315318832, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 125779835276384, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 125779835250186, count = 26214 EXT4-fs error: 78773 callbacks suppressed EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 55471422009951, count = 26215 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 55471422009936, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 58489673116304, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 58489673101924, count = 14384 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 58489673101920, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111550608623456, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111550608598538, count = 24932 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 111550608598528, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112594486514400, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112594486506099, count = 8308 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 64 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 2014339679024, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 2014339661824, count = 17208 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 4, count = 64 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16 EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081702608, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081699942, count = 2676 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112589081699936, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 122515643749584, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 122515643725156, count = 24441 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 122515643725152, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112386952618640, count = 16 EXT4-fs error (device loop0): ext4_free_blocks:6587: comm syz-executor: Freeing blocks not in datazone - block = 112386952605750, count = 12902