================================================================== BUG: KASAN: out-of-bounds in ext4_ext_split fs/ext4/extents.c:1154 [inline] BUG: KASAN: out-of-bounds in ext4_ext_create_new_leaf fs/ext4/extents.c:1414 [inline] BUG: KASAN: out-of-bounds in ext4_ext_insert_extent+0x204f/0x4530 fs/ext4/extents.c:2098 Read of size 18446744069088878608 at addr ffff88811369dffc by task syz-executor.5/4386 CPU: 0 PID: 4386 Comm: syz-executor.5 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x169/0x1d8 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0xe2/0x130 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x280/0x290 mm/kasan/generic.c:189 memmove+0x2d/0x70 mm/kasan/shadow.c:54 ext4_ext_split fs/ext4/extents.c:1154 [inline] ext4_ext_create_new_leaf fs/ext4/extents.c:1414 [inline] ext4_ext_insert_extent+0x204f/0x4530 fs/ext4/extents.c:2098 ext4_ext_map_blocks+0x17b5/0x5d80 fs/ext4/extents.c:4356 ext4_map_blocks+0x978/0x1bc0 fs/ext4/inode.c:674 _ext4_get_block+0x1bb/0x4b0 fs/ext4/inode.c:817 ext4_get_block_unwritten+0x2a/0x40 fs/ext4/inode.c:848 ext4_block_write_begin+0x567/0x1330 fs/ext4/inode.c:1101 ext4_write_begin+0x651/0x15a0 fs/ext4/ext4_jbd2.h:-1 ext4_da_write_begin+0x455/0xe80 fs/ext4/inode.c:3033 generic_perform_write+0x2be/0x510 mm/filemap.c:3509 ext4_buffered_write_iter+0x4b8/0x640 fs/ext4/file.c:271 ext4_file_write_iter+0x536/0x1980 fs/ext4/file.c:-1 call_write_iter include/linux/fs.h:2066 [inline] new_sync_write fs/read_write.c:518 [inline] vfs_write+0x725/0xd60 fs/read_write.c:605 ksys_write+0x140/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:667 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fccca2128d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fccc9d950c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fccca331f80 RCX: 00007fccca2128d9 RDX: 000000000208e24b RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007fccca26ead0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fccca331f80 R15: 00007ffda87e5578 The buggy address belongs to the page: page:ffffea00044da740 refcount:2 mapcount:0 mapping:ffff888110768b10 index:0x80 pfn:0x11369d aops:def_blk_aops ino:0 flags: 0x4000000000022036(referenced|uptodate|lru|active|private|mappedtodisk) raw: 4000000000022036 ffffea00043e5448 ffffea000482d988 ffff888110768b10 raw: 0000000000000080 ffff88812617e348 00000002ffffffff ffff888100140000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff888100140000 page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 371, ts 126863073683, free_ts 126763435723 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x179/0x180 mm/page_alloc.c:2462 get_page_from_freelist+0x2235/0x23d0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x268/0x5f0 mm/page_alloc.c:5370 __alloc_pages include/linux/gfp.h:544 [inline] __alloc_pages_node include/linux/gfp.h:557 [inline] alloc_pages_node include/linux/gfp.h:571 [inline] alloc_pages include/linux/gfp.h:590 [inline] __page_cache_alloc include/linux/pagemap.h:290 [inline] page_cache_ra_unbounded+0x2c8/0x7d0 mm/readahead.c:226 do_page_cache_ra mm/readahead.c:277 [inline] force_page_cache_ra+0x3a9/0x400 mm/readahead.c:308 page_cache_sync_ra+0x237/0x2a0 mm/readahead.c:582 page_cache_sync_readahead include/linux/pagemap.h:837 [inline] generic_file_buffered_read+0x55b/0x2730 mm/filemap.c:2250 generic_file_read_iter+0x116/0x560 mm/filemap.c:2568 blkdev_read_iter+0x12f/0x160 fs/block_dev.c:1956 call_read_iter include/linux/fs.h:2060 [inline] new_sync_read fs/read_write.c:415 [inline] vfs_read+0x874/0xa10 fs/read_write.c:496 ksys_read+0x140/0x240 fs/read_write.c:634 __do_sys_read fs/read_write.c:644 [inline] __se_sys_read fs/read_write.c:642 [inline] __x64_sys_read+0x7b/0x90 fs/read_write.c:642 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] free_pcp_prepare mm/page_alloc.c:1421 [inline] free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336 free_unref_page_list+0x12e/0x9b0 mm/page_alloc.c:3443 release_pages+0xe38/0xe80 mm/swap.c:1103 __pagevec_release+0x71/0xe0 mm/swap.c:1123 pagevec_release include/linux/pagevec.h:88 [inline] __invalidate_mapping_pages+0x887/0x920 mm/truncate.c:607 invalidate_mapping_pages+0x27/0x30 mm/truncate.c:632 invalidate_bdev+0xa3/0x140 fs/block_dev.c:97 ext4_put_super+0x669/0x9c0 fs/ext4/super.c:1237 generic_shutdown_super+0x149/0x320 fs/super.c:465 kill_block_super+0x7f/0xf0 fs/super.c:1469 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x446/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 Memory state around the buggy address: ffff88811369de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88811369df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88811369df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff88811369e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811369e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ================================================================== general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 4386 Comm: syz-executor.5 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__rb_insert lib/rbtree.c:115 [inline] RIP: 0010:rb_insert_color+0xa6/0x6e0 lib/rbtree.c:436 Code: 4c 8b 3b 41 f6 c7 01 0f 85 11 06 00 00 4c 89 75 b8 4c 89 65 d0 4d 8d 67 08 4d 89 e5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 4c 89 e7 e8 aa 4e 46 ff 4d 8b 34 24 49 39 RSP: 0018:ffffc90002816700 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: ffff888110c73010 RCX: dffffc0000000000 RDX: 0000000000000010 RSI: ffff8881f71561f0 RDI: ffff888123ebbc10 RBP: ffffc90002816758 R08: dffffc0000000000 R09: ffff888123ebbc18 R10: ffffed10247d7785 R11: 1ffff110247d7783 R12: 0000000000000008 R13: 0000000000000001 R14: 1ffff1102218e602 R15: 0000000000000000 FS: 00007fccc9d956c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff11442f98 CR3: 000000011ef72000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rb_insert_color_cached include/linux/rbtree.h:141 [inline] __enqueue_entity kernel/sched/fair.c:606 [inline] put_prev_entity+0x225/0x460 kernel/sched/fair.c:4769 pick_next_task_fair+0x694/0xa30 kernel/sched/fair.c:7466 pick_next_task kernel/sched/core.c:4622 [inline] __schedule+0x4c5/0x1310 kernel/sched/core.c:4773 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:5067 irqentry_exit_cond_resched kernel/entry/common.c:365 [inline] irqentry_exit+0x56/0x60 kernel/entry/common.c:395 sysvec_apic_timer_interrupt+0xcb/0xe0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:64 Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 RSP: 0018:ffffc90002816b30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: fffffffffff9efe4 RCX: ffffffffffd36d71 RDX: fffffffffff9efe4 RSI: 0000000000000000 RDI: ffff888110ded28f RBP: ffffc90002816b50 R08: ffff888110b24000 R09: ffff888110b8501c R10: fffffbfff0d8f048 R11: 1ffffffff0d8f048 R12: ffff88810de28018 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888110b8501c ext4_ext_split fs/ext4/extents.c:1161 [inline] ext4_ext_create_new_leaf fs/ext4/extents.c:1414 [inline] ext4_ext_insert_extent+0x2344/0x4530 fs/ext4/extents.c:2098 ext4_ext_map_blocks+0x17b5/0x5d80 fs/ext4/extents.c:4356 ext4_map_blocks+0x978/0x1bc0 fs/ext4/inode.c:674 _ext4_get_block+0x1bb/0x4b0 fs/ext4/inode.c:817 ext4_get_block_unwritten+0x2a/0x40 fs/ext4/inode.c:848 ext4_block_write_begin+0x567/0x1330 fs/ext4/inode.c:1101 ext4_write_begin+0x651/0x15a0 fs/ext4/ext4_jbd2.h:-1 ext4_da_write_begin+0x455/0xe80 fs/ext4/inode.c:3033 generic_perform_write+0x2be/0x510 mm/filemap.c:3509 ext4_buffered_write_iter+0x4b8/0x640 fs/ext4/file.c:271 ext4_file_write_iter+0x536/0x1980 fs/ext4/file.c:-1 call_write_iter include/linux/fs.h:2066 [inline] new_sync_write fs/read_write.c:518 [inline] vfs_write+0x725/0xd60 fs/read_write.c:605 ksys_write+0x140/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:667 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fccca2128d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fccc9d950c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fccca331f80 RCX: 00007fccca2128d9 RDX: 000000000208e24b RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007fccca26ead0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fccca331f80 R15: 00007ffda87e5578 Modules linked in: ---[ end trace d72a12ca00cc8519 ]--- RIP: 0010:__rb_insert lib/rbtree.c:115 [inline] RIP: 0010:rb_insert_color+0xa6/0x6e0 lib/rbtree.c:436 Code: 4c 8b 3b 41 f6 c7 01 0f 85 11 06 00 00 4c 89 75 b8 4c 89 65 d0 4d 8d 67 08 4d 89 e5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 4c 89 e7 e8 aa 4e 46 ff 4d 8b 34 24 49 39 RSP: 0018:ffffc90002816700 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: ffff888110c73010 RCX: dffffc0000000000 RDX: 0000000000000010 RSI: ffff8881f71561f0 RDI: ffff888123ebbc10 RBP: ffffc90002816758 R08: dffffc0000000000 R09: ffff888123ebbc18 R10: ffffed10247d7785 R11: 1ffff110247d7783 R12: 0000000000000008 R13: 0000000000000001 R14: 1ffff1102218e602 R15: 0000000000000000 FS: 00007fccc9d956c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff11442f98 CR3: 000000011ef72000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 4c 8b 3b mov (%rbx),%r15 3: 41 f6 c7 01 test $0x1,%r15b 7: 0f 85 11 06 00 00 jne 0x61e d: 4c 89 75 b8 mov %r14,-0x48(%rbp) 11: 4c 89 65 d0 mov %r12,-0x30(%rbp) 15: 4d 8d 67 08 lea 0x8(%r15),%r12 19: 4d 89 e5 mov %r12,%r13 1c: 49 c1 ed 03 shr $0x3,%r13 20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 27: fc ff df * 2a: 41 80 7c 05 00 00 cmpb $0x0,0x0(%r13,%rax,1) <-- trapping instruction 30: 74 08 je 0x3a 32: 4c 89 e7 mov %r12,%rdi 35: e8 aa 4e 46 ff call 0xff464ee4 3a: 4d 8b 34 24 mov (%r12),%r14 3e: 49 rex.WB 3f: 39 .byte 0x39