==================================================================
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2602 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x2f43/0x3fb0 fs/ext4/extents.c:2940
Read of size 4 at addr ffff8881264d2db8 by task syz-executor/462
CPU: 0 PID: 462 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
ext4_ext_rm_leaf fs/ext4/extents.c:2602 [inline]
ext4_ext_remove_space+0x2f43/0x3fb0 fs/ext4/extents.c:2940
ext4_ext_truncate+0x200/0x320 fs/ext4/extents.c:4470
ext4_truncate+0x9a6/0xf90 fs/ext4/inode.c:4291
ext4_evict_inode+0xcc3/0x1460 fs/ext4/inode.c:286
evict+0x493/0x890 fs/inode.c:708
iput_final fs/inode.c:1844 [inline]
iput+0x620/0x670 fs/inode.c:1870
do_unlinkat+0x375/0x6b0 fs/namei.c:4396
__do_sys_unlink fs/namei.c:4437 [inline]
__se_sys_unlink fs/namei.c:4435 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4435
x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd8b918df57
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbac55078 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b918df57
RDX: 00007fffbac550a0 RSI: 00007fffbac55130 RDI: 00007fffbac55130
RBP: 00007fffbac55130 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffbac56220
R13: 00007fd8b9210b55 R14: 000000000000cd65 R15: 00007fffbac572f0
The buggy address belongs to the physical page:
page:ffffea0004993480 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1264d2
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea00049934c8 ffffea0004993448 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x141cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_WRITE), pid 478, tgid 477 (syz.2.17), ts 52617873874, free_ts 52652864484
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2643
prep_new_page+0x1c/0x110 mm/page_alloc.c:2650
get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4554
__alloc_pages+0x1c3/0x450 mm/page_alloc.c:5868
__folio_alloc+0x12/0x40 mm/page_alloc.c:5900
__folio_alloc_node include/linux/gfp.h:245 [inline]
folio_alloc include/linux/gfp.h:274 [inline]
filemap_alloc_folio include/linux/pagemap.h:513 [inline]
__filemap_get_folio+0x6ec/0x980 mm/filemap.c:2018
pagecache_get_page+0x2b/0x110 mm/folio-compat.c:110
grab_cache_page_write_begin+0x43/0x60 mm/folio-compat.c:122
ext4_write_begin+0x24b/0xf70 fs/ext4/inode.c:1221
ext4_da_write_begin+0x3e1/0x8b0 fs/ext4/inode.c:3001
generic_perform_write+0x2f6/0x6d0 mm/filemap.c:3882
ext4_buffered_write_iter+0x36f/0x660 fs/ext4/file.c:285
ext4_file_write_iter+0x18f/0x13d0 fs/ext4/file.c:-1
call_write_iter include/linux/fs.h:2282 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5db/0xca0 fs/read_write.c:584
ksys_write+0x140/0x240 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:646
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1551 [inline]
free_pcp_prepare mm/page_alloc.c:1625 [inline]
free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3589
free_unref_page_list+0x112/0x8b0 mm/page_alloc.c:3740
release_pages+0xad1/0xb20 mm/swap.c:1047
__pagevec_release+0x71/0xe0 mm/swap.c:1067
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
truncate_inode_pages_range+0x309/0xcc0 mm/truncate.c:377
truncate_inode_pages mm/truncate.c:459 [inline]
truncate_pagecache+0x6c/0x90 mm/truncate.c:770
ext4_setattr+0xf9b/0x1a50 fs/ext4/inode.c:5627
notify_change+0xcc3/0xf80 fs/attr.c:499
do_truncate fs/open.c:66 [inline]
do_sys_ftruncate+0x58f/0x7f0 fs/open.c:194
__do_sys_ftruncate fs/open.c:205 [inline]
__se_sys_ftruncate fs/open.c:203 [inline]
__x64_sys_ftruncate+0x60/0x70 fs/open.c:203
x64_sys_call+0x2f9/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:78
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff8881264d2c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881264d2d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881264d2d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8881264d2e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881264d2e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs (loop2): unmounting filesystem.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 462 at fs/ext4/mballoc.c:1772 mb_free_blocks+0xe72/0x1290 fs/ext4/mballoc.c:1772
Modules linked in:
CPU: 0 PID: 462 Comm: syz-executor Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:mb_free_blocks+0xe72/0x1290 fs/ext4/mballoc.c:1772
Code: 54 f6 c7 ff 48 8b 33 48 8b bd 78 ff ff ff e8 e5 44 00 00 48 81 c4 a8 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 de 86 83 ff <0f> 0b eb e5 e8 d5 86 83 ff eb de 48 8b 85 60 ff ff ff 42 80 3c 28
RSP: 0018:ffffc90000b67480 EFLAGS: 00010293
RAX: ffffffff81ec9722 RBX: 0000000000000000 RCX: ffff88811a7de540
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000b67550 R08: dffffc0000000000 R09: ffffed102396b090
R10: ffffed102396b090 R11: 1ffff1102396b08f R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88811c96f000 R15: ffffc90000b67650
FS: 000055557c6d0500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557c6fb528 CR3: 0000000121562000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ext4_mb_clear_bb fs/ext4/mballoc.c:6115 [inline]
ext4_free_blocks+0x163a/0x2100 fs/ext4/mballoc.c:6268
ext4_remove_blocks fs/ext4/extents.c:2526 [inline]
ext4_ext_rm_leaf fs/ext4/extents.c:2692 [inline]
ext4_ext_remove_space+0x1b7d/0x3fb0 fs/ext4/extents.c:2940
ext4_ext_truncate+0x200/0x320 fs/ext4/extents.c:4470
ext4_truncate+0x9a6/0xf90 fs/ext4/inode.c:4291
ext4_evict_inode+0xcc3/0x1460 fs/ext4/inode.c:286
evict+0x493/0x890 fs/inode.c:708
iput_final fs/inode.c:1844 [inline]
iput+0x620/0x670 fs/inode.c:1870
do_unlinkat+0x375/0x6b0 fs/namei.c:4396
__do_sys_unlink fs/namei.c:4437 [inline]
__se_sys_unlink fs/namei.c:4435 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4435
x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd8b918df57
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbac55078 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b918df57
RDX: 00007fffbac550a0 RSI: 00007fffbac55130 RDI: 00007fffbac55130
RBP: 00007fffbac55130 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffbac56220
R13: 00007fd8b9210b55 R14: 000000000000d0c6 R15: 00007fffbac572f0
---[ end trace 0000000000000000 ]---
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 8192, count = 64
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 32720, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 32728
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 1360, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 1363
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 0, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 38655229952, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 38655229959, count = 9
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 9118354150032, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 9118354147656, count = 2377
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 9118354147648, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 201988076303840, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 201988076292607, count = 11240
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 201988076292592, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 144081268931456, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 144081268929085, count = 2376
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 11426331020240, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 11426330994278, count = 25974
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 11426330994272, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 125844460657104, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 125844460632169, count = 24941
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 125844460632160, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 53021913678480, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 53021913653296, count = 25185
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs (loop2): unmounting filesystem.
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 118057719421072, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 118057719396723, count = 24352
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 118057719396720, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 59615092198288, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 59615092172084, count = 26214
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 59615092172080, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 119221420194256, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 119221420165753, count = 28511
EXT4-fs error: 28481 callbacks suppressed
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 60684137289872, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 60684137275444, count = 14437
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 60684137275440, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 112589990710368, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 112589990684262, count = 26122
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 112589990684256, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 127961829531584, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 127961829501027, count = 30559
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 127961829501024, count = 16
EXT4-fs error (device loop2): ext4_free_blocks:6205: comm syz-executor: Freeing blocks not in datazone - block = 104876213190864, count = 16