ext4 filesystem being mounted at /0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
Read of size 4 at addr ffff88811621620c by task syz.3.410/2347
CPU: 0 PID: 2347 Comm: syz.3.410 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
ext4_ext_remove_space+0x2b6/0x3fb0 fs/ext4/extents.c:2834
ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4147
ext4_fallocate+0x2b6/0x1dd0 fs/ext4/extents.c:4761
vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
madvise_remove mm/madvise.c:1049 [inline]
madvise_vma_behavior mm/madvise.c:1073 [inline]
madvise_walk_vmas mm/madvise.c:1308 [inline]
do_madvise+0x12bf/0x2f50 mm/madvise.c:1487
__do_sys_madvise mm/madvise.c:1500 [inline]
__se_sys_madvise mm/madvise.c:1498 [inline]
__x64_sys_madvise+0xa9/0xc0 mm/madvise.c:1498
x64_sys_call+0x99e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:29
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f886fb8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8870b16038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f886fde5fa0 RCX: 00007f886fb8f749
RDX: 0000000000000009 RSI: 000000000060000b RDI: 0000200000000000
RBP: 00007f886fc13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f886fde6038 R14: 00007f886fde5fa0 R15: 00007ffdf877e488
Allocated by task 2194:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:379 [inline]
__kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:388
kasan_kmalloc include/linux/kasan.h:212 [inline]
__do_kmalloc_node mm/slab_common.c:938 [inline]
__kmalloc+0xb1/0x1e0 mm/slab_common.c:951
kmalloc include/linux/slab.h:568 [inline]
kzalloc include/linux/slab.h:699 [inline]
kobject_get_path+0xbf/0x200 lib/kobject.c:152
kobject_uevent_env+0x2a0/0x730 lib/kobject_uevent.c:544
kobject_uevent+0x1d/0x30 lib/kobject_uevent.c:657
rx_queue_add_kobject net/core/net-sysfs.c:1068 [inline]
net_rx_queue_update_kobjects+0x249/0x4d0 net/core/net-sysfs.c:1108
register_queue_kobjects net/core/net-sysfs.c:1768 [inline]
netdev_register_kobject+0x229/0x320 net/core/net-sysfs.c:2013
register_netdevice+0xe3d/0x14a0 net/core/dev.c:10168
veth_newlink+0x7a0/0xbe0 drivers/net/veth.c:1776
rtnl_newlink_create net/core/rtnetlink.c:3422 [inline]
__rtnl_newlink net/core/rtnetlink.c:3642 [inline]
rtnl_newlink+0x14b9/0x2030 net/core/rtnetlink.c:3655
rtnetlink_rcv_msg+0x9f4/0xcf0 net/core/rtnetlink.c:6153
netlink_rcv_skb+0x1f2/0x440 net/netlink/af_netlink.c:2521
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6171
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x8ab/0xa30 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x8aa/0xbc0 net/netlink/af_netlink.c:1873
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
__sys_sendto+0x464/0x5e0 net/socket.c:2143
__do_sys_sendto net/socket.c:2155 [inline]
__se_sys_sendto net/socket.c:2151 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:2151
x64_sys_call+0x83/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:45
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
__call_rcu_common kernel/rcu/tree.c:2807 [inline]
call_rcu+0xd4/0xf90 kernel/rcu/tree.c:2926
nf_hook_entries_free net/netfilter/core.c:94 [inline]
__nf_unregister_net_hook+0x4a7/0x610 net/netfilter/core.c:520
nf_unregister_net_hook net/netfilter/core.c:-1 [inline]
nf_unregister_net_hooks+0xe2/0x150 net/netfilter/core.c:607
ip6t_unregister_table_pre_exit+0x7c/0xb0 net/ipv6/netfilter/ip6_tables.c:1805
ip6table_filter_net_pre_exit+0x1c/0x20 net/ipv6/netfilter/ip6table_filter.c:63
ops_pre_exit_list net/core/net_namespace.c:162 [inline]
cleanup_net+0x4c0/0xb00 net/core/net_namespace.c:592
process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Second to last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
__call_rcu_common kernel/rcu/tree.c:2807 [inline]
call_rcu+0xd4/0xf90 kernel/rcu/tree.c:2926
nf_hook_entries_free net/netfilter/core.c:94 [inline]
__nf_register_net_hook+0x693/0x820 net/netfilter/core.c:451
nf_register_net_hook+0xbb/0x1a0 net/netfilter/core.c:572
nf_register_net_hooks+0x47/0x1b0 net/netfilter/core.c:588
ipt_register_table+0x50c/0x7a0 net/ipv4/netfilter/ip_tables.c:1783
iptable_mangle_table_init+0x41/0x60 net/ipv4/netfilter/iptable_mangle.c:91
xt_find_table_lock+0x2b6/0x410 net/netfilter/x_tables.c:1259
xt_request_find_table_lock+0x27/0x100 net/netfilter/x_tables.c:1284
get_info net/ipv4/netfilter/ip_tables.c:965 [inline]
do_ipt_get_ctl+0x6d7/0x10e0 net/ipv4/netfilter/ip_tables.c:1661
nf_getsockopt+0x27f/0x2a0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x148/0x1d0 net/ipv4/ip_sockglue.c:1826
tcp_getsockopt+0xff/0x130 net/ipv4/tcp.c:4459
sock_common_getsockopt+0xaa/0xc0 net/core/sock.c:3676
__sys_getsockopt+0x215/0x4a0 net/socket.c:2322
__do_sys_getsockopt net/socket.c:2337 [inline]
__se_sys_getsockopt net/socket.c:2334 [inline]
__x64_sys_getsockopt+0xbf/0xd0 net/socket.c:2334
x64_sys_call+0x3d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:56
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
The buggy address belongs to the object at ffff888116216200
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 12 bytes inside of
64-byte region [ffff888116216200, ffff888116216240)
The buggy address belongs to the physical page:
page:ffffea0004588580 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116216b00 pfn:0x116216
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea000400e7c8 ffffea00044f06c8 ffff888100042780
raw: ffff888116216b00 0000000000200016 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 488, tgid 488 (syz-executor), ts 47275742285, free_ts 47188657446
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2643
prep_new_page+0x1c/0x110 mm/page_alloc.c:2650
get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4554
__alloc_pages+0x1c3/0x450 mm/page_alloc.c:5868
alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
allocate_slab mm/slub.c:1967 [inline]
new_slab+0x98/0x3d0 mm/slub.c:2020
___slab_alloc+0x6bd/0xb20 mm/slub.c:3177
__slab_alloc+0x5e/0xa0 mm/slub.c:3263
slab_alloc_node mm/slub.c:3348 [inline]
__kmem_cache_alloc_node+0x203/0x2c0 mm/slub.c:3423
kmalloc_trace+0x29/0xb0 mm/slab_common.c:1028
kmalloc include/linux/slab.h:563 [inline]
call_modprobe kernel/kmod.c:79 [inline]
__request_module+0x273/0x890 kernel/kmod.c:170
__rtnl_newlink net/core/rtnetlink.c:3631 [inline]
rtnl_newlink+0xa7e/0x2030 net/core/rtnetlink.c:3655
rtnetlink_rcv_msg+0x9f4/0xcf0 net/core/rtnetlink.c:6153
netlink_rcv_skb+0x1f2/0x440 net/netlink/af_netlink.c:2521
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6171
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x8ab/0xa30 net/netlink/af_netlink.c:1345
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1551 [inline]
free_pcp_prepare mm/page_alloc.c:1625 [inline]
free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3589
free_unref_page+0x8f/0x530 mm/page_alloc.c:3687
free_the_page mm/page_alloc.c:836 [inline]
__free_pages+0x67/0x100 mm/page_alloc.c:5957
free_pages+0x82/0x90 mm/page_alloc.c:5968
tlb_batch_list_free mm/mmu_gather.c:75 [inline]
tlb_finish_mmu+0x2ba/0x370 mm/mmu_gather.c:364
exit_mmap+0x3da/0xbb0 mm/mmap.c:3384
__mmput+0x93/0x360 kernel/fork.c:1309
mmput+0x4b/0x150 kernel/fork.c:1333
exit_mm kernel/exit.c:568 [inline]
do_exit+0x981/0x2650 kernel/exit.c:873
do_group_exit+0x210/0x2d0 kernel/exit.c:1028
__do_sys_exit_group kernel/exit.c:1039 [inline]
__se_sys_exit_group kernel/exit.c:1037 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1037
x64_sys_call+0x7b4/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff888116216100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888116216180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888116216200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888116216280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888116216300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:3187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2347 Comm: syz.3.410 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:ext4_split_extent_at+0xf3f/0xf60 fs/ext4/extents.c:3187
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 45 fb ff ff 4c 89 f7 49 89 f7 e8 1e 63 d0 ff 4c 89 fe e9 32 fb ff ff e8 f1 e8 8b ff <0f> 0b e8 ea e8 8b ff 0f 0b e8 e3 e8 8b ff 0f 0b e8 dc e8 8b ff 0f
RSP: 0018:ffffc90003d273e0 EFLAGS: 00010293
RAX: ffffffff81e440cf RBX: 0000000000000000 RCX: ffff8881100e5100
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000002c
RBP: ffffc90003d27550 R08: 0000000000000000 R09: 0000000050000028
R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88812cd90a00
FS: 00007f8870b166c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f02e3799000 CR3: 0000000129702000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ext4_force_split_extent_at fs/ext4/extents.c:338 [inline]
ext4_ext_remove_space+0x349d/0x3fb0 fs/ext4/extents.c:2881
ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4147
ext4_fallocate+0x2b6/0x1dd0 fs/ext4/extents.c:4761
vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
madvise_remove mm/madvise.c:1049 [inline]
madvise_vma_behavior mm/madvise.c:1073 [inline]
madvise_walk_vmas mm/madvise.c:1308 [inline]
do_madvise+0x12bf/0x2f50 mm/madvise.c:1487
__do_sys_madvise mm/madvise.c:1500 [inline]
__se_sys_madvise mm/madvise.c:1498 [inline]
__x64_sys_madvise+0xa9/0xc0 mm/madvise.c:1498
x64_sys_call+0x99e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:29
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f886fb8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8870b16038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f886fde5fa0 RCX: 00007f886fb8f749
RDX: 0000000000000009 RSI: 000000000060000b RDI: 0000200000000000
RBP: 00007f886fc13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f886fde6038 R14: 00007f886fde5fa0 R15: 00007ffdf877e488
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_split_extent_at+0xf3f/0xf60 fs/ext4/extents.c:3187
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 45 fb ff ff 4c 89 f7 49 89 f7 e8 1e 63 d0 ff 4c 89 fe e9 32 fb ff ff e8 f1 e8 8b ff <0f> 0b e8 ea e8 8b ff 0f 0b e8 e3 e8 8b ff 0f 0b e8 dc e8 8b ff 0f
RSP: 0018:ffffc90003d273e0 EFLAGS: 00010293
RAX: ffffffff81e440cf RBX: 0000000000000000 RCX: ffff8881100e5100
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000002c
RBP: ffffc90003d27550 R08: 0000000000000000 R09: 0000000050000028
R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88812cd90a00
FS: 00007f8870b166c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000010000 CR3: 0000000129702000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400