================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504 Read of size 1 at addr ffff8881d7bd76e3 by task syz-executor.3/442 CPU: 1 PID: 442 Comm: syz-executor.3 Not tainted 5.4.268-syzkaller-04882-g51cf29fc2bfc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1698 __ext4_find_entry+0x2a9/0x1b50 fs/ext4/namei.c:1577 ext4_lookup_entry fs/ext4/namei.c:1730 [inline] ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1798 lookup_open fs/namei.c:3308 [inline] do_last fs/namei.c:3421 [inline] path_openat+0x159a/0x3480 fs/namei.c:3634 do_filp_open+0x20b/0x450 fs/namei.c:3664 do_sys_open+0x39c/0x810 fs/open.c:1113 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 The buggy address belongs to the page: page:ffffea00075ef5c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 flags: 0x8000000000000000() raw: 8000000000000000 ffffea00075ef608 ffffea00075ef588 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffff8881d7bd7580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881d7bd7600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881d7bd7680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881d7bd7700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881d7bd7780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs error (device loop3): ext4_find_dest_de:2063: inode #12: block 5: comm syz-executor.3: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=1375716473, rec_len=40042, size=56 fake=0