syzbot

 sign-in | mailing list | source | docs
🐞 Open [1578]
≡ Subsystems
🐞 Fixed [6330]
🐞 Invalid [16123]
⬇ Missing Backports [191]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: slab-use-after-free Read in ext4_ext_insert_extent

Status: auto-obsoleted due to no activity on 2024/02/09 07:34
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+f84cd89a0edee61c1a21@syzkaller.appspotmail.com
First crash: 593d, last: 593d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ext4_ext_insert_extent ext4 C done 5 14d 31d 0/29 upstream: reported C repro on 2025/05/25 18:12
linux-5.15 KASAN: use-after-free Read in ext4_ext_insert_extent 1 417d 417d 0/3 auto-obsoleted due to no activity on 2024/08/13 04:16
android-5-10 KASAN: use-after-free Read in ext4_ext_insert_extent syz 2 19d 104d 0/2 premoderation: reported syz repro on 2025/03/14 06:10
android-5-15 KASAN: use-after-free Read in ext4_ext_insert_extent origin:lts syz 1 6d10h 6d10h 0/2 premoderation: reported syz repro on 2025/06/20 07:17

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x2b8b/0x4f00 fs/ext4/extents.c:2156
Read of size 243660 at addr ffff8880227bc854 by task syz-executor.5/8776

CPU: 1 PID: 8776 Comm: syz-executor.5 Not tainted 6.6.0-syzkaller-16039-gac347a0655db #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0x163/0x540 mm/kasan/report.c:475
 kasan_report+0x142/0x170 mm/kasan/report.c:588
 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:187
 __asan_memmove+0x29/0x70 mm/kasan/shadow.c:94
 ext4_ext_insert_extent+0x2b8b/0x4f00 fs/ext4/extents.c:2156
 ext4_ext_map_blocks+0x207c/0x7150 fs/ext4/extents.c:4306
 ext4_map_blocks+0xa2f/0x1cb0 fs/ext4/inode.c:621
 _ext4_get_block+0x238/0x6a0 fs/ext4/inode.c:763
 ext4_block_write_begin+0x537/0x1840 fs/ext4/inode.c:1053
 ext4_write_begin+0x619/0x10b0
 generic_perform_write+0x31b/0x630 mm/filemap.c:3918
 ext4_buffered_write_iter+0xc6/0x350 fs/ext4/file.c:299
 ext4_file_write_iter+0x1dc/0x19b0
 call_write_iter include/linux/fs.h:2020 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x792/0xb20 fs/read_write.c:584
 ksys_write+0x1a0/0x2c0 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7efcd3e7cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efcd29fe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007efcd3f9bf80 RCX: 00007efcd3e7cae9
RDX: 00000000fffffd9d RSI: 0000000020000440 RDI: 0000000000000008
RBP: 00007efcd3ec847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007efcd3f9bf80 R15: 00007ffedbd179f8
 </TASK>

The buggy address belongs to the physical page:
page:ffffea000089ef00 refcount:3 mapcount:1 mapping:ffff88801b0c1f78 index:0x3e pfn:0x227bc
memcg:ffff888026d86000
aops:def_blk_aops ino:700005
flags: 0xfff0000002813c(referenced|uptodate|dirty|lru|active|private|mappedtodisk|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0x0()
raw: 00fff0000002813c ffffea0000c8f548 ffffea0000801888 ffff88801b0c1f78
raw: 000000000000003e ffff88808100d658 0000000300000000 ffff888026d86000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 8772, tgid 8772 (syz-executor.5), ts 2332075647520, free_ts 2330096080070
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1537
 prep_new_page mm/page_alloc.c:1544 [inline]
 get_page_from_freelist+0x339a/0x3530 mm/page_alloc.c:3312
 __alloc_pages+0x255/0x670 mm/page_alloc.c:4568
 alloc_pages_mpol+0x3de/0x640 mm/mempolicy.c:2133
 alloc_pages mm/mempolicy.c:2204 [inline]
 folio_alloc+0x12a/0x330 mm/mempolicy.c:2211
 filemap_alloc_folio+0xde/0x500 mm/filemap.c:974
 page_cache_ra_unbounded+0x1f2/0x7c0 mm/readahead.c:247
 do_async_mmap_readahead mm/filemap.c:3169 [inline]
 filemap_fault+0x74a/0x1670 mm/filemap.c:3223
 __do_fault+0x133/0x4e0 mm/memory.c:4265
 do_shared_fault mm/memory.c:4692 [inline]
 do_fault mm/memory.c:4766 [inline]
 do_pte_missing mm/memory.c:3730 [inline]
 handle_pte_fault mm/memory.c:5038 [inline]
 __handle_mm_fault mm/memory.c:5179 [inline]
 handle_mm_fault+0x21d7/0x6650 mm/memory.c:5344
 do_user_addr_fault arch/x86/mm/fault.c:1364 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x455/0x860 arch/x86/mm/fault.c:1561
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1137 [inline]
 free_unref_page_prepare+0x92a/0xa50 mm/page_alloc.c:2347
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:234 [inline]
 pipe_read+0x6ee/0x13e0 fs/pipe.c:354
 call_read_iter include/linux/fs.h:2014 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x78b/0xb00 fs/read_write.c:470
 ksys_read+0x1a0/0x2c0 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:
 ffff8880227bcf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880227bcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880227bd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8880227bd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff8880227bd100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/11 07:34 upstream ac347a0655db d80eec66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ext4_ext_insert_extent
* Struck through repros no longer work on HEAD.