KASAN: slab-out-of-bounds Write in ext4_expand_extra_isize_ea

Status: upstream: reported C repro on 2026/07/18 10:47
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+d5291b745ca3a19ad2d6@syzkaller.appspotmail.com
First crash: 6d13h, last: 6d09h
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/07/22 lts (merge base) c86c4726e7f0 C [report] lost connection to test machine
2026/07/22 upstream (ToT) 248951ddc14d C [report] lost connection to test machine
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 KASAN: use-after-free Write in ext4_expand_extra_isize_ea 22 1 95d 95d 0/2 auto-obsoleted due to no activity on 2026/07/19 13:41

Sample crash report:
EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.2274: bg 0: block 144: padding at end of block bitmap is not set
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
BUG: KASAN: use-after-free in ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
Write of size 72 at addr ffff88811cdc73a0 by task syz.6.2274/9006

CPU: 1 PID: 9006 Comm: syz.6.2274 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 memmove+0x44/0x70 mm/kasan/shadow.c:55
 ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
 ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
 __ext4_expand_extra_isize+0x2fe/0x3e0 fs/ext4/inode.c:5955
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
 __ext4_mark_inode_dirty+0x39d/0x5e0 fs/ext4/inode.c:6076
 ext4_dirty_inode+0xbd/0x100 fs/ext4/inode.c:6108
 __mark_inode_dirty+0x1ef/0x9c0 fs/fs-writeback.c:2486
 generic_update_time fs/inode.c:1891 [inline]
 inode_update_time fs/inode.c:1904 [inline]
 touch_atime+0x333/0x500 fs/inode.c:1976
 file_accessed include/linux/fs.h:2566 [inline]
 filemap_read+0x1fa8/0x21e0 mm/filemap.c:2737
 generic_file_read_iter+0xac/0x420 mm/filemap.c:2816
 ext4_file_read_iter+0x2e8/0x500 fs/ext4/file.c:-1
 call_read_iter include/linux/fs.h:2206 [inline]
 generic_file_splice_read+0x3ea/0x5f0 fs/splice.c:311
 do_splice_to fs/splice.c:796 [inline]
 splice_direct_to_actor+0x40f/0xb40 fs/splice.c:870
 do_splice_direct+0x1c2/0x2d0 fs/splice.c:979
 do_sendfile+0x515/0xe20 fs/read_write.c:1249
 __do_sys_sendfile64 fs/read_write.c:1317 [inline]
 __se_sys_sendfile64 fs/read_write.c:1303 [inline]
 __x64_sys_sendfile64+0x199/0x1f0 fs/read_write.c:1303
 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d1c019e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1be7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f5d1c2a1fa0 RCX: 00007f5d1c019e99
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 00007f5d1c0afeaf R08: 0000000000000000 R09: 0000000000000000
R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5d1c2a2038 R14: 00007f5d1c2a1fa0 R15: 00007ffc90540dd8
 </TASK>

The buggy address belongs to the page:
page:ffffea00047371c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cdc7
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004c47bc8 ffffea0004c49948 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 379, ts 410440801058, free_ts 410559723322
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 __get_free_pages+0x10/0x30 mm/page_alloc.c:5861
 _pgd_alloc arch/x86/mm/pgtable.c:414 [inline]
 pgd_alloc+0x22/0x2b0 arch/x86/mm/pgtable.c:430
 mm_alloc_pgd kernel/fork.c:694 [inline]
 mm_init+0x594/0xa70 kernel/fork.c:1144
 dup_mm kernel/fork.c:1524 [inline]
 copy_mm+0x1c6/0x13a0 kernel/fork.c:1579
 copy_process+0x1184/0x3280 kernel/fork.c:2353
 kernel_clone+0x233/0x960 kernel/fork.c:2742
 __do_sys_clone kernel/fork.c:2868 [inline]
 __se_sys_clone kernel/fork.c:2852 [inline]
 __x64_sys_clone+0x198/0x210 kernel/fork.c:2852
 x64_sys_call+0x41f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page+0xae/0x540 mm/page_alloc.c:3618
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5900
 free_pages+0x82/0x90 mm/page_alloc.c:5911
 _pgd_free arch/x86/mm/pgtable.c:420 [inline]
 pgd_free+0x1a2/0x1c0 arch/x86/mm/pgtable.c:476
 mm_free_pgd kernel/fork.c:702 [inline]
 __mmdrop+0xad/0x500 kernel/fork.c:753
 mmdrop include/linux/sched/mm.h:49 [inline]
 finish_task_switch+0x2bb/0x790 kernel/sched/core.c:5075
 context_switch kernel/sched/core.c:5181 [inline]
 __schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
 schedule+0x11e/0x1e0 kernel/sched/core.c:6621
 freezable_schedule include/linux/freezer.h:197 [inline]
 do_nanosleep+0x19f/0x630 kernel/time/hrtimer.c:2048
 hrtimer_nanosleep+0x1b6/0x3d0 kernel/time/hrtimer.c:2101
 common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
 __se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
 __x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
 x64_sys_call+0x824/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:231
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88811cdc7280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88811cdc7380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff88811cdc7400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/18 10:37 android13-5.15-lts 31c263582f4e 72524a66 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-android-5-15 KASAN: use-after-free Write in ext4_expand_extra_isize_ea
2026/07/18 07:06 android13-5.15-lts 31c263582f4e 72524a66 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-android-5-15 KASAN: slab-out-of-bounds Write in ext4_expand_extra_isize_ea
* Struck through repros no longer work on HEAD.