KASAN: use-after-free Read in ext4_search_dir

Status: auto-obsoleted due to no activity on 2025/02/18 14:16
Reported-by: syzbot+a133fb1e9618ba1cc23d@syzkaller.appspotmail.com
First crash: 862d, last: 693d
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ext4_search_dir (3) prio:high actionable ext4 19 2 23d 47d 0/29 upstream: reported on 2026/07/09 00:07
android-5-15 KASAN: slab-out-of-bounds Read in ext4_search_dir origin:upstream missing-backport 19 syz, C done 6 653d 1012d 0/2 auto-obsoleted due to no activity on 2025/02/18 18:03
linux-5.15 KASAN: use-after-free Read in ext4_search_dir 19 syz, C done 5 688d 1166d 3/3 fixed on 2024/11/08 17:20
upstream KASAN: use-after-free Read in ext4_search_dir prio:low ext4 19 syz, C error done 20 961d 1202d 25/29 fixed on 2024/02/21 18:23
upstream KASAN: slab-out-of-bounds Read in ext4_search_dir ext4 19 syz, C 5 244d 327d 29/29 fixed on 2026/05/06 16:40
android-6-1 KASAN: use-after-free Read in ext4_search_dir missing-backport origin:upstream 19 syz, C error error 32 24d 1038d 0/2 upstream: reported C repro on 2023/10/22 16:55
android-5-15 KASAN: use-after-free Read in ext4_search_dir origin:upstream 19 syz, C 4 35d 65d 0/2 upstream: reported C repro on 2026/06/21 07:51
android-5-10 KASAN: slab-out-of-bounds Read in ext4_search_dir 19 syz, C error 24 65d 1012d 0/2 upstream: reported C repro on 2023/11/17 09:38
linux-6.1 KASAN: use-after-free Read in ext4_search_dir origin:upstream missing-backport 19 syz, C done 1 703d 1164d 0/3 upstream: reported C repro on 2023/06/18 19:29
upstream KASAN: use-after-free Read in ext4_search_dir (2) ext4 19 syz, C 5 712d 736d 28/29 fixed on 2024/10/22 11:57
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/02/18 14:02 13m retest repro android12-5.4 no crash log
2024/12/10 10:03 12m retest repro android12-5.4 error
2024/10/01 06:40 6m retest repro android12-5.4 report log
2024/07/23 05:45 5m retest repro android12-5.4 report log
2024/05/14 05:06 9m retest repro android12-5.4 report log

Sample crash report:
EXT4-fs error (device loop3): ext4_find_dest_de:2063: inode #12: block 7: comm syz-executor.3: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=1660078826, rec_len=60141, size=56 fake=0
EXT4-fs error (device loop3): ext4_xattr_block_get:544: inode #19: comm syz-executor.3: corrupted xattr block 128
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504
Read of size 1 at addr ffff8881ee15900a by task syz-executor.3/397

CPU: 0 PID: 397 Comm: syz-executor.3 Not tainted 5.4.268-syzkaller-00001-g8322246edffa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 ext4_search_dir+0xee/0x1b0 fs/ext4/namei.c:1504
 ext4_find_inline_entry+0x4b6/0x5e0 fs/ext4/inline.c:1698
 __ext4_find_entry+0x2a9/0x1b50 fs/ext4/namei.c:1577
 ext4_lookup_entry fs/ext4/namei.c:1730 [inline]
 ext4_lookup+0x3c6/0xaa0 fs/ext4/namei.c:1798
 lookup_open fs/namei.c:3308 [inline]
 do_last fs/namei.c:3421 [inline]
 path_openat+0x159a/0x3480 fs/namei.c:3634
 do_filp_open+0x20b/0x450 fs/namei.c:3664

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/30 04:03 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/30 04:03 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/30 04:02 android12-5.4 8322246edffa 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/27 02:35 android12-5.4 8322246edffa a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/20 21:21 android12-5.4 51cf29fc2bfc c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/05/15 16:54 android12-5.4 51cf29fc2bfc 94b087b1 .config console log report info ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/30 05:05 android12-5.4 2d5d8240a7cb f10afd69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/30 05:05 android12-5.4 2d5d8240a7cb f10afd69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/28 00:58 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:03 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:02 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:01 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/27 06:01 android12-5.4 2d5d8240a7cb 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/18 19:42 android12-5.4 2d5d8240a7cb af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
2024/04/15 06:45 android12-5.4 d0d34dcb02cc c8349e48 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-android-5-4-kasan KASAN: use-after-free Read in ext4_search_dir
* Struck through repros no longer work on HEAD.