================================================================== BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1159/0x3860 fs/ext4/xattr.c:1731 Read of size 18446744073709551600 at addr ffff8881220b3eb8 by task syz.3.848/3453 CPU: 1 PID: 3453 Comm: syz.3.848 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 memmove+0x2d/0x70 mm/kasan/shadow.c:54 ext4_xattr_set_entry+0x1159/0x3860 fs/ext4/xattr.c:1731 ext4_xattr_ibody_set+0x114/0x330 fs/ext4/xattr.c:2231 ext4_destroy_inline_data_nolock+0x20f/0x5e0 fs/ext4/inline.c:464 ext4_destroy_inline_data+0x84/0xe0 fs/ext4/inline.c:1904 ext4_writepages+0x603/0x2f00 fs/ext4/inode.c:2781 do_writepages+0x12e/0x280 mm/page-writeback.c:2380 __filemap_fdatawrite_range+0x2a0/0x350 mm/filemap.c:427 __filemap_fdatawrite mm/filemap.c:435 [inline] filemap_flush+0x23/0x30 mm/filemap.c:462 ext4_convert_inline_data+0x197/0x5b0 fs/ext4/inline.c:2061 ext4_page_mkwrite+0x26d/0x12f0 fs/ext4/inode.c:6305 do_page_mkwrite mm/memory.c:3037 [inline] wp_page_shared+0x45f/0x740 mm/memory.c:3372 do_wp_page+0xb68/0xd00 mm/memory.c:3476 handle_pte_fault+0xbc3/0x3910 mm/memory.c:4819 __handle_mm_fault mm/memory.c:4953 [inline] handle_mm_fault+0xf86/0x1720 mm/memory.c:5367 do_user_addr_fault+0x576/0xe20 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1436 [inline] exc_page_fault+0x5a/0xc0 arch/x86/mm/fault.c:1492 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:571 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x40 arch/x86/lib/copy_user_64.S:206 Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 90 90 90 90 90 90 90 0f 01 cb 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 01 ca c3 90 90 90 90 90 90 90 90 90 90 89 d1 83 f8 RSP: 0018:ffffc900010178a8 EFLAGS: 00050206 RAX: ffffffff823c9601 RBX: 0000000000001000 RCX: 0000000000001000 RDX: 0000000000001000 RSI: ffff888135eff000 RDI: 0000200000000400 RBP: ffffc90001017930 R08: ffff888135efffff R09: 1ffff11026bdffff R10: dffffc0000000000 R11: ffffed1026be0000 R12: 0000000000001000 R13: ffffc90001017dff R14: 0000200000000400 R15: ffff888135eff000 generic_file_buffered_read+0x1b68/0x26d0 mm/filemap.c:2355 generic_file_read_iter+0x10b/0x580 mm/filemap.c:2568 ext4_file_read_iter+0x2e8/0x530 fs/ext4/file.c:-1 call_read_iter include/linux/fs.h:2060 [inline] new_sync_read fs/read_write.c:415 [inline] vfs_read+0x62a/0xa50 fs/read_write.c:496 ksys_read+0x14a/0x260 fs/read_write.c:634 __do_sys_read fs/read_write.c:644 [inline] __se_sys_read fs/read_write.c:642 [inline] __x64_sys_read+0x7b/0x90 fs/read_write.c:642 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f83887e1e99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f838723b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f8388a69fa0 RCX: 00007f83887e1e99 RDX: 00000000fffffeb1 RSI: 0000200000000400 RDI: 0000000000000006 RBP: 00007f8388877eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8388a6a038 R14: 00007f8388a69fa0 R15: 00007ffe681dda88 The buggy address belongs to the page: page:ffffea0004882cc0 refcount:2 mapcount:0 mapping:ffff888110374f50 index:0x26 pfn:0x1220b3 aops:def_blk_aops ino:0 flags: 0x400000000002203e(referenced|uptodate|dirty|lru|active|private|mappedtodisk) raw: 400000000002203e ffffea000577be48 ffffea000462ac08 ffff888110374f50 raw: 0000000000000026 ffff88811c6bad20 00000002ffffffff ffff888127fde000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff888127fde000 page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 3453, ts 142961640352, free_ts 142547760635 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 __alloc_pages include/linux/gfp.h:544 [inline] __alloc_pages_node include/linux/gfp.h:557 [inline] alloc_pages_node include/linux/gfp.h:571 [inline] alloc_pages include/linux/gfp.h:590 [inline] __page_cache_alloc include/linux/pagemap.h:290 [inline] page_cache_ra_unbounded+0x2d2/0x790 mm/readahead.c:226 do_page_cache_ra mm/readahead.c:277 [inline] ondemand_readahead+0x780/0xbc0 mm/readahead.c:559 page_cache_async_ra+0x29f/0x2d0 mm/readahead.c:617 page_cache_async_readahead include/linux/pagemap.h:860 [inline] do_async_mmap_readahead mm/filemap.c:2695 [inline] filemap_fault+0x9c8/0x2020 mm/filemap.c:2805 __do_fault mm/memory.c:4064 [inline] do_read_fault mm/memory.c:4408 [inline] do_fault mm/memory.c:4536 [inline] handle_pte_fault+0x2466/0x3910 mm/memory.c:4800 __handle_mm_fault mm/memory.c:4953 [inline] handle_mm_fault+0xf86/0x1720 mm/memory.c:5367 faultin_page mm/gup.c:902 [inline] __get_user_pages+0xbf8/0x1400 mm/gup.c:1121 populate_vma_page_range mm/gup.c:1454 [inline] __mm_populate+0x31c/0x420 mm/gup.c:1502 mm_populate include/linux/mm.h:2793 [inline] vm_mmap_pgoff+0x23b/0x350 mm/util.c:548 ksys_mmap_pgoff+0x16f/0x1e0 mm/mmap.c:1712 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:95 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline] __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:86 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] free_pcp_prepare mm/page_alloc.c:1421 [inline] free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336 free_unref_page_list+0x129/0x9c0 mm/page_alloc.c:3443 release_pages+0xe41/0xe90 mm/swap.c:1103 free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:356 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu mm/mmu_gather.c:247 [inline] tlb_finish_mmu+0x17e/0x310 mm/mmu_gather.c:326 exit_mmap+0x329/0x590 mm/mmap.c:3387 __mmput+0x92/0x2d0 kernel/fork.c:1153 mmput+0x4e/0x150 kernel/fork.c:1176 exit_mm kernel/exit.c:540 [inline] do_exit+0x9d8/0x24e0 kernel/exit.c:860 do_group_exit+0x149/0x310 kernel/exit.c:987 get_signal+0xfb1/0x1300 kernel/signal.c:2794 arch_do_signal_or_restart+0xe7/0x11b0 arch/x86/kernel/signal.c:805 handle_signal_work kernel/entry/common.c:145 [inline] exit_to_user_mode_loop+0xa2/0xe0 kernel/entry/common.c:169 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:291 Memory state around the buggy address: ffff8881220b3d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881220b3e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881220b3e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8881220b3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881220b3f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== EXT4-fs warning (device loop3): ext4_read_block_bitmap_nowait:485: Cannot get buffer for block bitmap - block_group = 0, block_bitmap = 3905754590 EXT4-fs warning (device loop3): ext4_read_block_bitmap_nowait:485: Cannot get buffer for block bitmap - block_group = 0, block_bitmap = 3905754590 ---------------- Code disassembly (best guess): 0: 89 d1 mov %edx,%ecx 2: c1 e9 03 shr $0x3,%ecx 5: 83 e2 07 and $0x7,%edx 8: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi) b: 89 d1 mov %edx,%ecx d: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) f: 31 c0 xor %eax,%eax 11: 0f 01 ca clac 14: c3 ret 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 0f 01 cb stac 1f: 83 fa 40 cmp $0x40,%edx 22: 0f 82 70 ff ff ff jb 0xffffff98 28: 89 d1 mov %edx,%ecx * 2a: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) <-- trapping instruction 2c: 31 c0 xor %eax,%eax 2e: 0f 01 ca clac 31: c3 ret 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 89 d1 mov %edx,%ecx 3e: 83 .byte 0x83 3f: f8 clc