ext4 filesystem being mounted at /0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
Read of size 4 at addr ffff88810d5e920c by task syz.3.679/3290

CPU: 1 PID: 3290 Comm: syz.3.679 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
 ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
 ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
 ext4_ext_remove_space+0x2b6/0x3fb0 fs/ext4/extents.c:2834
 ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4141
 ext4_fallocate+0x2b6/0x1dd0 fs/ext4/extents.c:4761
 vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
 madvise_remove mm/madvise.c:1049 [inline]
 madvise_vma_behavior mm/madvise.c:1073 [inline]
 madvise_walk_vmas mm/madvise.c:1308 [inline]
 do_madvise+0x12bf/0x2f50 mm/madvise.c:1487
 __do_sys_madvise mm/madvise.c:1500 [inline]
 __se_sys_madvise mm/madvise.c:1498 [inline]
 __x64_sys_madvise+0xa9/0xc0 mm/madvise.c:1498
 x64_sys_call+0x99e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:29
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f72d678f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc5f177f18 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f72d69e5fa0 RCX: 00007f72d678f749
RDX: 0000000000000009 RSI: 000000000060000b RDI: 0000200000000000
RBP: 00007f72d6813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f72d69e5fa0 R14: 00007f72d69e5fa0 R15: 0000000000000003
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0004357a40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d5e9
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004b383c8 ffffea0004b633c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100cc0(GFP_USER), pid 1869, tgid 1869 (syz.5.356), ts 156172264596, free_ts 206604556840
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2643
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2650
 get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4554
 __alloc_pages+0x1c3/0x450 mm/page_alloc.c:5868
 __alloc_pages_node include/linux/gfp.h:236 [inline]
 alloc_pages_node include/linux/gfp.h:259 [inline]
 alloc_pages include/linux/gfp.h:270 [inline]
 __get_free_pages+0xe/0x30 mm/page_alloc.c:5918
 kasan_populate_vmalloc_pte+0x29/0x120 mm/kasan/shadow.c:271
 apply_to_pte_range mm/memory.c:2687 [inline]
 apply_to_pmd_range mm/memory.c:2731 [inline]
 apply_to_pud_range mm/memory.c:2767 [inline]
 apply_to_p4d_range mm/memory.c:2803 [inline]
 __apply_to_page_range+0x8de/0xc80 mm/memory.c:2839
 apply_to_page_range+0x3b/0x50 mm/memory.c:2858
 kasan_populate_vmalloc+0x60/0x70 mm/kasan/shadow.c:318
 alloc_vmap_area+0x173e/0x1870 mm/vmalloc.c:1663
 __get_vm_area_node+0x160/0x360 mm/vmalloc.c:2522
 __vmalloc_node_range+0x326/0x13d0 mm/vmalloc.c:3216
 vmalloc_user+0x73/0x80 mm/vmalloc.c:3410
 security_read_policy+0xf3/0x200 security/selinux/ss/services.c:4042
 sel_open_policy+0x217/0x4a0 security/selinux/selinuxfs.c:423
 do_dentry_open+0x88e/0x1260 fs/open.c:884
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1551 [inline]
 free_pcp_prepare mm/page_alloc.c:1625 [inline]
 free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3589
 free_unref_page+0x8f/0x530 mm/page_alloc.c:3687
 free_the_page mm/page_alloc.c:836 [inline]
 __free_pages+0x67/0x100 mm/page_alloc.c:5957
 free_pages+0x82/0x90 mm/page_alloc.c:5968
 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:375
 apply_to_pte_range mm/memory.c:2687 [inline]
 apply_to_pmd_range mm/memory.c:2731 [inline]
 apply_to_pud_range mm/memory.c:2767 [inline]
 apply_to_p4d_range mm/memory.c:2803 [inline]
 __apply_to_page_range+0x8de/0xc80 mm/memory.c:2839
 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2872
 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:492
 __purge_vmap_area_lazy+0xd47/0x1850 mm/vmalloc.c:1791
 drain_vmap_area_work+0x3e/0xd0 mm/vmalloc.c:1820
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff88810d5e9100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88810d5e9180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88810d5e9200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88810d5e9280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88810d5e9300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:3187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3290 Comm: syz.3.679 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:ext4_split_extent_at+0xf3f/0xf60 fs/ext4/extents.c:3187
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 45 fb ff ff 4c 89 f7 49 89 f7 e8 1e 62 d0 ff 4c 89 fe e9 32 fb ff ff e8 61 ed 8b ff <0f> 0b e8 5a ed 8b ff 0f 0b e8 53 ed 8b ff 0f 0b e8 4c ed 8b ff 0f
RSP: 0018:ffffc900020373e0 EFLAGS: 00010293
RAX: ffffffff81e4360f RBX: 0000000000000000 RCX: ffff888117846540
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000002c
RBP: ffffc90002037550 R08: 0000000000000000 R09: 0000000050000028
R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88812cf50b00
FS:  0000555576880500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000010000 CR3: 000000011e3e8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ext4_force_split_extent_at fs/ext4/extents.c:338 [inline]
 ext4_ext_remove_space+0x349d/0x3fb0 fs/ext4/extents.c:2881
 ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4141
 ext4_fallocate+0x2b6/0x1dd0 fs/ext4/extents.c:4761
 vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
 madvise_remove mm/madvise.c:1049 [inline]
 madvise_vma_behavior mm/madvise.c:1073 [inline]
 madvise_walk_vmas mm/madvise.c:1308 [inline]
 do_madvise+0x12bf/0x2f50 mm/madvise.c:1487
 __do_sys_madvise mm/madvise.c:1500 [inline]
 __se_sys_madvise mm/madvise.c:1498 [inline]
 __x64_sys_madvise+0xa9/0xc0 mm/madvise.c:1498
 x64_sys_call+0x99e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:29
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f72d678f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc5f177f18 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f72d69e5fa0 RCX: 00007f72d678f749
RDX: 0000000000000009 RSI: 000000000060000b RDI: 0000200000000000
RBP: 00007f72d6813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f72d69e5fa0 R14: 00007f72d69e5fa0 R15: 0000000000000003
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_split_extent_at+0xf3f/0xf60 fs/ext4/extents.c:3187
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 45 fb ff ff 4c 89 f7 49 89 f7 e8 1e 62 d0 ff 4c 89 fe e9 32 fb ff ff e8 61 ed 8b ff <0f> 0b e8 5a ed 8b ff 0f 0b e8 53 ed 8b ff 0f 0b e8 4c ed 8b ff 0f
RSP: 0018:ffffc900020373e0 EFLAGS: 00010293
RAX: ffffffff81e4360f RBX: 0000000000000000 RCX: ffff888117846540
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000002c
RBP: ffffc90002037550 R08: 0000000000000000 R09: 0000000050000028
R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88812cf50b00
FS:  0000555576880500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 000000011e3e8000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400