================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:826 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:945 Read of size 4 at addr ffff88812e09e018 by task kworker/u4:5/626 CPU: 1 PID: 626 Comm: kworker/u4:5 Not tainted 5.10.236-syzkaller-00012-gab07aeb2c93d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: writeback wb_workfn (flush-7:2) Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x169/0x1d8 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0xe2/0x130 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 ext4_ext_binsearch fs/ext4/extents.c:826 [inline] ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:945 ext4_ext_map_blocks+0x1de/0x5d40 fs/ext4/extents.c:4159 ext4_map_blocks+0x993/0x1b80 fs/ext4/inode.c:673 mpage_map_one_extent fs/ext4/inode.c:2451 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2504 [inline] ext4_writepages+0x11d5/0x2e00 fs/ext4/inode.c:2872 do_writepages+0x12a/0x270 mm/page-writeback.c:2380 __writeback_single_inode+0xd5/0xa20 fs/fs-writeback.c:1470 writeback_sb_inodes+0x860/0x1400 fs/fs-writeback.c:1733 wb_writeback+0x3e3/0xb90 fs/fs-writeback.c:1908 wb_do_writeback fs/fs-writeback.c:2053 [inline] wb_workfn+0x38f/0xe20 fs/fs-writeback.c:2094 process_one_work+0x6e1/0xba0 kernel/workqueue.c:2301 worker_thread+0xa6a/0x13b0 kernel/workqueue.c:2447 kthread+0x346/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the page: page:ffffea0004b82780 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12e09e flags: 0x4000000000000000() raw: 4000000000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x100cca(GFP_HIGHUSER_MOVABLE), pid 1251, ts 72864693497, free_ts 75471562930 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x179/0x180 mm/page_alloc.c:2462 get_page_from_freelist+0x2235/0x23d0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x268/0x5f0 mm/page_alloc.c:5349 __alloc_pages include/linux/gfp.h:544 [inline] __alloc_pages_node include/linux/gfp.h:557 [inline] alloc_pages_node include/linux/gfp.h:571 [inline] alloc_pages include/linux/gfp.h:590 [inline] shmem_alloc_page+0x1b1/0x300 mm/shmem.c:1580 shmem_alloc_and_acct_page+0x36f/0x7b0 mm/shmem.c:1605 shmem_getpage_gfp+0x625/0x2110 mm/shmem.c:1918 shmem_getpage mm/shmem.c:161 [inline] shmem_write_begin+0xce/0x1b0 mm/shmem.c:2497 generic_perform_write+0x2be/0x510 mm/filemap.c:3509 __generic_file_write_iter+0x24b/0x480 mm/filemap.c:3638 generic_file_write_iter+0xa9/0x1d0 mm/filemap.c:3670 call_write_iter include/linux/fs.h:2058 [inline] new_sync_write fs/read_write.c:518 [inline] vfs_write+0x725/0xd60 fs/read_write.c:605 ksys_write+0x140/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:667 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] free_pcp_prepare mm/page_alloc.c:1421 [inline] free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336 free_unref_page_list+0x12e/0x9b0 mm/page_alloc.c:3443 release_pages+0xe38/0xe80 mm/swap.c:1103 __pagevec_release+0x71/0xe0 mm/swap.c:1123 pagevec_release include/linux/pagevec.h:88 [inline] shmem_undo_range+0x6e1/0x1760 mm/shmem.c:965 shmem_truncate_range mm/shmem.c:1069 [inline] shmem_evict_inode+0x1fd/0x9c0 mm/shmem.c:1169 evict+0x478/0x910 fs/inode.c:612 iput_final fs/inode.c:1736 [inline] iput+0x638/0x7c0 fs/inode.c:1762 dentry_unlink_inode+0x2cf/0x380 fs/dcache.c:378 __dentry_kill+0x44f/0x650 fs/dcache.c:583 dentry_kill+0xc0/0x2a0 fs/dcache.c:-1 dput+0x42/0x80 fs/dcache.c:883 __fput+0x4fe/0x770 fs/file_table.c:294 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 Memory state around the buggy address: ffff88812e09df00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812e09df80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88812e09e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88812e09e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812e09e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ------------[ cut here ]------------ kernel BUG at fs/ext4/inode.c:2463! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 626 Comm: kworker/u4:5 Tainted: G B 5.10.236-syzkaller-00012-gab07aeb2c93d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: writeback wb_workfn (flush-7:2) RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2463 [inline] RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2504 [inline] RIP: 0010:ext4_writepages+0x2d49/0x2e00 fs/ext4/inode.c:2872 Code: 08 48 89 df e8 c8 2a ce ff 48 8b 3b 48 8b 74 24 40 48 8b 54 24 28 48 8b 4c 24 20 45 89 f0 e8 de 41 07 00 eb 56 e8 07 44 94 ff <0f> 0b e8 00 44 94 ff eb 2f e8 f9 43 94 ff eb 64 e8 f2 43 94 ff 31 RSP: 0018:ffffc90001327180 EFLAGS: 00010293 RAX: ffffffff81cf48a9 RBX: 0000000000000000 RCX: ffff88810d02bb40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900013274f0 R08: dffffc0000000000 R09: ffffed10263b8cb1 R10: ffffed10263b8cb1 R11: 1ffff110263b8cb0 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000042b FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42a49219c8 CR3: 000000012f2d7000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_writepages+0x12a/0x270 mm/page-writeback.c:2380 __writeback_single_inode+0xd5/0xa20 fs/fs-writeback.c:1470 writeback_sb_inodes+0x860/0x1400 fs/fs-writeback.c:1733 wb_writeback+0x3e3/0xb90 fs/fs-writeback.c:1908 wb_do_writeback fs/fs-writeback.c:2053 [inline] wb_workfn+0x38f/0xe20 fs/fs-writeback.c:2094 process_one_work+0x6e1/0xba0 kernel/workqueue.c:2301 worker_thread+0xa6a/0x13b0 kernel/workqueue.c:2447 kthread+0x346/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Modules linked in: ---[ end trace 251949f5faf3c0ab ]--- RIP: 0010:mpage_map_one_extent fs/ext4/inode.c:2463 [inline] RIP: 0010:mpage_map_and_submit_extent fs/ext4/inode.c:2504 [inline] RIP: 0010:ext4_writepages+0x2d49/0x2e00 fs/ext4/inode.c:2872 Code: 08 48 89 df e8 c8 2a ce ff 48 8b 3b 48 8b 74 24 40 48 8b 54 24 28 48 8b 4c 24 20 45 89 f0 e8 de 41 07 00 eb 56 e8 07 44 94 ff <0f> 0b e8 00 44 94 ff eb 2f e8 f9 43 94 ff eb 64 e8 f2 43 94 ff 31 RSP: 0018:ffffc90001327180 EFLAGS: 00010293 RAX: ffffffff81cf48a9 RBX: 0000000000000000 RCX: ffff88810d02bb40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900013274f0 R08: dffffc0000000000 R09: ffffed10263b8cb1 R10: ffffed10263b8cb1 R11: 1ffff110263b8cb0 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000042b FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1873512d58 CR3: 0000000124c01000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400