EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
EXT4-fs (loop0): 1 truncate cleaned up
EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir+0xf8/0x1c0 fs/ext4/namei.c:1544
Read of size 1 at addr ffff8881222bbc86 by task syz-executor516/325

CPU: 0 PID: 325 Comm: syz-executor516 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:348
 ext4_search_dir+0xf8/0x1c0 fs/ext4/namei.c:1544
 ext4_find_inline_entry+0x4f2/0x630 fs/ext4/inline.c:1756
 __ext4_find_entry+0x307/0x1a10 fs/ext4/namei.c:1617
 ext4_lookup_entry fs/ext4/namei.c:1774 [inline]
 ext4_lookup+0x181/0x710 fs/ext4/namei.c:1842
 lookup_one_qstr_excl+0x125/0x270 fs/namei.c:1612
 filename_create+0x23d/0x440 fs/namei.c:3884
 do_mkdirat+0x5c/0x4d0 fs/namei.c:4128
 __do_sys_mkdir fs/namei.c:4158 [inline]
 __se_sys_mkdir fs/namei.c:4156 [inline]
 __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4156
 x64_sys_call+0x966/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:84
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f84055c1097
Code: 1f 40 00 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db b5 01 00 66 2e 0f 1f 84 00 00 00 00 00 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007f8405593f88 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000200000000140 RCX: 00007f84055c1097
RDX: 000000000399446c RSI: 00000000000001ff RDI: 0000200000000080
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 00007f8405594cdc R11: 0000000000000246 R12: 0000200000000080
R13: 00007f8405594020 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Allocated by task 314:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x72/0x80 mm/kasan/common.c:334
 kasan_slab_alloc include/linux/kasan.h:202 [inline]
 slab_post_alloc_hook+0x4f/0x2d0 mm/slab.h:768
 slab_alloc_node mm/slub.c:3382 [inline]
 slab_alloc mm/slub.c:3392 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3399 [inline]
 kmem_cache_alloc+0x166/0x320 mm/slub.c:3408
 skb_clone+0x1e8/0x380 net/core/skbuff.c:1663
 dev_queue_xmit_nit+0x245/0xab0 net/core/dev.c:2342
 xmit_one net/core/dev.c:3699 [inline]
 dev_hard_start_xmit+0x15f/0x730 net/core/dev.c:3722
 sch_direct_xmit+0x279/0x9c0 net/sched/sch_generic.c:345
 __dev_xmit_skb net/core/dev.c:3943 [inline]
 __dev_queue_xmit+0x163e/0x3540 net/core/dev.c:4348
 dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip_finish_output2+0xc07/0xf50 net/ipv4/ip_output.c:228
 __ip_finish_output+0x172/0x370 net/ipv4/ip_output.c:-1
 ip_finish_output+0x31/0x2b0 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_output+0x1ea/0x390 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:453 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x1129/0x1cf0 net/ipv4/ip_output.c:538
 ip_queue_xmit+0x4d/0x70 net/ipv4/ip_output.c:552
 __tcp_transmit_skb+0x1da6/0x3410 net/ipv4/tcp_output.c:1406
 tcp_transmit_skb net/ipv4/tcp_output.c:1424 [inline]
 tcp_write_xmit+0x17e1/0x5e20 net/ipv4/tcp_output.c:2721
 __tcp_push_pending_frames+0x99/0x2f0 net/ipv4/tcp_output.c:2906
 tcp_push+0x484/0x660 net/ipv4/tcp.c:738
 tcp_sendmsg_locked+0x323e/0x39f0 net/ipv4/tcp.c:1464
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1492
 inet_sendmsg+0xb6/0xd0 net/ipv4/af_inet.c:841
 sock_sendmsg_nosec net/socket.c:716 [inline]
 __sock_sendmsg net/socket.c:728 [inline]
 sock_write_iter+0x2ea/0x3f0 net/socket.c:1133
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 314:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 kmem_cache_free+0x12d/0x300 mm/slub.c:3737
 kfree_skbmem+0x10c/0x180 net/core/skbuff.c:-1
 __kfree_skb net/core/skbuff.c:874 [inline]
 consume_skb+0xb3/0x1f0 net/core/skbuff.c:1038
 packet_rcv+0x16d/0x1510 net/packet/af_packet.c:2280
 dev_queue_xmit_nit+0xa27/0xab0 net/core/dev.c:2374
 xmit_one net/core/dev.c:3699 [inline]
 dev_hard_start_xmit+0x15f/0x730 net/core/dev.c:3722
 sch_direct_xmit+0x279/0x9c0 net/sched/sch_generic.c:345
 __dev_xmit_skb net/core/dev.c:3943 [inline]
 __dev_queue_xmit+0x163e/0x3540 net/core/dev.c:4348
 dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip_finish_output2+0xc07/0xf50 net/ipv4/ip_output.c:228
 __ip_finish_output+0x172/0x370 net/ipv4/ip_output.c:-1
 ip_finish_output+0x31/0x2b0 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_output+0x1ea/0x390 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:453 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x1129/0x1cf0 net/ipv4/ip_output.c:538
 ip_queue_xmit+0x4d/0x70 net/ipv4/ip_output.c:552
 __tcp_transmit_skb+0x1da6/0x3410 net/ipv4/tcp_output.c:1406
 tcp_transmit_skb net/ipv4/tcp_output.c:1424 [inline]
 tcp_write_xmit+0x17e1/0x5e20 net/ipv4/tcp_output.c:2721
 __tcp_push_pending_frames+0x99/0x2f0 net/ipv4/tcp_output.c:2906
 tcp_push+0x484/0x660 net/ipv4/tcp.c:738
 tcp_sendmsg_locked+0x323e/0x39f0 net/ipv4/tcp.c:1464
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1492
 inet_sendmsg+0xb6/0xd0 net/ipv4/af_inet.c:841
 sock_sendmsg_nosec net/socket.c:716 [inline]
 __sock_sendmsg net/socket.c:728 [inline]
 sock_write_iter+0x2ea/0x3f0 net/socket.c:1133
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff8881222bbc80
 which belongs to the cache skbuff_head_cache of size 256
The buggy address is located 6 bytes inside of
 256-byte region [ffff8881222bbc80, ffff8881222bbd80)

The buggy address belongs to the physical page:
page:ffffea000488aec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1222bb
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff888108c5dc80
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 314, tgid 314 (sshd-session), ts 33613459827, free_ts 28277594054
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679
 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930
 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
 allocate_slab mm/slub.c:1967 [inline]
 new_slab+0x98/0x3e0 mm/slub.c:2020
 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177
 __slab_alloc+0x5e/0xa0 mm/slub.c:3263
 slab_alloc_node mm/slub.c:3348 [inline]
 slab_alloc mm/slub.c:3392 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3399 [inline]
 kmem_cache_alloc+0x1a8/0x320 mm/slub.c:3408
 skb_clone+0x1e8/0x380 net/core/skbuff.c:1663
 dev_queue_xmit_nit+0x245/0xab0 net/core/dev.c:2342
 xmit_one net/core/dev.c:3699 [inline]
 dev_hard_start_xmit+0x15f/0x730 net/core/dev.c:3722
 sch_direct_xmit+0x279/0x9c0 net/sched/sch_generic.c:345
 __dev_xmit_skb net/core/dev.c:3943 [inline]
 __dev_queue_xmit+0x163e/0x3540 net/core/dev.c:4348
 dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip_finish_output2+0xc07/0xf50 net/ipv4/ip_output.c:228
 __ip_finish_output+0x172/0x370 net/ipv4/ip_output.c:-1
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1580 [inline]
 free_pcp_prepare mm/page_alloc.c:1654 [inline]
 free_unref_page_prepare+0x80c/0x820 mm/page_alloc.c:3621
 free_unref_page+0x93/0x530 mm/page_alloc.c:3719
 __folio_put_small mm/swap.c:100 [inline]
 __folio_put+0xac/0xe0 mm/swap.c:123
 folio_put include/linux/mm.h:1442 [inline]
 put_page include/linux/mm.h:1494 [inline]
 anon_pipe_buf_release+0x15f/0x1d0 fs/pipe.c:138
 pipe_buf_release include/linux/pipe_fs_i.h:199 [inline]
 pipe_read+0x582/0x1070 fs/pipe.c:324
 call_read_iter include/linux/fs.h:2276 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x46e/0x930 fs/read_write.c:470
 ksys_read+0x14a/0x260 fs/read_write.c:613
 __do_sys_read fs/read_write.c:623 [inline]
 __se_sys_read fs/read_write.c:621 [inline]
 __x64_sys_read+0x7b/0x90 fs/read_write.c:621
 x64_sys_call+0x2f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff8881222bbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881222bbc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881222bbc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8881222bbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881222bbd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
==================================================================
EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0