================================================================== BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x7c8/0x15a0 fs/ext4/xattr.c:1785 Read of size 18446744073709551572 at addr ffff0000f8157050 by task syz.3.1323/9591 CPU: 0 UID: 0 PID: 9591 Comm: syz.3.1323 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200 __asan_memmove+0x3c/0x84 mm/kasan/shadow.c:94 ext4_xattr_set_entry+0x7c8/0x15a0 fs/ext4/xattr.c:1785 ext4_xattr_block_set+0x5ec/0x2188 fs/ext4/xattr.c:2032 ext4_xattr_move_to_block fs/ext4/xattr.c:2671 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2746 [inline] ext4_expand_extra_isize_ea+0xb18/0x13a0 fs/ext4/xattr.c:2834 __ext4_expand_extra_isize+0x29c/0x370 fs/ext4/inode.c:6434 ext4_try_to_expand_extra_isize fs/ext4/inode.c:6477 [inline] __ext4_mark_inode_dirty+0x3a4/0x810 fs/ext4/inode.c:6555 ext4_dirty_inode+0xd4/0x104 fs/ext4/inode.c:6587 __mark_inode_dirty+0x354/0x1a10 fs/fs-writeback.c:2623 generic_update_time+0xe8/0x110 fs/inode.c:2198 file_update_time_flags+0x288/0x348 fs/inode.c:2428 file_modified_flags+0x58/0x74 fs/inode.c:2479 file_modified+0x24/0x34 fs/inode.c:2495 ext4_write_checks+0xb4/0x1e4 fs/ext4/file.c:281 ext4_buffered_write_iter+0xac/0x310 fs/ext4/file.c:312 ext4_file_write_iter+0x1d8/0x1390 fs/ext4/file.c:-1 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x52c/0xa14 fs/read_write.c:688 ksys_pwrite64+0x118/0x1b0 fs/read_write.c:795 __do_sys_pwrite64 fs/read_write.c:803 [inline] __se_sys_pwrite64 fs/read_write.c:800 [inline] __arm64_sys_pwrite64+0x9c/0xb4 fs/read_write.c:800 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Allocated by task 9591: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_node_track_caller_noprof+0x370/0x748 mm/slub.c:5408 kmemdup_noprof+0x44/0x8c mm/util.c:138 kmemdup_noprof include/linux/fortify-string.h:763 [inline] ext4_xattr_block_set+0x538/0x2188 fs/ext4/xattr.c:1980 ext4_xattr_move_to_block fs/ext4/xattr.c:2671 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2746 [inline] ext4_expand_extra_isize_ea+0xb18/0x13a0 fs/ext4/xattr.c:2834 __ext4_expand_extra_isize+0x29c/0x370 fs/ext4/inode.c:6434 ext4_try_to_expand_extra_isize fs/ext4/inode.c:6477 [inline] __ext4_mark_inode_dirty+0x3a4/0x810 fs/ext4/inode.c:6555 ext4_dirty_inode+0xd4/0x104 fs/ext4/inode.c:6587 __mark_inode_dirty+0x354/0x1a10 fs/fs-writeback.c:2623 generic_update_time+0xe8/0x110 fs/inode.c:2198 file_update_time_flags+0x288/0x348 fs/inode.c:2428 file_modified_flags+0x58/0x74 fs/inode.c:2479 file_modified+0x24/0x34 fs/inode.c:2495 ext4_write_checks+0xb4/0x1e4 fs/ext4/file.c:281 ext4_buffered_write_iter+0xac/0x310 fs/ext4/file.c:312 ext4_file_write_iter+0x1d8/0x1390 fs/ext4/file.c:-1 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x52c/0xa14 fs/read_write.c:688 ksys_pwrite64+0x118/0x1b0 fs/read_write.c:795 __do_sys_pwrite64 fs/read_write.c:803 [inline] __se_sys_pwrite64 fs/read_write.c:800 [inline] __arm64_sys_pwrite64+0x9c/0xb4 fs/read_write.c:800 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 The buggy address belongs to the object at ffff0000f8157000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 80 bytes inside of 1024-byte region [ffff0000f8157000, ffff0000f8157400) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000f8156800 pfn:0x138150 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000240 ffff0000c0001dc0 ffff0000c0000888 fffffdffc31ab010 raw: ffff0000f8156800 0000000800100009 00000000f5000000 0000000000000000 head: 05ffc00000000240 ffff0000c0001dc0 ffff0000c0000888 fffffdffc31ab010 head: ffff0000f8156800 0000000800100009 00000000f5000000 0000000000000000 head: 05ffc00000000003 fffffdffc3e05401 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000f8156f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000f8156f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000f8157000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff0000f8157080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000f8157100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================