================================================================== BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1159/0x3860 fs/ext4/xattr.c:1731 Read of size 18446744073709551600 at addr ffff888136370302 by task syz.2.1007/4105 CPU: 1 PID: 4105 Comm: syz.2.1007 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 memmove+0x2d/0x70 mm/kasan/shadow.c:54 ext4_xattr_set_entry+0x1159/0x3860 fs/ext4/xattr.c:1731 ext4_xattr_ibody_set+0x114/0x330 fs/ext4/xattr.c:2231 ext4_destroy_inline_data_nolock+0x20f/0x5e0 fs/ext4/inline.c:464 ext4_convert_inline_data_nolock+0x3df/0xcc0 fs/ext4/inline.c:1266 ext4_convert_inline_data+0x470/0x5b0 fs/ext4/inline.c:2083 ext4_page_mkwrite+0x26d/0x12f0 fs/ext4/inode.c:6305 do_page_mkwrite mm/memory.c:3037 [inline] wp_page_shared+0x45f/0x740 mm/memory.c:3372 do_wp_page+0xb68/0xd00 mm/memory.c:3476 handle_pte_fault+0xbc3/0x3910 mm/memory.c:4819 __handle_mm_fault mm/memory.c:4953 [inline] handle_mm_fault+0xf86/0x1720 mm/memory.c:5367 do_user_addr_fault+0x576/0xe20 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1436 [inline] exc_page_fault+0x5a/0xc0 arch/x86/mm/fault.c:1492 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:571 RIP: 0033:0x7fee43f545a2 Code: 30 48 8b 14 24 48 85 d2 74 17 8b 44 24 10 0f c8 89 c0 48 89 44 24 10 48 83 fa 01 0f 85 aa 02 00 00 48 8b 44 24 18 8b 74 24 10 <89> 30 e9 1e fe ff ff 48 8b 44 24 18 8b 10 48 8b 04 24 48 85 c0 0f RSP: 002b:00007fff1339f110 EFLAGS: 00010246 RAX: 0000200000000700 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 000055556bfd23d8 RBP: 00007fff1339f230 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00007fff1339f270 R13: 00007fee44312fac R14: 0000000000032b49 R15: 00007fee44312fa0 The buggy address belongs to the page: page:ffffea0004d8dc00 refcount:2 mapcount:0 mapping:ffff8881092fcf50 index:0x2 pfn:0x136370 aops:def_blk_aops ino:0 flags: 0x400000000002203e(referenced|uptodate|dirty|lru|active|private|mappedtodisk) raw: 400000000002203e ffffea0004c47a48 ffffea00041bf188 ffff8881092fcf50 raw: 0000000000000002 ffff888132c8ad20 00000002ffffffff ffff88812843a000 page dumped because: kasan: bad access detected page->mem_cgroup:ffff88812843a000 page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 4106, ts 207746696045, free_ts 207745944826 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 __alloc_pages include/linux/gfp.h:544 [inline] __alloc_pages_node include/linux/gfp.h:557 [inline] alloc_pages_node include/linux/gfp.h:571 [inline] alloc_pages include/linux/gfp.h:590 [inline] __page_cache_alloc include/linux/pagemap.h:290 [inline] pagecache_get_page+0x63e/0x930 mm/filemap.c:1848 find_or_create_page include/linux/pagemap.h:402 [inline] grow_dev_page fs/buffer.c:976 [inline] grow_buffers fs/buffer.c:1045 [inline] __getblk_slow fs/buffer.c:1072 [inline] __getblk_gfp+0x212/0x780 fs/buffer.c:1370 sb_getblk include/linux/buffer_head.h:361 [inline] __ext4_get_inode_loc+0x45e/0xbf0 fs/ext4/inode.c:4456 __ext4_get_inode_loc_noinmem fs/ext4/inode.c:4566 [inline] __ext4_iget+0x491/0x44e0 fs/ext4/inode.c:4816 ext4_orphan_get+0x1df/0x630 fs/ext4/ialloc.c:1401 ext4_orphan_cleanup+0x674/0xd40 fs/ext4/super.c:3081 ext4_fill_super+0x867e/0x8d90 fs/ext4/super.c:5079 mount_bdev+0x26a/0x380 fs/super.c:1442 ext4_mount+0x34/0x40 fs/ext4/super.c:6666 legacy_get_tree+0xed/0x190 fs/fs_context.c:593 vfs_get_tree+0x89/0x260 fs/super.c:1572 do_new_mount+0x25a/0xa30 fs/namespace.c:3006 path_mount+0x581/0xca0 fs/namespace.c:3336 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] free_pcp_prepare mm/page_alloc.c:1421 [inline] free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336 free_unref_page_list+0x129/0x9c0 mm/page_alloc.c:3443 release_pages+0xe41/0xe90 mm/swap.c:1103 __pagevec_release+0x71/0xe0 mm/swap.c:1123 pagevec_release include/linux/pagevec.h:88 [inline] shmem_undo_range+0x741/0x1740 mm/shmem.c:965 shmem_truncate_range mm/shmem.c:1069 [inline] shmem_evict_inode+0x1dc/0x970 mm/shmem.c:1169 evict+0x4a9/0x940 fs/inode.c:612 iput_final fs/inode.c:1736 [inline] iput+0x654/0x7e0 fs/inode.c:1762 dentry_unlink_inode+0x2d5/0x390 fs/dcache.c:378 __dentry_kill+0x45b/0x660 fs/dcache.c:583 dentry_kill+0xc0/0x2a0 fs/dcache.c:-1 dput+0x42/0x80 fs/dcache.c:883 do_renameat2+0x7f2/0xe50 fs/namei.c:4631 __do_sys_rename fs/namei.c:4678 [inline] __se_sys_rename fs/namei.c:4676 [inline] __x64_sys_rename+0x86/0x90 fs/namei.c:4676 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Memory state around the buggy address: ffff888136370200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888136370280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888136370300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888136370380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888136370400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================