KASAN: out-of-bounds Read in ext4_xattr_set_entry

Status: upstream: reported C repro on 2021/04/12 14:20
Reported-by: syzbot+97177fd4bf74cef7673e@syzkaller.appspotmail.com
First crash: 1951d, last: 1437d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (18)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 KASAN: out-of-bounds Read in ext4_xattr_set_entry (2) origin:lts 19 syz, C 192 4d17h 408d 0/2 upstream: reported C repro on 2025/07/03 01:48
linux-4.19 KASAN: use-after-free Read in ext4_xattr_set_entry (2) 19 syz, C done 7 1798d 2256d 1/1 fixed on 2021/10/13 07:23
android-5-15 KASAN: out-of-bounds Read in ext4_xattr_set_entry 17 1 1153d 1153d 0/2 auto-obsoleted due to no activity on 2023/09/17 07:02
upstream KASAN: out-of-bounds Read in ext4_xattr_set_entry prio:high ext4 22 syz, C error 7886 2h21m 692d 0/29 upstream: reported C repro on 2024/09/22 00:16
android-54 KASAN: out-of-bounds Read in ext4_xattr_set_entry ext4 17 syz, C 14 1207d 1973d 0/2 auto-obsoleted due to no activity on 2023/08/23 09:06
linux-5.15 KASAN: out-of-bounds Read in ext4_xattr_set_entry 19 syz, C error 66 2d20h 518d 0/3 upstream: reported C repro on 2025/03/15 11:50
linux-6.1 KASAN: out-of-bounds Read in ext4_xattr_set_entry missing-backport origin:lts-only 21 syz, C inconclusive 1059 6d07h 1184d 0/3 upstream: reported C repro on 2023/05/19 08:42
linux-6.6 KASAN: out-of-bounds Read in ext4_xattr_set_entry origin:upstream missing-backport 17 syz, C inconclusive 1398 70d 424d 0/2 upstream: reported C repro on 2025/06/17 02:45
android-5-10 KASAN: out-of-bounds Read in ext4_xattr_set_entry 19 syz, C inconclusive 265 12d 1060d 0/2 upstream: reported C repro on 2023/09/20 02:40
android-6-1 KASAN: out-of-bounds Read in ext4_xattr_set_entry origin:lts 21 syz, C 1013 9d13h 824d 0/2 upstream: reported C repro on 2024/05/13 18:18
android-5-15 general protection fault in ext4_xattr_set_entry 2 syz, C error 1 1262d 1342d 2/2 fixed on 2023/03/28 12:29
android-5-10 general protection fault in ext4_xattr_set_entry (4) 2 syz, C error 62 1165d 1194d 2/2 fixed on 2023/06/07 17:22
android-5-10 general protection fault in ext4_xattr_set_entry (2) ext4 2 syz, C error 423 1200d 1400d 2/2 fixed on 2023/05/03 13:06
upstream KASAN: use-after-free Read in ext4_xattr_set_entry (5) ext4 19 2 1482d 1540d 0/29 auto-obsoleted due to no activity on 2022/11/22 17:19
android-5-10 general protection fault in ext4_xattr_set_entry (3) 2 syz, C error 9 1196d 1199d 2/2 fixed on 2023/05/08 19:06
upstream KASAN: use-after-free Read in ext4_xattr_set_entry (4) ext4 22 syz, C error done 21 1636d 2023d 20/29 fixed on 2022/03/28 10:17
android-5-10 general protection fault in ext4_xattr_set_entry 2 syz, C error 2 1423d 1437d 0/2 closed as invalid on 2022/09/26 18:30
android-5-10 general protection fault in ext4_xattr_set_entry (5) 2 syz, C done 11 1162d 1164d 2/2 fixed on 2023/06/13 02:27
▶ ▼ Fix bisection attempts (18)
Created Duration User Patch Repo Result
2022/10/13 02:21 0m bisect fix linux-4.14.y error job log
2022/09/08 14:08 20m bisect fix linux-4.14.y OK (0) job log log
2022/08/09 10:53 24m bisect fix linux-4.14.y OK (0) job log log
2022/07/10 10:28 25m bisect fix linux-4.14.y OK (0) job log log
2022/06/10 09:59 21m bisect fix linux-4.14.y OK (0) job log log
2022/05/11 09:20 23m bisect fix linux-4.14.y OK (0) job log log
2022/04/10 00:01 24m bisect fix linux-4.14.y OK (0) job log log
2022/03/10 23:31 29m bisect fix linux-4.14.y OK (0) job log log
2022/02/08 23:05 25m bisect fix linux-4.14.y OK (0) job log log
2022/01/09 22:39 26m bisect fix linux-4.14.y OK (0) job log log
2021/12/10 22:11 27m bisect fix linux-4.14.y OK (0) job log log
2021/11/10 21:49 21m bisect fix linux-4.14.y OK (0) job log log
2021/10/11 21:23 25m bisect fix linux-4.14.y OK (0) job log log
2021/09/11 20:58 21m bisect fix linux-4.14.y OK (0) job log log
2021/08/12 20:36 21m bisect fix linux-4.14.y OK (0) job log log
2021/07/13 20:12 23m bisect fix linux-4.14.y OK (0) job log log
2021/06/13 18:26 24m bisect fix linux-4.14.y OK (0) job log log
2021/05/14 17:39 26m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs error (device loop0): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 50 vs 25 free clusters
==================================================================
BUG: KASAN: out-of-bounds in memmove include/linux/string.h:391 [inline]
BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1787/0x3180 fs/ext4/xattr.c:1732
Read of size 18446744073709551600 at addr ffff88809b8980b8 by task syz-executor772/7987

CPU: 0 PID: 7987 Comm: syz-executor772 Not tainted 4.14.230-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report+0x6f/0x80 mm/kasan/report.c:409
 memmove+0x20/0x50 mm/kasan/kasan.c:293
 memmove include/linux/string.h:391 [inline]
 ext4_xattr_set_entry+0x1787/0x3180 fs/ext4/xattr.c:1732
 ext4_xattr_ibody_inline_set+0x73/0x280 fs/ext4/xattr.c:2221
 ext4_destroy_inline_data_nolock+0x1cb/0x440 fs/ext4/inline.c:440
 ext4_convert_inline_data_nolock+0x115/0xb40 fs/ext4/inline.c:1213
 ext4_convert_inline_data+0x2ae/0x300 fs/ext4/inline.c:2001
 ext4_fallocate+0x106/0x1d80 fs/ext4/extents.c:4964
 vfs_fallocate+0x346/0x790 fs/open.c:319
 SYSC_fallocate fs/open.c:342 [inline]
 SyS_fallocate+0x4a/0x80 fs/open.c:336
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x449b69
RSP: 002b:00007f55599e22f8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00000000004cb420 RCX: 0000000000449b69
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: 000000000049b064 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000bb89 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 000000000049a060 R14: e5d26e84aa4cf3c6 R15: 00000000004cb428

The buggy address belongs to the page:
page:ffffea00026e2600 count:2 mapcount:0 mapping:ffff8880b1e334a8 index:0x8
flags: 0xfff0000001107c(referenced|uptodate|dirty|lru|active|private|mappedtodisk)
raw: 00fff0000001107c ffff8880b1e334a8 0000000000000008 00000002ffffffff
raw: ffffea000249e4e0 ffffea00026d96e0 ffff88808e368348 ffff88823b320880
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88823b320880

Memory state around the buggy address:
 ffff88809b897f80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
 ffff88809b898000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88809b898080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                        ^
 ffff88809b898100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88809b898180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/04/14 17:32 linux-4.14.y 958e517f4e16 3134b37f .config console log report syz C ci2-linux-4-14 KASAN: out-of-bounds Read in ext4_xattr_set_entry
2021/04/12 14:20 linux-4.14.y 958e517f4e16 6a81331a .config console log report syz C ci2-linux-4-14 KASAN: out-of-bounds Read in ext4_xattr_set_entry
* Struck through repros no longer work on HEAD.