KASAN: use-after-free Read in ext4_xattr_set

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry (3)	19	C		error	1	1483d	1968d	0/1	upstream: reported C repro on 2020/10/28 15:08
android-5-15	KASAN: out-of-bounds Read in ext4_xattr_set_entry (2) origin:lts	19	C			106	12h41m	260d	0/2	upstream: reported C repro on 2025/07/03 01:48
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	19				1	2188d	2188d	0/1	auto-closed as invalid on 2020/07/21 03:20
linux-4.19	KASAN: use-after-free Read in ext4_xattr_set_entry (2)	19	C		done	7	1649d	2107d	1/1	fixed on 2021/10/13 07:23
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry ext4	19				1	2792d	2792d	0/29	closed as invalid on 2018/07/29 11:55
upstream	KASAN: out-of-bounds Read in ext4_xattr_set_entry ext4	22	C	error		7082	28m	544d	0/29	upstream: reported C repro on 2024/09/22 00:16
android-414	KASAN: use-after-free Read in ext4_xattr_set_entry	19				4	2639d	2532d	0/1	auto-closed as invalid on 2019/06/26 01:15
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (5) ext4	19				2	1333d	1392d	0/29	auto-obsoleted due to no activity on 2022/11/22 17:19
linux-5.15	KASAN: out-of-bounds Read in ext4_xattr_set_entry origin:upstream	19	C		error	58	1d17h	370d	0/3	upstream: reported C repro on 2025/03/15 11:50
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (3) ext4	19				4	2084d	2202d	0/29	auto-closed as invalid on 2020/11/02 08:32
linux-4.19	KASAN: use-after-free Read in ext4_xattr_set_entry	19	syz		done	10	2211d	2459d	1/1	fixed on 2020/03/30 09:03
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (4) ext4	22	C	error	done	21	1488d	1875d	20/29	fixed on 2022/03/28 10:17
upstream	KASAN: use-after-free Read in ext4_xattr_set_entry (2) ext4	19	C	done		19	2285d	2694d	15/29	fixed on 2020/02/14 01:19
android-54	KASAN: use-after-free Read in ext4_xattr_set_entry	19				6	2051d	2232d	0/2	auto-closed as invalid on 2020/12/04 21:44
linux-6.1	KASAN: out-of-bounds Read in ext4_xattr_set_entry missing-backport origin:lts-only	21	C		inconclusive	985	2h32m	1036d	0/3	upstream: reported C repro on 2023/05/19 08:42
android-5-10	KASAN: out-of-bounds Read in ext4_xattr_set_entry	19	C		inconclusive	150	1d11h	912d	0/2	upstream: reported C repro on 2023/09/20 02:40
linux-4.14	KASAN: use-after-free Read in ext4_xattr_set_entry	19	C		done	9	2239d	2331d	1/1	fixed on 2020/03/01 21:06
android-6-1	KASAN: out-of-bounds Read in ext4_xattr_set_entry origin:lts	21	C			721	1h52m	675d	0/2	upstream: reported C repro on 2024/05/13 18:18

================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x2e28/0x2f00 fs/ext4/xattr.c:1602 Read of size 4 at addr ffff88819a8b41a6 by task syz-executor.2/10215 CPU: 1 PID: 10215 Comm: syz-executor.2 Not tainted 4.14.151+ #0 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xca/0x134 lib/dump_stack.c:53 print_address_description+0x60/0x226 mm/kasan/report.c:187 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316 ext4_xattr_set_entry+0x2e28/0x2f00 fs/ext4/xattr.c:1602 ext4_xattr_ibody_set+0x73/0x280 fs/ext4/xattr.c:2238 ext4_xattr_set_handle+0x508/0xdd0 fs/ext4/xattr.c:2394 ext4_initxattrs+0xb5/0x110 fs/ext4/xattr_security.c:43 security_inode_init_security security/security.c:493 [inline] security_inode_init_security+0x246/0x330 security/security.c:466 __ext4_new_inode+0x336f/0x4850 fs/ext4/ialloc.c:1166 ext4_mkdir+0x2f7/0xb50 fs/ext4/namei.c:2776 vfs_mkdir2+0x3c7/0x640 fs/namei.c:3967 SYSC_mkdirat fs/namei.c:3996 [inline] SyS_mkdirat+0x125/0x220 fs/namei.c:3980 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459367 RSP: 002b:00007ffd83ccf7d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 000000000004835d RCX: 0000000000459367 RDX: 00007ffd83ccf824 RSI: 00000000000001ff RDI: 00007ffd83ccf820 RBP: 0000000000000141 R08: 0000000000000000 R09: 0000000000000004 R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000015 R13: 00007ffd83ccf810 R14: 0000000000048198 R15: 00007ffd83ccf820 The buggy address belongs to the page: page:ffffea00066a2d00 count:0 mapcount:-127 mapping: (null) index:0x1 flags: 0x4000000000000000() raw: 4000000000000000 0000000000000000 0000000000000001 00000000ffffff80 raw: ffffea0006c6b520 ffffea00070a9da0 0000000000000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88819a8b4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88819a8b4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88819a8b4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88819a8b4200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88819a8b4280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Manager
2019/10/31 13:34	android-4.14	2bb70f40b08b	a41ca8fa	.config	console log	report	ci-android-414-kasan-gce-root
2019/10/29 09:46	android-4.14	c9a4502888e7	5ea87a66	.config	console log	report	ci-android-414-kasan-gce-root
2019/10/28 18:16	android-4.14	0b383e2946f5	439d7b14	.config	console log	report	ci-android-414-kasan-gce-root
2019/10/19 20:05	android-4.14	234de92896af	8c88c9c1	.config	console log	report	ci-android-414-kasan-gce-root
2019/09/26 00:20	android-4.14	d649ef04c3ed	a3355dba	.config	console log	report	ci-android-414-kasan-gce-root
2019/09/05 20:30	android-4.14	38733badc0e6	040fda58	.config	console log	report	ci-android-414-kasan-gce-root

Crashes (6):

Assets (help?)