=======================================================
EXT4-fs: Ignoring removed oldalloc option
EXT4-fs: Ignoring removed orlov option
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
Read of size 4 at addr ffff888122a3d018 by task syz.4.7/324
CPU: 1 PID: 324 Comm: syz.4.7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
ext4_ext_remove_space+0x2de/0x40d0 fs/ext4/extents.c:2834
ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4147
ext4_fallocate+0x2b6/0x1dc0 fs/ext4/extents.c:4767
vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
ioctl_preallocate fs/ioctl.c:290 [inline]
file_ioctl fs/ioctl.c:333 [inline]
do_vfs_ioctl+0x19cb/0x1cd0 fs/ioctl.c:849
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl+0x9f/0x1b0 fs/ioctl.c:856
__x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:856
x64_sys_call+0x58b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa7b079c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa7b16d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa7b0a15fa0 RCX: 00007fa7b079c799
RDX: 00002000000000c0 RSI: 0000000040305829 RDI: 0000000000000005
RBP: 00007fa7b0832c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa7b0a16038 R14: 00007fa7b0a15fa0 R15: 00007ffe142b3e78
The buggy address belongs to the physical page:
page:ffffea00048a8f40 refcount:1 mapcount:0 mapping:ffff8881335f94f8 index:0x2bc pfn:0x122a3d
memcg:ffff88810023b0c0
aops:shmem_aops ino:13 dentry name(?):"bus"
flags: 0x580000000008001e(referenced|uptodate|dirty|lru|swapbacked|zone=1)
raw: 580000000008001e ffffea00048a8f08 ffffea00048a8f88 ffff8881335f94f8
raw: 00000000000002bc 0000000000000000 00000001ffffffff ffff88810023b0c0
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 320, tgid 319 (syz.1.2), ts 23515570017, free_ts 20348924874
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2670
prep_new_page+0x1c/0x110 mm/page_alloc.c:2677
get_page_from_freelist+0x2d12/0x2d80 mm/page_alloc.c:4583
__alloc_pages+0x1fa/0x610 mm/page_alloc.c:5924
__folio_alloc+0x12/0x40 mm/page_alloc.c:5957
__folio_alloc_node include/linux/gfp.h:245 [inline]
folio_alloc include/linux/gfp.h:274 [inline]
shmem_alloc_folio mm/shmem.c:1597 [inline]
shmem_alloc_and_acct_folio+0x6dd/0x8c0 mm/shmem.c:1622
shmem_get_folio_gfp+0x119f/0x2230 mm/shmem.c:1951
shmem_get_folio mm/shmem.c:2082 [inline]
shmem_write_begin+0xea/0x2c0 mm/shmem.c:2567
generic_perform_write+0x32d/0x740 mm/filemap.c:3904
__generic_file_write_iter+0x17a/0x230 mm/filemap.c:4003
generic_file_write_iter+0xae/0x310 mm/filemap.c:4032
call_write_iter include/linux/fs.h:2282 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x603/0xce0 fs/read_write.c:584
ksys_write+0x149/0x250 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:646
x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1578 [inline]
free_pcp_prepare mm/page_alloc.c:1652 [inline]
free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3618
free_unref_page_list+0x117/0x8c0 mm/page_alloc.c:3769
release_pages+0xaf2/0xb50 mm/swap.c:1048
free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:315
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu mm/mmu_gather.c:261 [inline]
tlb_finish_mmu+0x1aa/0x370 mm/mmu_gather.c:361
unmap_region+0x2b7/0x320 mm/mmap.c:2419
do_mas_align_munmap+0xbed/0x1320 mm/mmap.c:2693
do_mas_munmap+0x241/0x2b0 mm/mmap.c:2751
__vm_munmap+0x1bd/0x330 mm/mmap.c:3050
__do_sys_munmap mm/mmap.c:3076 [inline]
__se_sys_munmap mm/mmap.c:3072 [inline]
__x64_sys_munmap+0x6b/0x80 mm/mmap.c:3072
x64_sys_call+0x8a/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Memory state around the buggy address:
ffff888122a3cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888122a3cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888122a3d000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888122a3d080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888122a3d100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:3190!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 324 Comm: syz.4.7 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:ext4_split_extent_at+0xf62/0xf80 fs/ext4/extents.c:3190
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 3f fb ff ff 4c 89 f7 49 89 f7 e8 9b b7 cf ff 4c 89 fe e9 2c fb ff ff e8 4e 7b 8a ff <0f> 0b e8 47 7b 8a ff 0f 0b e8 40 7b 8a ff 0f 0b e8 39 7b 8a ff 0f
RSP: 0018:ffffc9000dc9f4c0 EFLAGS: 00010246
RAX: ffffffff81e6f382 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90003a73000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000dc9f630 R08: 0000000000000000 R09: 0000000050000028
R10: dffffc0000000000 R11: fffffbfff0f6e4fd R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881336ec600
FS: 00007fa7b16d86c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa7b07e9e80 CR3: 0000000132f9f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ext4_force_split_extent_at fs/ext4/extents.c:338 [inline]
ext4_ext_remove_space+0x652/0x40d0 fs/ext4/extents.c:2881
ext4_punch_hole+0x77c/0xbd0 fs/ext4/inode.c:4147
ext4_fallocate+0x2b6/0x1dc0 fs/ext4/extents.c:4767
vfs_fallocate+0x4c5/0x5a0 fs/open.c:324
ioctl_preallocate fs/ioctl.c:290 [inline]
file_ioctl fs/ioctl.c:333 [inline]
do_vfs_ioctl+0x19cb/0x1cd0 fs/ioctl.c:849
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl+0x9f/0x1b0 fs/ioctl.c:856
__x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:856
x64_sys_call+0x58b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa7b079c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa7b16d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa7b0a15fa0 RCX: 00007fa7b079c799
RDX: 00002000000000c0 RSI: 0000000040305829 RDI: 0000000000000005
RBP: 00007fa7b0832c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa7b0a16038 R14: 00007fa7b0a15fa0 R15: 00007ffe142b3e78
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_split_extent_at+0xf62/0xf80 fs/ext4/extents.c:3190
Code: ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 3f fb ff ff 4c 89 f7 49 89 f7 e8 9b b7 cf ff 4c 89 fe e9 2c fb ff ff e8 4e 7b 8a ff <0f> 0b e8 47 7b 8a ff 0f 0b e8 40 7b 8a ff 0f 0b e8 39 7b 8a ff 0f
RSP: 0018:ffffc9000dc9f4c0 EFLAGS: 00010246
RAX: ffffffff81e6f382 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90003a73000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000dc9f630 R08: 0000000000000000 R09: 0000000050000028
R10: dffffc0000000000 R11: fffffbfff0f6e4fd R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881336ec600
FS: 00007fa7b16d86c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e90dff8 CR3: 0000000132f9f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400