================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:826 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:945 Read of size 4 at addr ffff88812d341b80 by task kworker/u4:5/1199 CPU: 1 PID: 1199 Comm: kworker/u4:5 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: writeback wb_workfn (flush-7:9) Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 ext4_ext_binsearch fs/ext4/extents.c:826 [inline] ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:945 ext4_ext_map_blocks+0x204/0x5da0 fs/ext4/extents.c:4191 ext4_map_blocks+0x979/0x1b10 fs/ext4/inode.c:676 mpage_map_one_extent fs/ext4/inode.c:2454 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2507 [inline] ext4_writepages+0x1238/0x2f00 fs/ext4/inode.c:2875 do_writepages+0x12e/0x280 mm/page-writeback.c:2380 __writeback_single_inode+0xd9/0xa30 fs/fs-writeback.c:1470 writeback_sb_inodes+0x96d/0x1680 fs/fs-writeback.c:1733 wb_writeback+0x40f/0xb80 fs/fs-writeback.c:1908 wb_do_writeback fs/fs-writeback.c:2053 [inline] wb_workfn+0x3ac/0xf30 fs/fs-writeback.c:2094 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447 kthread+0x324/0x3b0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the page: page:ffffea0004b4d040 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12d341 flags: 0x4000000000000000() raw: 4000000000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x100cca(GFP_HIGHUSER_MOVABLE), pid 1754, ts 84222941502, free_ts 84871442084 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 __alloc_pages include/linux/gfp.h:544 [inline] __alloc_pages_node include/linux/gfp.h:557 [inline] alloc_pages_node include/linux/gfp.h:571 [inline] alloc_pages include/linux/gfp.h:590 [inline] shmem_alloc_page+0x1fd/0x380 mm/shmem.c:1580 shmem_alloc_and_acct_page+0x3d3/0x840 mm/shmem.c:1605 shmem_getpage_gfp+0x785/0x20f0 mm/shmem.c:1918 shmem_getpage mm/shmem.c:161 [inline] shmem_write_begin+0xce/0x1b0 mm/shmem.c:2497 generic_perform_write+0x2ce/0x540 mm/filemap.c:3509 __generic_file_write_iter+0x24b/0x480 mm/filemap.c:3638 generic_file_write_iter+0xa9/0x1d0 mm/filemap.c:3670 call_write_iter include/linux/fs.h:2066 [inline] new_sync_write fs/read_write.c:518 [inline] vfs_write+0x770/0xd70 fs/read_write.c:605 ksys_write+0x14a/0x260 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:667 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] free_pcp_prepare mm/page_alloc.c:1421 [inline] free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336 free_unref_page_list+0x129/0x9c0 mm/page_alloc.c:3443 release_pages+0xe41/0xe90 mm/swap.c:1103 __pagevec_release+0x71/0xe0 mm/swap.c:1123 pagevec_release include/linux/pagevec.h:88 [inline] shmem_undo_range+0x741/0x1740 mm/shmem.c:965 shmem_truncate_range mm/shmem.c:1069 [inline] shmem_evict_inode+0x1dc/0x970 mm/shmem.c:1169 evict+0x4a9/0x940 fs/inode.c:612 iput_final fs/inode.c:1736 [inline] iput+0x654/0x7e0 fs/inode.c:1762 dentry_unlink_inode+0x2d5/0x390 fs/dcache.c:378 __dentry_kill+0x45b/0x660 fs/dcache.c:583 dentry_kill+0xc0/0x2a0 fs/dcache.c:-1 dput+0x42/0x80 fs/dcache.c:883 __fput+0x4bd/0x730 fs/file_table.c:294 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 Memory state around the buggy address: ffff88812d341a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812d341b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88812d341b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88812d341c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88812d341c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== EXT4-fs error (device loop9): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:5: lblock 5 mapped to illegal pblock 23 (length 1) Quota error (device loop9): qtree_write_dquot: dquota write failed EXT4-fs error (device loop9): ext4_write_dquot:6210: comm kworker/u4:5: Failed to commit dquot type 0 EXT4-fs error (device loop9): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:5: lblock 5 mapped to illegal pblock 29 (length 1) Quota error (device loop9): qtree_write_dquot: dquota write failed EXT4-fs error (device loop9): ext4_write_dquot:6210: comm kworker/u4:5: Failed to commit dquot type 1 EXT4-fs error (device loop9): __ext4_get_inode_loc:4451: comm kworker/u4:5: Invalid inode table block 1061109567 in block_group 0 Quota error (device loop9): qtree_write_dquot: dquota write failed Quota error (device loop9): qtree_write_dquot: dquota write failed EXT4-fs (loop9): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117 EXT4-fs (loop9): This should not happen!! Data will be lost