[Bug 200109] New: BUG: KASAN: use-after-free in ext4_xattr_set_entry fs/ext4/xattr.c:1598

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

https://bugzilla.kernel.org/show_bug.cgi?id=200109

            Bug ID: 200109
           Summary: BUG: KASAN: use-after-free in ext4_xattr_set_entry
                    fs/ext4/xattr.c:1598
           Product: File System
           Version: 2.5
    Kernel Version: v4.17
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@xxxxxxxxxxxxxxxxxxxx
          Reporter: icytxw@xxxxxxxxx
        Regression: No

Created attachment 276629
  --> https://bugzilla.kernel.org/attachment.cgi?id=276629&action=edit
found this with modified syzkaller

==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x2c6c/0x2f60
fs/ext4/xattr.c:1598
Read of size 4 at addr ffff880069696a64 by task syz-executor1/11113

CPU: 0 PID: 11113 Comm: syz-executor1 Not tainted 4.17.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
Call Trace:

The buggy address belongs to the page:
page:ffffea0001a5a580 count:0 mapcount:-128 mapping:0000000000000000 index:0x1
flags: 0x100000000000000()
raw: 0100000000000000 ffffea00019e4008 ffffea000172ee08 0000000000000000
raw: 0000000000000001 0000000000000001 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880069696900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff880069696980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff880069696a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
 ffff880069696a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff880069696b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 11113 Comm: syz-executor1 Tainted: G    B             4.17.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
Call Trace:
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

-- 
You are receiving this mail because:
You are watching the assignee of the bug.