https://bugzilla.kernel.org/show_bug.cgi?id=200109 Bug ID: 200109 Summary: BUG: KASAN: use-after-free in ext4_xattr_set_entry fs/ext4/xattr.c:1598 Product: File System Version: 2.5 Kernel Version: v4.17 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: ext4 Assignee: fs_ext4@xxxxxxxxxxxxxxxxxxxx Reporter: icytxw@xxxxxxxxx Regression: No Created attachment 276629 --> https://bugzilla.kernel.org/attachment.cgi?id=276629&action=edit found this with modified syzkaller ================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x2c6c/0x2f60 fs/ext4/xattr.c:1598 Read of size 4 at addr ffff880069696a64 by task syz-executor1/11113 CPU: 0 PID: 11113 Comm: syz-executor1 Not tainted 4.17.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Call Trace: The buggy address belongs to the page: page:ffffea0001a5a580 count:0 mapcount:-128 mapping:0000000000000000 index:0x1 flags: 0x100000000000000() raw: 0100000000000000 ffffea00019e4008 ffffea000172ee08 0000000000000000 raw: 0000000000000001 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff880069696900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff880069696980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff880069696a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff880069696a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff880069696b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 11113 Comm: syz-executor1 Tainted: G B 4.17.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Call Trace: Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds.. -- You are receiving this mail because: You are watching the assignee of the bug.