Re: [syzbot] [ext4?] KASAN: use-after-free Read in ext4_ext_insert_extent

syzbot
2025-09-30T23:27:04Z

general protection fault in ext4_ext_map_blocks

EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 1 UID: 0 PID: 6473 Comm: syz.1.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:ext4_ext_map_blocks+0x2a1/0x38f0 fs/ext4/extents.c:4212
Code: 24 58 45 0f b7 3f 31 ff 44 89 fe e8 59 a6 51 ff 45 85 ff 74 29 e8 af a2 51 ff 4b 8d 1c 7f c1 e3 04 48 83 c3 20 89 d8 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 f0 10 b5 ff 48 8b 1b eb 0c e8 86
RSP: 0018:ffffc90003e8f060 EFLAGS: 00010206
RAX: 000000000000000a RBX: 0000000000000050 RCX: ffff88807cc91e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003e8f270 R08: ffffffff8f5ae037 R09: 1ffffffff1eb5c06
R10: dffffc0000000000 R11: fffffbfff1eb5c07 R12: ffffc90003e8f460
R13: 1ffff920007d1e24 R14: dffffc0000000000 R15: 0000000000000001
FS: 00007f8b97f5d6c0(0000) GS:ffff8881264d6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004000 CR3: 000000007a25c000 CR4: 00000000003526f0
Call Trace:
<TASK>
ext4_map_create_blocks fs/ext4/inode.c:609 [inline]
ext4_map_blocks+0x860/0x1740 fs/ext4/inode.c:811
_ext4_get_block+0x200/0x4c0 fs/ext4/inode.c:910
ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:943
ext4_block_write_begin+0x990/0x1710 fs/ext4/inode.c:1198
ext4_write_begin+0xc04/0x19a0 fs/ext4/ext4_jbd2.h:-1
ext4_da_write_begin+0x445/0xda0 fs/ext4/inode.c:3129
generic_perform_write+0x2c2/0x900 mm/filemap.c:4175
ext4_buffered_write_iter+0xce/0x3a0 fs/ext4/file.c:299
ext4_file_write_iter+0x298/0x1bc0 fs/ext4/file.c:-1
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_pwrite64 fs/read_write.c:793 [inline]
__do_sys_pwrite64 fs/read_write.c:801 [inline]
__se_sys_pwrite64 fs/read_write.c:798 [inline]
__x64_sys_pwrite64+0x193/0x220 fs/read_write.c:798
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8b9718e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8b97f5d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f8b973b5fa0 RCX: 00007f8b9718e969
RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004
RBP: 00007f8b97210ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f8b973b5fa0 R15: 00007ffea2f11788
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_ext_map_blocks+0x2a1/0x38f0 fs/ext4/extents.c:4212
Code: 24 58 45 0f b7 3f 31 ff 44 89 fe e8 59 a6 51 ff 45 85 ff 74 29 e8 af a2 51 ff 4b 8d 1c 7f c1 e3 04 48 83 c3 20 89 d8 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 f0 10 b5 ff 48 8b 1b eb 0c e8 86
RSP: 0018:ffffc90003e8f060 EFLAGS: 00010206
RAX: 000000000000000a RBX: 0000000000000050 RCX: ffff88807cc91e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003e8f270 R08: ffffffff8f5ae037 R09: 1ffffffff1eb5c06
R10: dffffc0000000000 R11: fffffbfff1eb5c07 R12: ffffc90003e8f460
R13: 1ffff920007d1e24 R14: dffffc0000000000 R15: 0000000000000001
FS: 00007f8b97f5d6c0(0000) GS:ffff8881263d6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555839b2c950 CR3: 000000007a25c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 24 58 and $0x58,%al
2: 45 0f b7 3f movzwl (%r15),%r15d
6: 31 ff xor %edi,%edi
8: 44 89 fe mov %r15d,%esi
b: e8 59 a6 51 ff call 0xff51a669
10: 45 85 ff test %r15d,%r15d
13: 74 29 je 0x3e
15: e8 af a2 51 ff call 0xff51a2c9
1a: 4b 8d 1c 7f lea (%r15,%r15,2),%rbx
1e: c1 e3 04 shl $0x4,%ebx
21: 48 83 c3 20 add $0x20,%rbx
25: 89 d8 mov %ebx,%eax
27: c1 e8 03 shr $0x3,%eax
* 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 f0 10 b5 ff call 0xffb51129
39: 48 8b 1b mov (%rbx),%rbx
3c: eb 0c jmp 0x4a
3e: e8 .byte 0xe8
3f: 86 .byte 0x86

Tested on:

commit: 22bdd6e6 Merge tag 'x86_apic_for_v6.18_rc1' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1664d05b980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6899ea2dd30a3ed1
dashboard link: https://syzkaller.appspot.com/bug?extid=9db318d6167044609878
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14057c14580000