On Fri, 04 Apr 2025 08:28:05 +0000, Artem Sadovnikov wrote:
> Syzkaller detected a use-after-free issue in ext4_insert_dentry that was
> caused by out-of-bounds access due to incorrect splitting in do_split.
>
> BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
> Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847
>
> CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:488
> kasan_report+0x143/0x180 mm/kasan/report.c:601
> kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
> __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
> ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
> add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154
> make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351
> ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455
> ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796
> ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431
> vfs_symlink+0x137/0x2e0 fs/namei.c:4615
> do_symlinkat+0x222/0x3a0 fs/namei.c:4641
> __do_sys_symlink fs/namei.c:4662 [inline]
> __se_sys_symlink fs/namei.c:4660 [inline]
> __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> [...]
Applied, thanks!
[1/1] ext4: fix off-by-one error in do_split
commit: 7e50bbb134aba1df0854f171b596b3a42d35605a
(Apologies for sending this late; I've been dealing with a family
medical emergency. In any case, the patch landed in v6.16-rc2.)
Best regards,
--
Theodore Ts'o <tytso@xxxxxxx>
