Re: Kernel Bug: KASAN: use-after-free Read in ext4_find_extente

[Liebes Wang]

The config is attached.

Liebes Wang <wanghaichi0403@xxxxxxxxx> 于2026年3月18日周三 18:55写道：
>
> Dear Linux maintainers and reviewers:
>
> We are reporting a Linux kernel bug titled **KASAN: use-after-free
> Read in ext4_find_extente**.
>
> Linux version: 5ee8dbf54602dc340d6235b1d6aa17c0f283f48c (mainline latest)
>
> The bisection log shows the first introduced commit is
> 6347558764911f88acac06ab996e162f0c8a212d
> 6347558764911 ext4: refactor choose group to scan group
>
> The test case, kernel config and full bisection log are attached.
>
> The report is (The full reports are attached):
>
> This report is generated at kernel version 6.19.0-rc2
> (report-6.19.log). But we still verified this crash can be reproduced
> at the latest kernel version (latest_repro.log).
>
> ----
>
> BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:841 [inline]
> BUG: KASAN: use-after-free in ext4_find_extent+0x9ab/0xa00 fs/ext4/extents.c:956
> Read of size 4 at addr ff1100031ebe1400 by task syz.7.2557/41017
>
> CPU: 0 UID: 0 PID: 41017 Comm: syz.7.2557 Tainted: G             L
>  6.19.0-rc2-gccd1cdca5cd4 #1 PREEMPT(full)
> Tainted: [L]=SOFTLOCKUP
> Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
>  print_address_description mm/kasan/report.c:378 [inline]
>  print_report+0xca/0x5f0 mm/kasan/report.c:482
>  kasan_report+0xca/0x100 mm/kasan/report.c:595
>  ext4_ext_binsearch fs/ext4/extents.c:841 [inline]
>  ext4_find_extent+0x9ab/0xa00 fs/ext4/extents.c:956
>  ext4_ext_map_blocks+0x24a/0x6110 fs/ext4/extents.c:4208
>  ext4_map_query_blocks+0x110/0x900 fs/ext4/inode.c:549
>  ext4_map_blocks+0x49d/0x1250 fs/ext4/inode.c:778
>  _ext4_get_block+0x237/0x580 fs/ext4/inode.c:916
>  ext4_block_write_begin+0x9a6/0x1230 fs/ext4/inode.c:1203
>  ext4_write_begin+0x84e/0x1540 fs/ext4/inode.c:1364
>  generic_perform_write+0x3e8/0x900 mm/filemap.c:4314
>  ext4_buffered_write_iter+0x11a/0x430 fs/ext4/file.c:299
>  ext4_file_write_iter+0xa51/0x1c70 fs/ext4/file.c:723
>  new_sync_write fs/read_write.c:593 [inline]
>  vfs_write+0xc0b/0x1170 fs/read_write.c:686
>  ksys_write+0x121/0x240 fs/read_write.c:738
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x72/0xf80 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> RIP: 0033:0x7f1ec558feed
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f1ec63f5008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 00007f1ec57c5fa0 RCX: 00007f1ec558feed
> RDX: 000000000000f000 RSI: 0000400000000080 RDI: 0000000000000004
> RBP: 00007f1ec56317f4 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007f1ec57c5fa0 R15: 00007ffcbfa0a660
>  </TASK>

Attachment: kconfig-latest
Description: Binary data