[Android 5.15] KASAN: slab-out-of-bounds Write in ext4_expand_extra_isize_ea

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 31c263582f4e Revert "spi: topcliff-pch: Convert to platfor..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14e48746580000
kernel config: https://syzkaller.appspot.com/x/.config?x=43676e801f1929a9
dashboard link: https://syzkaller.appspot.com/bug?extid=d5291b745ca3a19ad2d6
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c3bcb9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10cf1789580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fa25a72d6602/disk-31c26358.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f3603d6e2228/vmlinux-31c26358.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dd7e7e64f2ca/bzImage-31c26358.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5955ba5201f1/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=14e71cb9580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5291b...@syzkaller.appspotmail.com

EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.2274: bg 0: block 144: padding at end of block bitmap is not set
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
BUG: KASAN: use-after-free in ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
Write of size 72 at addr ffff88811cdc73a0 by task syz.6.2274/9006

CPU: 1 PID: 9006 Comm: syz.6.2274 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<TASK>
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
memmove+0x44/0x70 mm/kasan/shadow.c:55
ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
__ext4_expand_extra_isize+0x2fe/0x3e0 fs/ext4/inode.c:5955
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
__ext4_mark_inode_dirty+0x39d/0x5e0 fs/ext4/inode.c:6076
ext4_dirty_inode+0xbd/0x100 fs/ext4/inode.c:6108
__mark_inode_dirty+0x1ef/0x9c0 fs/fs-writeback.c:2486
generic_update_time fs/inode.c:1891 [inline]
inode_update_time fs/inode.c:1904 [inline]
touch_atime+0x333/0x500 fs/inode.c:1976
file_accessed include/linux/fs.h:2566 [inline]
filemap_read+0x1fa8/0x21e0 mm/filemap.c:2737
generic_file_read_iter+0xac/0x420 mm/filemap.c:2816
ext4_file_read_iter+0x2e8/0x500 fs/ext4/file.c:-1
call_read_iter include/linux/fs.h:2206 [inline]
generic_file_splice_read+0x3ea/0x5f0 fs/splice.c:311
do_splice_to fs/splice.c:796 [inline]
splice_direct_to_actor+0x40f/0xb40 fs/splice.c:870
do_splice_direct+0x1c2/0x2d0 fs/splice.c:979
do_sendfile+0x515/0xe20 fs/read_write.c:1249
__do_sys_sendfile64 fs/read_write.c:1317 [inline]
__se_sys_sendfile64 fs/read_write.c:1303 [inline]
__x64_sys_sendfile64+0x199/0x1f0 fs/read_write.c:1303
x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d1c019e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1be7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f5d1c2a1fa0 RCX: 00007f5d1c019e99
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 00007f5d1c0afeaf R08: 0000000000000000 R09: 0000000000000000
R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5d1c2a2038 R14: 00007f5d1c2a1fa0 R15: 00007ffc90540dd8
</TASK>

The buggy address belongs to the page:
page:ffffea00047371c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cdc7
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004c47bc8 ffffea0004c49948 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 379, ts 410440801058, free_ts 410559723322
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
__alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
__alloc_pages_node include/linux/gfp.h:595 [inline]
alloc_pages_node include/linux/gfp.h:609 [inline]
alloc_pages include/linux/gfp.h:622 [inline]
__get_free_pages+0x10/0x30 mm/page_alloc.c:5861
_pgd_alloc arch/x86/mm/pgtable.c:414 [inline]
pgd_alloc+0x22/0x2b0 arch/x86/mm/pgtable.c:430
mm_alloc_pgd kernel/fork.c:694 [inline]
mm_init+0x594/0xa70 kernel/fork.c:1144
dup_mm kernel/fork.c:1524 [inline]
copy_mm+0x1c6/0x13a0 kernel/fork.c:1579
copy_process+0x1184/0x3280 kernel/fork.c:2353
kernel_clone+0x233/0x960 kernel/fork.c:2742
__do_sys_clone kernel/fork.c:2868 [inline]
__se_sys_clone kernel/fork.c:2852 [inline]
__x64_sys_clone+0x198/0x210 kernel/fork.c:2852
x64_sys_call+0x41f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:57
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1474 [inline]
free_pcp_prepare mm/page_alloc.c:1546 [inline]
free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
free_unref_page+0xae/0x540 mm/page_alloc.c:3618
free_the_page mm/page_alloc.c:805 [inline]
__free_pages+0x6c/0x100 mm/page_alloc.c:5900
free_pages+0x82/0x90 mm/page_alloc.c:5911
_pgd_free arch/x86/mm/pgtable.c:420 [inline]
pgd_free+0x1a2/0x1c0 arch/x86/mm/pgtable.c:476
mm_free_pgd kernel/fork.c:702 [inline]
__mmdrop+0xad/0x500 kernel/fork.c:753
mmdrop include/linux/sched/mm.h:49 [inline]
finish_task_switch+0x2bb/0x790 kernel/sched/core.c:5075
context_switch kernel/sched/core.c:5181 [inline]
__schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
schedule+0x11e/0x1e0 kernel/sched/core.c:6621
freezable_schedule include/linux/freezer.h:197 [inline]
do_nanosleep+0x19f/0x630 kernel/time/hrtimer.c:2048
hrtimer_nanosleep+0x1b6/0x3d0 kernel/time/hrtimer.c:2101
common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
__se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
__x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
x64_sys_call+0x824/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:231
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
ffff88811cdc7280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88811cdc7300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88811cdc7380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88811cdc7400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88811cdc7480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup