[BUG] KASAN: slab-use-after-free Write in f2fs_setxattr (ocfs2 leaks a hashed inode on mount failure)
From: Farhad Alemi
Date: Thu Sep 10 2026 - 17:44:10 EST
Hello,
We are reporting the following crash (reproducer attached and a
proposed patch forthcoming):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 68.240647][ T9507] BUG: KASAN: slab-use-after-free in down_write+0x96/0x200
[ 68.240686][ T9507] Read of size 1 at addr ffff888031684820 by task
repro/9507
[ 68.240692][ T9507]
[ 68.240706][ T9507] CPU: 0 UID: 0 PID: 9507 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 68.240714][ T9507] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 68.240723][ T9507] Call Trace:
[ 68.240728][ T9507] <TASK>
[ 68.240734][ T9507] dump_stack_lvl+0xe8/0x150
[ 68.240746][ T9507] print_address_description+0x55/0x1e0
[ 68.240755][ T9507] ? down_write+0x96/0x200
[ 68.240762][ T9507] print_report+0x58/0x70
[ 68.240769][ T9507] kasan_report+0x117/0x150
[ 68.240782][ T9507] ? down_write+0x96/0x200
[ 68.240790][ T9507] __kasan_check_byte+0x2a/0x40
[ 68.240800][ T9507] lock_acquire+0x7d/0x350
[ 68.240812][ T9507] down_write+0x96/0x200
[ 68.240819][ T9507] ? f2fs_setxattr+0x258/0x460
[ 68.240832][ T9507] ? __pfx_down_write+0x10/0x10
[ 68.240839][ T9507] ? down_read+0x2be/0x330
[ 68.240846][ T9507] ? f2fs_down_read_trace+0x50/0x1f0
[ 68.240856][ T9507] f2fs_setxattr+0x258/0x460
[ 68.240864][ T9507] ? __pfx_f2fs_setxattr+0x10/0x10
[ 68.240872][ T9507] ? posix_xattr_acl+0x93/0xc0
[ 68.240883][ T9507] ? evm_protect_xattr+0x4d4/0xac0
[ 68.240891][ T9507] f2fs_xattr_generic_set+0x133/0x170
[ 68.240899][ T9507] ? __pfx_f2fs_xattr_generic_set+0x10/0x10
[ 68.240905][ T9507] __vfs_setxattr+0x43c/0x480
[ 68.240915][ T9507] __vfs_setxattr_noperm+0x12d/0x660
[ 68.240923][ T9507] vfs_setxattr+0x163/0x360
[ 68.240931][ T9507] ? __pfx_vfs_setxattr+0x10/0x10
[ 68.240939][ T9507] filename_setxattr+0x296/0x630
[ 68.240948][ T9507] ? __pfx_filename_setxattr+0x10/0x10
[ 68.240955][ T9507] ? do_getname+0x151/0x250
[ 68.240968][ T9507] path_setxattrat+0x3eb/0x440
[ 68.240978][ T9507] ? __pfx_path_setxattrat+0x10/0x10
[ 68.240991][ T9507] ? rcu_is_watching+0x16/0xb0
[ 68.241004][ T9507] __x64_sys_lsetxattr+0xbf/0xe0
[ 68.241012][ T9507] do_syscall_64+0x155/0x510
[ 68.241025][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.241033][ T9507] ? clear_bhb_loop+0x30/0x80
[ 68.241042][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.241049][ T9507] RIP: 0033:0x4144ae
[ 68.241059][ T9507] Code: ff ff ff f7 d8 64 89 02 ba ff ff ff ff eb
d3 e8 08 0a 00 00 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 bd
00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 f0 ff ff ff f7 d8
64 89 01 48
[ 68.241068][ T9507] RSP: 002b:00007ffcf0857128 EFLAGS: 00000246
ORIG_RAX: 00000000000000bd
[ 68.241080][ T9507] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 00000000004144ae
[ 68.241085][ T9507] RDX: 0000000000489c04 RSI: 0000000000489c15
RDI: 0000000000489c2b
[ 68.241090][ T9507] RBP: 00007ffcf0857250 R08: 0000000000000000
R09: 0000000000000000
[ 68.241095][ T9507] R10: 0000000000000010 R11: 0000000000000246
R12: 00007ffcf0857378
[ 68.241099][ T9507] R13: 00007ffcf0857388 R14: 0000000000000002
R15: 00000000004b07c0
[ 68.241107][ T9507] </TASK>
[ 68.241109][ T9507]
[ 68.241113][ T9507] Allocated by task 9507:
[ 68.241116][ T9507] kasan_save_track+0x3e/0x80
[ 68.241125][ T9507] __kasan_slab_alloc+0x6c/0x80
[ 68.241133][ T9507] kmem_cache_alloc_lru_noprof+0x2a7/0x600
[ 68.241143][ T9507] ocfs2_alloc_inode+0x2a/0xf0
[ 68.241154][ T9507] alloc_inode+0x6a/0x1b0
[ 68.241164][ T9507] iget5_locked+0x4a/0xa0
[ 68.241170][ T9507] ocfs2_iget+0x213/0x1b30
[ 68.241182][ T9507] ocfs2_init_global_system_inodes+0x16d/0x6e0
[ 68.241190][ T9507] ocfs2_fill_super+0x4592/0x6950
[ 68.241197][ T9507] get_tree_bdev_flags+0x431/0x4f0
[ 68.241206][ T9507] vfs_get_tree+0x92/0x2a0
[ 68.241213][ T9507] do_new_mount+0x341/0xd30
[ 68.241227][ T9507] __se_sys_mount+0x31d/0x420
[ 68.241233][ T9507] do_syscall_64+0x155/0x510
[ 68.241242][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.241249][ T9507]
[ 68.241251][ T9507] Freed by task 15:
[ 68.241254][ T9507] kasan_save_track+0x3e/0x80
[ 68.241262][ T9507] kasan_save_free_info+0x46/0x50
[ 68.241268][ T9507] __kasan_slab_free+0x5c/0x80
[ 68.241276][ T9507] kmem_cache_free+0x182/0x650
[ 68.241284][ T9507] rcu_core+0x985/0x1250
[ 68.241293][ T9507] handle_softirqs+0x22c/0x860
[ 68.241300][ T9507] run_ksoftirqd+0x36/0x60
[ 68.241307][ T9507] smpboot_thread_fn+0x562/0xa60
[ 68.241315][ T9507] kthread+0x38b/0x480
[ 68.241324][ T9507] ret_from_fork+0x514/0xb70
[ 68.241333][ T9507] ret_from_fork_asm+0x1a/0x30
[ 68.241342][ T9507]
[ 68.241343][ T9507] Last potentially related work creation:
[ 68.241346][ T9507] kasan_save_stack+0x3e/0x60
[ 68.241354][ T9507] kasan_record_aux_stack+0xbd/0xd0
[ 68.241360][ T9507] call_rcu+0xee/0x890
[ 68.241369][ T9507] evict+0x95b/0xb10
[ 68.241378][ T9507] ocfs2_iget+0xfde/0x1b30
[ 68.241387][ T9507] ocfs2_init_global_system_inodes+0x16d/0x6e0
[ 68.241395][ T9507] ocfs2_fill_super+0x4592/0x6950
[ 68.241402][ T9507] get_tree_bdev_flags+0x431/0x4f0
[ 68.241409][ T9507] vfs_get_tree+0x92/0x2a0
[ 68.241416][ T9507] do_new_mount+0x341/0xd30
[ 68.241422][ T9507] __se_sys_mount+0x31d/0x420
[ 68.241427][ T9507] do_syscall_64+0x155/0x510
[ 68.241436][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.241443][ T9507]
[ 68.241444][ T9507] The buggy address belongs to the object at
ffff888031684600
[ 68.241444][ T9507] which belongs to the cache ocfs2_inode_cache
of size 3416
[ 68.241451][ T9507] The buggy address is located 544 bytes inside of
[ 68.241451][ T9507] freed 3416-byte region [ffff888031684600,
ffff888031685358)
[ 68.241468][ T9507]
[ 68.241470][ T9507] The buggy address belongs to the physical page:
[ 68.241479][ T9507] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0xffff888031682a00 pfn:0x31680
[ 68.241488][ T9507] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[ 68.241493][ T9507] memcg:ffff888031687e01
[ 68.241496][ T9507] flags:
0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 68.241506][ T9507] page_type: f5(slab)
[ 68.241515][ T9507] raw: 00fff00000000240 ffff888105f23000
ffff88801bb4c708 ffffea0000c5a410
[ 68.241521][ T9507] raw: ffff888031682a00 0000000200090006
00000000f5000000 ffff888031687e01
[ 68.241528][ T9507] head: 00fff00000000240 ffff888105f23000
ffff88801bb4c708 ffffea0000c5a410
[ 68.241533][ T9507] head: ffff888031682a00 0000000200090006
00000000f5000000 ffff888031687e01
[ 68.241539][ T9507] head: 00fff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[ 68.241545][ T9507] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[ 68.241548][ T9507] page dumped because: kasan: bad access detected
[ 68.241554][ T9507] page_owner tracks the page as allocated
[ 68.241557][ T9507] page last allocated via order 3, migratetype
Reclaimable, gfp_mask
0xd2050(__GFP_RECLAIMABLE|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 9507, tgid 9507 (repro), ts 54947607160
[ 68.241571][ T9507] post_alloc_hook+0x1f9/0x250
[ 68.241579][ T9507] get_page_from_freelist+0x235a/0x23e0
[ 68.241587][ T9507] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 68.241595][ T9507] allocate_slab+0x7d/0x610
[ 68.241601][ T9507] refill_objects+0x2d6/0x350
[ 68.241607][ T9507] __pcs_replace_empty_main+0x2c9/0x6c0
[ 68.241617][ T9507] kmem_cache_alloc_lru_noprof+0x38d/0x600
[ 68.241624][ T9507] ocfs2_alloc_inode+0x2a/0xf0
[ 68.241632][ T9507] alloc_inode+0x6a/0x1b0
[ 68.241640][ T9507] iget5_locked+0x4a/0xa0
[ 68.241646][ T9507] ocfs2_iget+0x213/0x1b30
[ 68.241654][ T9507] ocfs2_init_global_system_inodes+0xc8/0x6e0
[ 68.241662][ T9507] ocfs2_fill_super+0x4592/0x6950
[ 68.241669][ T9507] get_tree_bdev_flags+0x431/0x4f0
[ 68.241675][ T9507] vfs_get_tree+0x92/0x2a0
[ 68.241682][ T9507] do_new_mount+0x341/0xd30
[ 68.241687][ T9507] page_owner free stack trace missing
[ 68.241690][ T9507]
[ 68.241691][ T9507] Memory state around the buggy address:
[ 68.241695][ T9507] ffff888031684700: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 68.241700][ T9507] ffff888031684780: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 68.241704][ T9507] >ffff888031684800: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 68.241707][ T9507] ^
[ 68.241711][ T9507] ffff888031684880: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 68.241715][ T9507] ffff888031684900: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 68.241718][ T9507]
==================================================================
[ 68.241750][ T9507] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 68.319921][ T9507] CPU: 0 UID: 0 PID: 9507 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 68.320872][ T9507] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 68.321866][ T9507] Call Trace:
[ 68.322191][ T9507] <TASK>
[ 68.322482][ T9507] vpanic+0x56d/0xa60
[ 68.322875][ T9507] ? __pfx_vpanic+0x10/0x10
[ 68.323350][ T9507] ? __pfx___schedule+0x10/0x10
[ 68.323803][ T9507] panic+0xc5/0xd0
[ 68.324151][ T9507] ? __pfx_panic+0x10/0x10
[ 68.324564][ T9507] ? preempt_schedule_thunk+0x16/0x40
[ 68.325061][ T9507] ? down_write+0x96/0x200
[ 68.325474][ T9507] check_panic_on_warn+0x89/0xb0
[ 68.325931][ T9507] ? down_write+0x96/0x200
[ 68.326342][ T9507] end_report+0x73/0x170
[ 68.326738][ T9507] ? down_write+0x96/0x200
[ 68.327146][ T9507] kasan_report+0x128/0x150
[ 68.327570][ T9507] ? down_write+0x96/0x200
[ 68.327982][ T9507] __kasan_check_byte+0x2a/0x40
[ 68.328435][ T9507] lock_acquire+0x7d/0x350
[ 68.328848][ T9507] down_write+0x96/0x200
[ 68.329243][ T9507] ? f2fs_setxattr+0x258/0x460
[ 68.329685][ T9507] ? __pfx_down_write+0x10/0x10
[ 68.330130][ T9507] ? down_read+0x2be/0x330
[ 68.330545][ T9507] ? f2fs_down_read_trace+0x50/0x1f0
[ 68.331028][ T9507] f2fs_setxattr+0x258/0x460
[ 68.331455][ T9507] ? __pfx_f2fs_setxattr+0x10/0x10
[ 68.331923][ T9507] ? posix_xattr_acl+0x93/0xc0
[ 68.332367][ T9507] ? evm_protect_xattr+0x4d4/0xac0
[ 68.332834][ T9507] f2fs_xattr_generic_set+0x133/0x170
[ 68.333393][ T9507] ? __pfx_f2fs_xattr_generic_set+0x10/0x10
[ 68.333928][ T9507] __vfs_setxattr+0x43c/0x480
[ 68.334375][ T9507] __vfs_setxattr_noperm+0x12d/0x660
[ 68.334856][ T9507] vfs_setxattr+0x163/0x360
[ 68.335275][ T9507] ? __pfx_vfs_setxattr+0x10/0x10
[ 68.335737][ T9507] filename_setxattr+0x296/0x630
[ 68.336191][ T9507] ? __pfx_filename_setxattr+0x10/0x10
[ 68.336691][ T9507] ? do_getname+0x151/0x250
[ 68.337111][ T9507] path_setxattrat+0x3eb/0x440
[ 68.337555][ T9507] ? __pfx_path_setxattrat+0x10/0x10
[ 68.338043][ T9507] ? rcu_is_watching+0x16/0xb0
[ 68.338489][ T9507] __x64_sys_lsetxattr+0xbf/0xe0
[ 68.338944][ T9507] do_syscall_64+0x155/0x510
[ 68.339375][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.339924][ T9507] ? clear_bhb_loop+0x30/0x80
[ 68.340358][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.340893][ T9507] RIP: 0033:0x4144ae
[ 68.341258][ T9507] Code: ff ff ff f7 d8 64 89 02 ba ff ff ff ff eb
d3 e8 08 0a 00 00 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 bd
00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 f0 ff ff ff f7 d8
64 89 01 48
[ 68.343039][ T9507] RSP: 002b:00007ffcf0857128 EFLAGS: 00000246
ORIG_RAX: 00000000000000bd
[ 68.343794][ T9507] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 00000000004144ae
[ 68.344507][ T9507] RDX: 0000000000489c04 RSI: 0000000000489c15
RDI: 0000000000489c2b
[ 68.345227][ T9507] RBP: 00007ffcf0857250 R08: 0000000000000000
R09: 0000000000000000
[ 68.345942][ T9507] R10: 0000000000000010 R11: 0000000000000246
R12: 00007ffcf0857378
[ 68.346655][ T9507] R13: 00007ffcf0857388 R14: 0000000000000002
R15: 00000000004b07c0
[ 68.347375][ T9507] </TASK>
[ 68.348313][ T9507] Kernel Offset: disabled
Regards,
SEFCOM Lab @ ASU
Attachment:
reproducer.c
Description: Binary data