From nobody Thu Apr 2 15:35:56 2026 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C659C21FF23 for ; Fri, 27 Mar 2026 13:28:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774618084; cv=none; b=LPC8acb1H4KIzWHLDaPN5WNI57dOttn0e6nBSYZZpZWdzN9HU9TLZoJiZmv7V+MvqiF5PnmFMyzz00DTWWqTH1uev03YARflMcdKQ88VJjQ10Py6duQBlyIhVT3WwYuIbIyHRNqm+gdBxpWTdjBmeJbbdyQVzZRzO6WkBb07hO4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774618084; c=relaxed/simple; bh=hAuyVDvgnLTcgLyR1DrEv7Q/Lj78Qt76hddfIRwJrYY=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=e+z0V7Bk87f6e/RnU3binCjZzWSFgD/PCILF12JaPT8rZWDtusAY7LFzYmxdTzDrE6ng6SGZiHYaOK0zWJAnt/xJOBbylFMNofPgwzulHMr1no5/TIGF57Q5qfPXkc7tJvaAGcj6xHWV7Vf7PSJIWfnCUlB+Q0WSdNlx97vlF7M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-67df8dd0e26so3136771eaf.1 for ; Fri, 27 Mar 2026 06:28:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774618082; x=1775222882; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=1EzzlCDNx8nOsTbn+5Ldm+4JUn+xhnx/722Dq+8XwFY=; b=WNW2qHSqIUcQ6q96mmU+i6xezxcsJqf8Q3kWvY/lYMj4Voe1Y6yrciupljt+6CZVTD Wtdfm0qzD9clrs+B0E5kevN8JIBPo2IlSyBcpqayJam3zLHZGdU8ZsakIPgtnLUtjISc WD3TMEIK+TBuo7NiAIdjQydqnXQGlcayusLkoVTEKKOYCLidu2fGXHcjt+T+IY614aow 6dQRHN9gelBolzDnwWsYlSAacCXK4ecRFn6yHSla5mulQRP3k/KWkVRUIDNM8I31YgCU 0ryAdID94jUiKsta3GWTUf+xms/Rn/s/InYCoh6nr44vI4mwNBbctGFqyfPjpl3JzqDJ 9W8w== X-Gm-Message-State: AOJu0YxzgLx//cdv75WPcBAHEVfiI/1wr9lkrHJ/MWk9InWzAvNUDlZ2 Yz7muBRrJV3awDU3o/1zDZrBvO02RbqhzpFJMrNRgvI8c5HDiK8hoR9sshqYUBOjpJvCc5A1A2Z KwZxNtvzHx5+E/D+SJrsgySMhWl7z4xrdQ+4eTxCCm7ce0cIv/gbFF6P9OG4= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:1c9f:b0:67d:ea9d:c89b with SMTP id 006d021491bc7-67e1870c03dmr1165539eaf.40.1774618081786; Fri, 27 Mar 2026 06:28:01 -0700 (PDT) Date: Fri, 27 Mar 2026 06:28:01 -0700 In-Reply-To: <699b9b6f.a70a0220.2c38d7.0189.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69c685e1.050a0220.172bcd.0003.GAE@google.com> Subject: Forwarded: [PATCH] ext4: add debug printk to trace xattr validation path From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] ext4: add debug printk to trace xattr validation path Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master Add temporary printk statements to trace the inline xattr validation code path for debugging syzbot use-after-free in xattr_find_entry(). This helps determine whether __xattr_check_inode() is being called before ext4_xattr_ibody_get() accesses inline xattr entries, and what the IFIRST/ITAIL gap values are at each stage. Not for upstream submission - debug only. Reported-by: syzbot+fb32afec111a7d61b939@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dfb32afec111a7d61b939 Signed-off-by: Deepanshu Kartikey --- fs/ext4/inode.c | 4 ++++ fs/ext4/xattr.c | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 396dc3a5d16b..af3a6992bf20 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5331,11 +5331,15 @@ struct inode *__ext4_iget(struct super_block *sb, u= nsigned long ino, =20 if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { if (ei->i_extra_isize =3D=3D 0) { + printk("DEBUG: inode %lu: i_extra_isize =3D=3D 0, skipping xattr check= \n", + inode->i_ino); /* The extra space is currently unused. Use it. */ BUILD_BUG_ON(sizeof(struct ext4_inode) & 3); ei->i_extra_isize =3D sizeof(struct ext4_inode) - EXT4_GOOD_OLD_INODE_SIZE; } else { + printk("DEBUG: inode %lu: calling ext4_iget_extra_inode\n", + inode->i_ino); ret =3D ext4_iget_extra_inode(inode, raw_inode, ei); if (ret) goto bad_inode; diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 7bf9ba19a89d..abc27521a3a8 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -316,6 +316,9 @@ int __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *h= eader, void *end, const char *function, unsigned int line) { + printk("DEBUG: inode %lu: __xattr_check_inode called, IFIRST=3D%px end=3D= %px gap=3D%ld\n", + inode->i_ino, IFIRST(header), end, + (long)(end - (void *)IFIRST(header))); return check_xattrs(inode, NULL, IFIRST(header), end, IFIRST(header), function, line); } @@ -645,6 +648,8 @@ ext4_xattr_ibody_get(struct inode *inode, int name_inde= x, const char *name, =20 if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR)) return -ENODATA; + printk("DEBUG: inode %lu: ext4_xattr_ibody_get called, EXT4_STATE_XATTR i= s set\n", + inode->i_ino); error =3D ext4_get_inode_loc(inode, &iloc); if (error) return error; @@ -652,6 +657,9 @@ ext4_xattr_ibody_get(struct inode *inode, int name_inde= x, const char *name, header =3D IHDR(inode, raw_inode); end =3D ITAIL(inode, raw_inode); entry =3D IFIRST(header); + printk("DEBUG: inode %lu: ibody_get IFIRST=3D%px end=3D%px gap=3D%ld\n", + inode->i_ino, entry, end, + (long)(end - (void *)entry)); error =3D xattr_find_entry(inode, &entry, end, name_index, name, 0); if (error) goto cleanup; --=20 2.43.0