program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xfe, 0x45e, &(0x7f000000ff40)="$eJzs3MuPFMUfAPBv98wu79/uT/EBgq6ikfjYZZfnwYMYTTxoYqIHjKd1dyHIwiq7JkKIogc8GhLvxqOJf4EnvRj1ZOJV74aEGC6gicmY7umeHYeZdYcdGGA+n6ShqruGqm9310x11QwBDKyx7I8kYnNE/BoRI/XsvwuM1f+6duXczJ9Xzs0kUau9/keSl7t65dxMWbR83aZ6plYr8uva1HvhrYjp+fm500V+YunkuxOLZ84+e/zk9LG5Y3Onpg4d2rd35/CBqf09iTOL6+r2Dxd2bHv5zYuvzhy5+PaPX2ft3Vwcb46jV8bqZ7etJ3pdWZ9taUon1Yjn+9gWVq8SEdWIGMr7/0hUYkPj2Ei89ElfGwfcVLVardbu87lwvgbcxZLodwuA/ig/6LPn33K7RUOP28LlwxHvHazHf63Y6keqkRZlhlqeb3tpLCKOnP/ri2yLmzQPAQDQ7NvDEfFMu/FfGvc3lftfsYYyGhH/j4h7IuLeiNgaEfdF5GUfiIgHu6y/dYXk+vFPeumGAlulbPz3XLG21Rj//V3L4y+MVorcljz+oeTo8fm5PcU52R1D67L85Ap1fPfiL591OtY8/su2rP5yLFiXXqq2TNDNTi9NrzHshssfR2yvtsSfS/J1gSjW9bZFxPau/uXlJ4zjT321o1Op/45/BdWuGtS+lV9GPFm//uejJf5S0nF9cvLggan9E+tjfm7PRHlXlJbXUX76+cJrnepfU/w9kF3/ja33f64R/2iyPmLxzNkT+XrtYvd1XPjt047PNDd6/w8nb+Tp4WLfB9NLS6cnI4aTV67fP7X82jJfls/i372rXfxp/h5XnomHIiK7iXdGxMMR8UjR9kcj4rGI2LVC/D+88Pg73ce/wqx8D2Xxz7a7/pVGkdEs/uXr332icuL7b7qPv5Rd/315anexZzXvf6tt4FrOHQAAANwp0vw78Ek63kin6fh4/Tv8W2NjOr+wuPT00YX3T83Wvys/GkNpOdM10jQfOlnMDZf5qZb83mLe+PPKhjw/PrMwP9vv4GHAberQ/zO/V/rdOuCm68E6GnCH0v9hcOn/MLj0fxhc+j8Mrnb9/6M+tAO49Xz+w+DS/2Fw6f8wuPR/GEitP4mvlHvSNf3kX+KuT0Ta/auqcZs0/k5KVFf9n1ncYGJd20P9fmcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADojX8CAAD//w/N7aY=") truncate(&(0x7f0000000280)='./file1\x00', 0x1bf8) io_setup(0x1, &(0x7f00000004c0)=0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3, 0x10000000]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x10d) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f000000fe80)='./file1\x00', 0x143042, 0x0) pwritev2(r3, &(0x7f000000fec0)=[{&(0x7f000000ff00)="ff", 0x1}], 0x1, 0x25412, 0x4, 0x0) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000140)='i', 0xa800, 0xe00}]) [ 103.646805][ T4649] Bluetooth: hci0: command tx timeout [ 103.746742][ T5336] loop0: detected capacity change from 0 to 512 [ 103.947443][ T5336] EXT4-fs (loop0): 1 truncate cleaned up [ 103.957635][ T5336] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 104.087477][ T5336] loop0: detected capacity change from 512 to 64 [ 104.104876][ T5337] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 104.132842][ T5336] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 104.187948][ T5337] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.0: corrupted inode contents [ 104.190537][ T5337] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm syz.0.0: mark_inode_dirty error [ 104.200610][ T5337] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.0: corrupted inode contents [ 104.206157][ T5337] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm syz.0.0: mark_inode_dirty error [ 104.207010][ T5337] syz.0.0: attempt to access beyond end of device [ 104.207010][ T5337] loop0: rw=2049, sector=296, nr_sectors = 2 limit=64 [ 104.207031][ T5337] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 148) [ 104.207118][ T5337] Buffer I/O error on device loop0, logical block 148 [ 104.207294][ T5337] syz.0.0: attempt to access beyond end of device [ 104.207294][ T5337] loop0: rw=2049, sector=510, nr_sectors = 2 limit=64 [ 104.207310][ T5337] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 255) [ 104.207329][ T5337] Buffer I/O error on device loop0, logical block 255 [ 104.207449][ T5337] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.0: corrupted inode contents [ 104.210074][ T5337] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2537: inode #15: comm syz.0.0: mark_inode_dirty error [ 104.210370][ T5337] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2541: comm syz.0.0: Failed to mark inode 15 dirty [ 104.263256][ T5337] syz.0.0: attempt to access beyond end of device [ 104.263256][ T5337] loop0: rw=2049, sector=308, nr_sectors = 14 limit=64 [ 104.263280][ T5337] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 154) [ 104.263300][ T5337] Buffer I/O error on device loop0, logical block 154 [ 104.263309][ T5337] Buffer I/O error on device loop0, logical block 155 [ 104.263337][ T5337] Buffer I/O error on device loop0, logical block 156 [ 104.263345][ T5337] Buffer I/O error on device loop0, logical block 157 [ 104.263353][ T5337] Buffer I/O error on device loop0, logical block 158 [ 104.263360][ T5337] Buffer I/O error on device loop0, logical block 159 [ 104.263368][ T5337] Buffer I/O error on device loop0, logical block 160 [ 104.308993][ T43] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:3: corrupted inode contents [ 104.320270][ T43] ------------[ cut here ]------------ [ 104.320622][ T43] kernel BUG at fs/ext4/mballoc.c:4781! [ 104.320668][ T43] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 104.328014][ T43] CPU: 0 UID: 0 PID: 43 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) [ 104.331893][ T43] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.336046][ T43] Workqueue: writeback wb_workfn (flush-7:0) [ 104.338703][ T43] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 104.341316][ T43] Code: e8 26 83 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 04 2f ff 90 0f 0b e8 8a 04 2f ff 90 0f 0b e8 82 04 2f ff 90 <0f> 0b e8 7a 04 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 104.349224][ T43] RSP: 0018:ffffc90000876540 EFLAGS: 00010293 [ 104.351792][ T43] RAX: ffffffff82991dae RBX: 00000000fffffff1 RCX: ffff8880312c8000 [ 104.355049][ T43] RDX: 0000000000000000 RSI: 000000000000001a RDI: 000000000000000b [ 104.358145][ T43] RBP: 1ffff11008b0c298 R08: ffff888045865a73 R09: 1ffff11008b0cb4e [ 104.361155][ T43] R10: dffffc0000000000 R11: ffffed1008b0cb4f R12: 0000000000000000 [ 104.364239][ T43] R13: 000000000000001a R14: 1ffff11008b0cb51 R15: ffff888045865a88 [ 104.367497][ T43] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 104.371267][ T43] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.374080][ T43] CR2: 000020000000a000 CR3: 0000000013a0c000 CR4: 0000000000352ef0 [ 104.377537][ T43] Call Trace: [ 104.378979][ T43] [ 104.380290][ T43] ext4_mb_use_preallocated+0x638/0x13e0 [ 104.382833][ T43] ext4_mb_new_blocks+0x5a0/0x4530 [ 104.385146][ T43] ? rcu_is_watching+0x16/0xb0 [ 104.387268][ T43] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 104.389667][ T43] ? unwind_next_frame+0x1baf/0x2550 [ 104.392006][ T43] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 104.394299][ T43] ? ret_from_fork_asm+0x1a/0x30 [ 104.396488][ T43] ? ext4_block_to_path+0x382/0x700 [ 104.398677][ T43] ext4_ind_map_blocks+0xe96/0x22a0 [ 104.400956][ T43] ? lockdep_unlock+0x5c/0xd0 [ 104.402935][ T43] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 104.405293][ T43] ? down_write+0x16b/0x200 [ 104.407398][ T43] ext4_map_create_blocks+0xbb/0x530 [ 104.409622][ T43] ? ext4_fc_track_inode+0xf3/0x3f0 [ 104.412502][ T43] ext4_map_blocks+0x791/0x12c0 [ 104.414584][ T43] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 104.416940][ T43] ? __pfx_ext4_map_blocks+0x10/0x10 [ 104.419184][ T43] ? kmem_cache_alloc_noprof+0x156/0x600 [ 104.421624][ T43] ext4_do_writepages+0x1901/0x4770 [ 104.423915][ T43] ? __pfx_ext4_do_writepages+0x10/0x10 [ 104.426303][ T43] ? __lock_acquire+0x747/0x2de0 [ 104.428472][ T43] ? filemap_get_folios_tag+0x639/0x720 [ 104.430874][ T43] ? filemap_get_folios_tag+0x118/0x720 [ 104.433240][ T43] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 104.435787][ T43] ? lock_acquire+0x115/0x350 [ 104.437807][ T43] ext4_writepages+0x241/0x3b0 [ 104.439903][ T43] ? __pfx_ext4_writepages+0x10/0x10 [ 104.442208][ T43] ? unwind_next_frame+0x8f/0x2550 [ 104.444356][ T43] ? __pfx_ext4_writepages+0x10/0x10 [ 104.446641][ T43] do_writepages+0x338/0x560 [ 104.448608][ T43] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.450828][ T43] ? reacquire_held_locks+0x117/0x1a0 [ 104.453205][ T43] ? writeback_sb_inodes+0x450/0x1b00 [ 104.455569][ T43] __writeback_single_inode+0x136/0x1220 [ 104.458066][ T43] ? do_raw_spin_unlock+0x4d/0x200 [ 104.460306][ T43] writeback_sb_inodes+0x9de/0x1b00 [ 104.462645][ T43] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 104.465085][ T43] ? __pfx_down_read_trylock+0x10/0x10 [ 104.467398][ T43] ? __pfx___up_read+0x10/0x10 [ 104.469463][ T43] __writeback_inodes_wb+0x114/0x240 [ 104.471786][ T43] wb_writeback+0x42f/0xad0 [ 104.473734][ T43] ? queue_io+0x241/0x470 [ 104.475533][ T43] ? __pfx_wb_writeback+0x10/0x10 [ 104.477612][ T43] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.479566][ T43] wb_workfn+0x980/0x10f0 [ 104.481416][ T43] ? __pfx_wb_workfn+0x10/0x10 [ 104.483634][ T43] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.485848][ T43] ? lock_acquire+0x115/0x350 [ 104.488036][ T43] ? rcu_is_watching+0x16/0xb0 [ 104.490231][ T43] ? process_scheduled_works+0x97a/0x1630 [ 104.492690][ T43] process_scheduled_works+0xc3d/0x1630 [ 104.495135][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.497819][ T43] ? assign_work+0x3cf/0x5d0 [ 104.499890][ T43] worker_thread+0xa47/0xfb0 [ 104.501978][ T43] ? __kthread_parkme+0x71/0x1f0 [ 104.504144][ T43] kthread+0x38b/0x480 [ 104.505902][ T43] ? __pfx_worker_thread+0x10/0x10 [ 104.508134][ T43] ? __pfx_kthread+0x10/0x10 [ 104.510238][ T43] ret_from_fork+0x514/0xb70 [ 104.512309][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 104.514531][ T43] ? __switch_to+0xc89/0x1420 [ 104.516643][ T43] ? __pfx_kthread+0x10/0x10 [ 104.518671][ T43] ret_from_fork_asm+0x1a/0x30 [ 104.520909][ T43] [ 104.522175][ T43] Modules linked in: [ 104.528227][ T43] ---[ end trace 0000000000000000 ]--- [ 104.530931][ T43] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 104.530958][ T43] Code: e8 26 83 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 04 2f ff 90 0f 0b e8 8a 04 2f ff 90 0f 0b e8 82 04 2f ff 90 <0f> 0b e8 7a 04 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 104.530969][ T43] RSP: 0018:ffffc90000876540 EFLAGS: 00010293 [ 104.530982][ T43] RAX: ffffffff82991dae RBX: 00000000fffffff1 RCX: ffff8880312c8000 [ 104.530991][ T43] RDX: 0000000000000000 RSI: 000000000000001a RDI: 000000000000000b [ 104.530999][ T43] RBP: 1ffff11008b0c298 R08: ffff888045865a73 R09: 1ffff11008b0cb4e [ 104.531008][ T43] R10: dffffc0000000000 R11: ffffed1008b0cb4f R12: 0000000000000000 [ 104.531016][ T43] R13: 000000000000001a R14: 1ffff11008b0cb51 R15: ffff888045865a88 [ 104.531024][ T43] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 104.531035][ T43] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.531042][ T43] CR2: 000020000000a000 CR3: 0000000013a0c000 CR4: 0000000000352ef0 [ 104.531079][ T43] Kernel panic - not syncing: Fatal exception [ 104.574252][ T43] Kernel Offset: disabled [ 104.576286][ T43] Rebooting in 86400 seconds..