program: r0 = syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xfe, 0x45e, &(0x7f000000ff40)="$eJzs3MuPFMUfAPBv98wu79/uT/EBgq6ikfjYZZfnwYMYTTxoYqIHjKd1dyHIwiq7JkKIogc8GhLvxqOJf4EnvRj1ZOJV74aEGC6gicmY7umeHYeZdYcdGGA+n6ShqruGqm9310x11QwBDKyx7I8kYnNE/BoRI/XsvwuM1f+6duXczJ9Xzs0kUau9/keSl7t65dxMWbR83aZ6plYr8uva1HvhrYjp+fm500V+YunkuxOLZ84+e/zk9LG5Y3Onpg4d2rd35/CBqf09iTOL6+r2Dxd2bHv5zYuvzhy5+PaPX2ft3Vwcb46jV8bqZ7etJ3pdWZ9taUon1Yjn+9gWVq8SEdWIGMr7/0hUYkPj2Ei89ElfGwfcVLVardbu87lwvgbcxZLodwuA/ig/6LPn33K7RUOP28LlwxHvHazHf63Y6keqkRZlhlqeb3tpLCKOnP/ri2yLmzQPAQDQ7NvDEfFMu/FfGvc3lftfsYYyGhH/j4h7IuLeiNgaEfdF5GUfiIgHu6y/dYXk+vFPeumGAlulbPz3XLG21Rj//V3L4y+MVorcljz+oeTo8fm5PcU52R1D67L85Ap1fPfiL591OtY8/su2rP5yLFiXXqq2TNDNTi9NrzHshssfR2yvtsSfS/J1gSjW9bZFxPau/uXlJ4zjT321o1Op/45/BdWuGtS+lV9GPFm//uejJf5S0nF9cvLggan9E+tjfm7PRHlXlJbXUX76+cJrnepfU/w9kF3/ja33f64R/2iyPmLxzNkT+XrtYvd1XPjt047PNDd6/w8nb+Tp4WLfB9NLS6cnI4aTV67fP7X82jJfls/i372rXfxp/h5XnomHIiK7iXdGxMMR8UjR9kcj4rGI2LVC/D+88Pg73ce/wqx8D2Xxz7a7/pVGkdEs/uXr332icuL7b7qPv5Rd/315anexZzXvf6tt4FrOHQAAANwp0vw78Ek63kin6fh4/Tv8W2NjOr+wuPT00YX3T83Wvys/GkNpOdM10jQfOlnMDZf5qZb83mLe+PPKhjw/PrMwP9vv4GHAberQ/zO/V/rdOuCm68E6GnCH0v9hcOn/MLj0fxhc+j8Mrnb9/6M+tAO49Xz+w+DS/2Fw6f8wuPR/GEitP4mvlHvSNf3kX+KuT0Ta/auqcZs0/k5KVFf9n1ncYGJd20P9fmcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADojX8CAAD//w/N7aY=") truncate(&(0x7f0000000040)='./file1\x00', 0xc5d) io_setup(0x1, &(0x7f00000004c0)=0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3, 0x10000000]}) r3 = openat(r0, &(0x7f00000000c0)='./file1\x00', 0x101042, 0x10d) r4 = openat(0xffffffffffffff9c, &(0x7f000000fe80)='./file1\x00', 0x143042, 0x0) pwritev2(r4, &(0x7f000000fec0)=[{&(0x7f000000ff00)="ff", 0x1}], 0x1, 0x25412, 0x4, 0x0) io_submit(r1, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000140)='i', 0xa800, 0xe00}]) [ 85.912445][ T4663] Bluetooth: hci0: command tx timeout [ 85.954706][ T5344] loop0: detected capacity change from 0 to 512 [ 86.069368][ T5344] EXT4-fs (loop0): 1 truncate cleaned up [ 86.072153][ T5344] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 86.161288][ T5344] loop0: detected capacity change from 512 to 64 [ 86.183771][ T5344] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 86.185897][ T5344] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 86.239817][ T5345] syz.0.0: attempt to access beyond end of device [ 86.239817][ T5345] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 86.239844][ T5345] EXT4-fs warning (device loop0): ext4_end_bio:367: I/O error 10 writing to inode 15 starting block 36) [ 86.239940][ T5345] Buffer I/O error on device loop0, logical block 36 [ 86.240042][ T5345] syz.0.0: attempt to access beyond end of device [ 86.240042][ T5345] loop0: rw=2049, sector=296, nr_sectors = 2 limit=64 [ 86.271937][ T57] kworker/u4:4: attempt to access beyond end of device [ 86.271937][ T57] loop0: rw=1, sector=510, nr_sectors = 2 limit=64 [ 86.271962][ T57] EXT4-fs warning (device loop0): ext4_end_bio:367: I/O error 10 writing to inode 15 starting block 255) [ 86.271980][ T57] Buffer I/O error on device loop0, logical block 255 [ 86.273477][ T5345] EXT4-fs warning (device loop0): ext4_end_bio:367: I/O error 10 writing to inode 15 starting block 148) [ 86.273497][ T5345] Buffer I/O error on device loop0, logical block 148 [ 86.280039][ T57] kworker/u4:4: attempt to access beyond end of device [ 86.280039][ T57] loop0: rw=1, sector=308, nr_sectors = 6 limit=64 [ 86.311293][ T57] EXT4-fs warning (device loop0): ext4_end_bio:367: I/O error 10 writing to inode 15 starting block 154) [ 86.311321][ T57] Buffer I/O error on device loop0, logical block 154 [ 86.311330][ T57] Buffer I/O error on device loop0, logical block 155 [ 86.311342][ T57] Buffer I/O error on device loop0, logical block 156 [ 86.314986][ T5345] syz.0.0: attempt to access beyond end of device [ 86.314986][ T5345] loop0: rw=2049, sector=314, nr_sectors = 8 limit=64 [ 86.316223][ T57] EXT4-fs error (device loop0): ext4_do_update_inode:6707: inode #15: comm kworker/u4:4: corrupted inode contents [ 86.316620][ T5345] EXT4-fs warning (device loop0): ext4_end_bio:367: I/O error 10 writing to inode 15 starting block 157) [ 86.316642][ T5345] Buffer I/O error on device loop0, logical block 157 [ 86.316650][ T5345] Buffer I/O error on device loop0, logical block 158 [ 86.316658][ T5345] Buffer I/O error on device loop0, logical block 159 [ 86.316664][ T5345] Buffer I/O error on device loop0, logical block 160 [ 86.319856][ T57] EXT4-fs error (device loop0): ext4_dirty_inode:7679: inode #15: comm kworker/u4:4: mark_inode_dirty error [ 86.372713][ T57] EXT4-fs error (device loop0): ext4_do_update_inode:6707: inode #15: comm kworker/u4:4: corrupted inode contents [ 86.373001][ T57] EXT4-fs error (device loop0): ext4_dirty_inode:7679: inode #15: comm kworker/u4:4: mark_inode_dirty error [ 86.398911][ T24] EXT4-fs error (device loop0): ext4_do_update_inode:6707: inode #15: comm kworker/u4:2: corrupted inode contents [ 86.407516][ T24] EXT4-fs error (device loop0): ext4_dirty_inode:7679: inode #15: comm kworker/u4:2: mark_inode_dirty error [ 86.408187][ T24] ------------[ cut here ]------------ [ 86.408194][ T24] kernel BUG at fs/ext4/mballoc.c:4779! [ 86.408297][ T24] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 86.420582][ T24] CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) [ 86.424604][ T24] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.428989][ T24] Workqueue: writeback wb_workfn (flush-7:0) [ 86.431664][ T24] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 86.434293][ T24] Code: e8 06 32 a0 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 72 2c 27 ff 90 0f 0b e8 6a 2c 27 ff 90 0f 0b e8 62 2c 27 ff 90 <0f> 0b e8 5a 2c 27 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 86.442730][ T24] RSP: 0018:ffffc9000031e4e0 EFLAGS: 00010293 [ 86.445337][ T24] RAX: ffffffff82a1f43e RBX: 00000000ffffffef RCX: ffff88801db2cb00 [ 86.448524][ T24] RDX: 0000000000000000 RSI: 0000000000000016 RDI: 0000000000000005 [ 86.452081][ T24] RBP: 1ffff11008aa2207 R08: ffff888045515a73 R09: 1ffff11008aa2b4e [ 86.455494][ T24] R10: dffffc0000000000 R11: ffffed1008aa2b4f R12: 0000000000000000 [ 86.459029][ T24] R13: 0000000000000016 R14: 1ffff11008aa2b51 R15: ffff888045515a88 [ 86.462342][ T24] FS: 0000000000000000(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 86.474669][ T24] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.477804][ T24] CR2: 00007ffe2b659870 CR3: 0000000013637000 CR4: 0000000000352ef0 [ 86.481282][ T24] Call Trace: [ 86.482817][ T24] [ 86.484197][ T24] ext4_mb_use_preallocated+0x638/0x13e0 [ 86.486803][ T24] ext4_mb_new_blocks+0x596/0x4520 [ 86.489112][ T24] ? do_raw_spin_unlock+0x4d/0x200 [ 86.491526][ T24] ? _raw_spin_unlock+0x28/0x50 [ 86.495315][ T24] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 86.497901][ T24] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 86.500372][ T24] ? unwind_next_frame+0x8f/0x2550 [ 86.502641][ T24] ? ext4_block_to_path+0x382/0x700 [ 86.504936][ T24] ext4_ind_map_blocks+0xef3/0x2300 [ 86.507172][ T24] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 86.509676][ T24] ? stack_trace_save+0xa9/0x100 [ 86.512102][ T24] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 86.514451][ T24] ? kmem_cache_alloc_noprof+0xb1/0x600 [ 86.516957][ T24] ? down_write+0x166/0x200 [ 86.518993][ T24] ext4_map_create_blocks+0xbb/0x530 [ 86.521324][ T24] ? ext4_fc_track_inode+0xf3/0x3f0 [ 86.523525][ T24] ext4_map_blocks+0xe8e/0x1c60 [ 86.525674][ T24] ? __pfx_ext4_map_blocks+0x10/0x10 [ 86.527987][ T24] ? kmem_cache_alloc_noprof+0x151/0x600 [ 86.530430][ T24] ext4_do_writepages+0x1978/0x44a0 [ 86.532748][ T24] ? __pfx_ext4_do_writepages+0x10/0x10 [ 86.535147][ T24] ? __lock_acquire+0x747/0x2de0 [ 86.537283][ T24] ? lock_acquire+0x115/0x350 [ 86.539261][ T24] ? __lock_acquire+0x747/0x2de0 [ 86.541473][ T24] ? lock_acquire+0x115/0x350 [ 86.543557][ T24] ext4_writepages+0x1fe/0x4e0 [ 86.545711][ T24] ? check_noncircular+0xdb/0x150 [ 86.547975][ T24] ? __pfx_ext4_writepages+0x10/0x10 [ 86.550272][ T24] ? lock_acquire+0x115/0x350 [ 86.552393][ T24] ? __pfx_ext4_writepages+0x10/0x10 [ 86.554720][ T24] do_writepages+0x338/0x560 [ 86.556825][ T24] ? reacquire_held_locks+0x117/0x1a0 [ 86.559211][ T24] ? writeback_sb_inodes+0x450/0x1af0 [ 86.561565][ T24] __writeback_single_inode+0x136/0x1220 [ 86.564156][ T24] ? do_raw_spin_unlock+0x4d/0x200 [ 86.566355][ T24] writeback_sb_inodes+0x9de/0x1af0 [ 86.568651][ T24] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 86.571379][ T24] ? __pfx_down_read_trylock+0x10/0x10 [ 86.574122][ T24] __writeback_inodes_wb+0x114/0x250 [ 86.576500][ T24] wb_writeback+0x42f/0xad0 [ 86.578477][ T24] ? queue_io+0x241/0x470 [ 86.580224][ T24] ? __pfx_wb_writeback+0x10/0x10 [ 86.582354][ T24] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.584501][ T24] wb_workfn+0x980/0x10f0 [ 86.586406][ T24] ? __pfx_wb_workfn+0x10/0x10 [ 86.588518][ T24] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.590749][ T24] ? lock_acquire+0x115/0x350 [ 86.592719][ T24] ? rcu_is_watching+0x16/0xb0 [ 86.594708][ T24] ? process_scheduled_works+0x97a/0x1630 [ 86.597056][ T24] process_scheduled_works+0xc3d/0x1630 [ 86.599353][ T24] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.601849][ T24] ? assign_work+0x3cf/0x5d0 [ 86.603809][ T24] worker_thread+0xa47/0xfb0 [ 86.605646][ T24] ? __kthread_parkme+0x71/0x1f0 [ 86.607805][ T24] kthread+0x38b/0x480 [ 86.609522][ T24] ? __pfx_worker_thread+0x10/0x10 [ 86.611756][ T24] ? __pfx_kthread+0x10/0x10 [ 86.613815][ T24] ret_from_fork+0x514/0xb70 [ 86.615918][ T24] ? __pfx_ret_from_fork+0x10/0x10 [ 86.618267][ T24] ? __switch_to+0xc78/0x1410 [ 86.620369][ T24] ? __pfx_kthread+0x10/0x10 [ 86.622484][ T24] ret_from_fork_asm+0x1a/0x30 [ 86.624694][ T24] [ 86.626119][ T24] Modules linked in: [ 86.631635][ T24] ---[ end trace 0000000000000000 ]--- [ 86.634414][ T24] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 86.634485][ T24] Code: e8 06 32 a0 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 72 2c 27 ff 90 0f 0b e8 6a 2c 27 ff 90 0f 0b e8 62 2c 27 ff 90 <0f> 0b e8 5a 2c 27 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 86.634496][ T24] RSP: 0018:ffffc9000031e4e0 EFLAGS: 00010293 [ 86.634522][ T24] RAX: ffffffff82a1f43e RBX: 00000000ffffffef RCX: ffff88801db2cb00 [ 86.634530][ T24] RDX: 0000000000000000 RSI: 0000000000000016 RDI: 0000000000000005 [ 86.634537][ T24] RBP: 1ffff11008aa2207 R08: ffff888045515a73 R09: 1ffff11008aa2b4e [ 86.634544][ T24] R10: dffffc0000000000 R11: ffffed1008aa2b4f R12: 0000000000000000 [ 86.634549][ T24] R13: 0000000000000016 R14: 1ffff11008aa2b51 R15: ffff888045515a88 [ 86.634554][ T24] FS: 0000000000000000(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 86.634559][ T24] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.634564][ T24] CR2: 00007ffe2b659870 CR3: 0000000013637000 CR4: 0000000000352ef0 [ 86.634601][ T24] Kernel panic - not syncing: Fatal exception [ 86.679676][ T24] Kernel Offset: disabled [ 86.681591][ T24] Rebooting in 86400 seconds..