program: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x4006, &(0x7f0000000140)={[{@i_version}, {@nombcache}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@lazytime}, {@block_validity}, {@sysvgroups}]}, 0x2, 0x42e, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+tj7O+jg6ZHi9g09WKh2urrsO1KWTvi42hE0p1bpp9Ff7/0CUYvXkDcSrn3a1ccC2qlQqlQfaH16qAP9jSXS7BUB3FF/02fy32HZo6HFXuPFSbQKUxX0r32pH+iLNy/Q3zW87aTgiziz981W2xfbchwAAaPB9Nv55ttX4L436+0L35msogxFxX0QcjIhTEXEoIu6PqJZ9MCIe2mT9zYska8c/6fUtBbZB2fjvxXxtq3H8V4z+YrCU5w5U4+9Pzs6WZ47n78lI9O/O8uPr1PHDK7990e5Y/fgv27L6i7Fg3o7rfbsbXzM9uTB5JzHXu/FJxFBfq/iTlZWAJCIOR8TQFuuYffqbo+2O3T7+dXRgnanydcRTtfO/FE3xF5L11yfH7onyzPGx4qpY65dfr77Zrv47ir8DsvO/t+X1vxL/YFK/Xju/+Tqu/vF52znNVq//XcnbDfs+nFxYuDQesSt5vdbo+v0TTeUmVstn8Y8ca93/D8bqO3EkIrKL+OGIeCQiHs3b/lhEPB4Rx9aJ/6eXn3hv6/Fvryz+6U2d/9XErmje0zpROv/jdw2VDm4m/uz8n6ymRvI9G/n820i7tnY1AwAAwH9PGhH7I0lHV9JpOjpa+w3/odiblufmF545O/fBxenaMwKD0Z8Wd7oG6u6HjufT+iI/0ZQ/kd83/rK0p5ofnZorT3c7eOhx+9r0/8yfpW63Dth2nteC3qX/Q+/S/6F36f/Qu1r0/z3daAew81p9/3/chXYAO6+p/1v2gx5i/g+9S/+H3qX/Q0+a3xO3f0heQmJNItK7ohkS25To9icTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wbAAD//+i45rU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x2000010, &(0x7f0000000280)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x85, 0x7a5, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") creat(&(0x7f0000000380)='./bus\x00', 0x0) getpid() mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r5 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write(r6, &(0x7f0000000600)='dir .', 0x5) write(r6, &(0x7f0000000700)='bind', 0x4) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, r4, 0x1, 0x0, 0x4, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}]}, 0x3c}}, 0x0) pselect6(0x40, &(0x7f0000000080)={0x4, 0x7, 0x9, 0x7, 0x30323129, 0x4, 0x4, 0x6}, &(0x7f00000000c0)={0x8, 0x8, 0x0, 0x9, 0x8001, 0xc9, 0xe44, 0x9}, &(0x7f0000000100)={0x5, 0xc849, 0x0, 0x343f, 0x1, 0x1, 0x3, 0x7fffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={[0x9]}, 0x8}) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc) [ 94.667434][ T5275] Bluetooth: hci0: command tx timeout [ 94.683915][ T5310] loop0: detected capacity change from 0 to 512 [ 94.768142][ T5310] EXT4-fs: Ignoring removed i_version option [ 94.910016][ T5310] EXT4-fs (loop0): 1 truncate cleaned up [ 94.914496][ T5310] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.978447][ T5310] loop0: detected capacity change from 512 to 64 [ 95.001843][ T5310] CacheFiles: mkdir cache failed with error -12 [ 95.005797][ T5310] CacheFiles: Failed to register: -12 [ 95.012959][ T5310] EXT4-fs error (device loop0): get_max_inline_xattr_value_size:73: inode #15: comm syz.0.0: corrupt xattr in inline inode [ 95.023597][ T5310] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 95.137535][ T5310] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 95.144828][ T5310] ------------[ cut here ]------------ [ 95.147579][ T5310] kernel BUG at fs/ext4/mballoc.c:4781! [ 95.150390][ T5310] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 95.152965][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.156496][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.160306][ T5310] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.162839][ T5310] Code: e8 e6 0f a2 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 a2 c7 30 ff 90 0f 0b e8 9a c7 30 ff 90 0f 0b e8 92 c7 30 ff 90 <0f> 0b e8 8a c7 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.170658][ T5310] RSP: 0018:ffffc9000f41eaa0 EFLAGS: 00010283 [ 95.173126][ T5310] RAX: ffffffff82966d2e RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.176197][ T5310] RDX: ffffc9000e9da000 RSI: 0000000000009dc6 RDI: 0000000000009dc7 [ 95.179293][ T5310] RBP: 1ffff110087a2129 R08: ffff888043d14d2b R09: 1ffff110087a29a5 [ 95.182485][ T5310] R10: dffffc0000000000 R11: ffffed10087a29a6 R12: 0000000000000000 [ 95.185577][ T5310] R13: 0000000000000041 R14: 1ffff110087a29a8 R15: ffff888043d14d40 [ 95.188583][ T5310] FS: 00007f135d29b6c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.192238][ T5310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.194912][ T5310] CR2: 000020000000f000 CR3: 00000000347f5000 CR4: 0000000000352ef0 [ 95.198146][ T5310] Call Trace: [ 95.199580][ T5310] [ 95.200807][ T5310] ext4_mb_use_preallocated+0x638/0x13e0 [ 95.203123][ T5310] ext4_mb_new_blocks+0x5a0/0x4530 [ 95.205213][ T5310] ? rcu_is_watching+0x16/0xb0 [ 95.207303][ T5310] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 95.209750][ T5310] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 95.212093][ T5310] ? ext4_block_to_path+0x382/0x700 [ 95.214358][ T5310] ext4_ind_map_blocks+0xe96/0x22a0 [ 95.216652][ T5310] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 95.219116][ T5310] ? kasan_save_track+0x4f/0x80 [ 95.221328][ T5310] ? ext4_map_blocks+0x77d/0x12c0 [ 95.223373][ T5310] ? down_write+0x16b/0x200 [ 95.225362][ T5310] ext4_map_create_blocks+0xbb/0x530 [ 95.227524][ T5310] ? ext4_fc_track_inode+0xf3/0x3f0 [ 95.230275][ T5310] ext4_map_blocks+0x791/0x12c0 [ 95.232292][ T5310] ? __pfx_ext4_map_blocks+0x10/0x10 [ 95.234504][ T5310] ext4_do_writepages+0x1901/0x4770 [ 95.236636][ T5310] ? __lock_acquire+0x683/0x2cf0 [ 95.238770][ T5310] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.241318][ T5310] ? __lock_acquire+0x683/0x2cf0 [ 95.243330][ T5310] ? __free_object+0x432/0x5d0 [ 95.245280][ T5310] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.247253][ T5310] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.249746][ T5310] ? debug_object_free+0x29c/0x340 [ 95.251981][ T5310] ? ext4_writepages+0x205/0x3b0 [ 95.254153][ T5310] ? ext4_writepages+0x205/0x3b0 [ 95.256185][ T5310] ext4_writepages+0x241/0x3b0 [ 95.258042][ T5310] ? __pfx_ext4_writepages+0x10/0x10 [ 95.260224][ T5310] ? __pfx_ext4_writepages+0x10/0x10 [ 95.262547][ T5310] do_writepages+0x338/0x560 [ 95.264607][ T5310] ? do_raw_spin_unlock+0x4d/0x200 [ 95.266805][ T5310] file_write_and_wait_range+0x36e/0x440 [ 95.269123][ T5310] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 95.271780][ T5310] ext4_sync_file+0x252/0xa40 [ 95.273729][ T5310] ext4_buffered_write_iter+0x2d0/0x380 [ 95.276084][ T5310] ? __pfx_futex_wake_mark+0x10/0x10 [ 95.278286][ T5310] ext4_file_write_iter+0xae4/0x1cd0 [ 95.280583][ T5310] ? vfs_write+0x22b/0xba0 [ 95.282437][ T5310] ? vfs_write+0x22b/0xba0 [ 95.284375][ T5310] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.286775][ T5310] vfs_write+0x612/0xba0 [ 95.288578][ T5310] ? __pfx_vfs_write+0x10/0x10 [ 95.290582][ T5310] ? __fget_files+0x2a/0x420 [ 95.292367][ T5310] __x64_sys_pwrite64+0x196/0x220 [ 95.294490][ T5310] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 95.296862][ T5310] do_syscall_64+0x166/0x520 [ 95.298853][ T5310] ? trace_irq_disable+0x3b/0x140 [ 95.300909][ T5310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.303437][ T5310] ? clear_bhb_loop+0x70/0xc0 [ 95.305409][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.307928][ T5310] RIP: 0033:0x7f135c39e0d9 [ 95.309919][ T5310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.317815][ T5310] RSP: 002b:00007f135d29afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 95.321375][ T5310] RAX: ffffffffffffffda RBX: 00007f135c625fa0 RCX: 00007f135c39e0d9 [ 95.324445][ T5310] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 [ 95.327677][ T5310] RBP: 00007f135c435024 R08: 0000000000000000 R09: 0000000000000000 [ 95.331016][ T5310] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 [ 95.334193][ T5310] R13: 00007f135c626038 R14: 00007f135c625fa0 R15: 00007ffd17b662d8 [ 95.337482][ T5310] [ 95.338870][ T5310] Modules linked in: [ 95.341377][ T5310] ---[ end trace 0000000000000000 ]--- [ 95.344018][ T5310] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.346826][ T5310] Code: e8 e6 0f a2 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 a2 c7 30 ff 90 0f 0b e8 9a c7 30 ff 90 0f 0b e8 92 c7 30 ff 90 <0f> 0b e8 8a c7 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.355615][ T5310] RSP: 0018:ffffc9000f41eaa0 EFLAGS: 00010283 [ 95.358270][ T5310] RAX: ffffffff82966d2e RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.361473][ T5310] RDX: ffffc9000e9da000 RSI: 0000000000009dc6 RDI: 0000000000009dc7 [ 95.364626][ T5310] RBP: 1ffff110087a2129 R08: ffff888043d14d2b R09: 1ffff110087a29a5 [ 95.368076][ T5310] R10: dffffc0000000000 R11: ffffed10087a29a6 R12: 0000000000000000 [ 95.371310][ T5310] R13: 0000000000000041 R14: 1ffff110087a29a8 R15: ffff888043d14d40 [ 95.374713][ T5310] FS: 00007f135d29b6c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.378469][ T5310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.381321][ T5310] CR2: 000020000000f000 CR3: 00000000347f5000 CR4: 0000000000352ef0 [ 95.384894][ T5310] Kernel panic - not syncing: Fatal exception [ 95.387835][ T5310] Kernel Offset: disabled [ 95.389744][ T5310] Rebooting in 86400 seconds..