program: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000280)='memory.numa_stat\x00', 0x275a, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r2, &(0x7f0000000140)='2', 0x1, 0x8000c61) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000300)={0xc, 0x987, {}, {0xee01}, 0x400, 0x7fffffff}) quotactl_fd$Q_QUOTAON(r3, 0xffffffff80000201, r4, &(0x7f0000000340)='./file1\x00') r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "2af01c3d0040fbffffffffffffff00"}) r8 = syz_open_pts(r7, 0x0) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r8, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r8, 0x5406, &(0x7f00000001c0)={0xffff, 0x0, 0x0, 0x6, 0x3, "a0590100002800"}) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000140)=0x4) bind$can_j1939(r3, &(0x7f0000000240)={0x1d, r6, 0x0, {0x0, 0x0, 0x4}, 0xfd}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000500)={&(0x7f0000000380)={0x1d, r6, 0x0, {0x0, 0xdd9d0550c42e69fa}, 0xff}, 0x18, &(0x7f00000004c0)={&(0x7f00000003c0)="cff0404e4f6d", 0x6}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r9, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) pwrite64(r10, &(0x7f0000000140)='2', 0xfdef, 0xfecc) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x06\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00 [ 68.225248][ T5330] dump_stack_lvl+0x189/0x250 [ 68.225264][ T5330] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.225279][ T5330] ? rcu_is_watching+0x15/0xb0 [ 68.225290][ T5330] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.225301][ T5330] ? rcu_is_watching+0x15/0xb0 [ 68.225310][ T5330] ? lock_release+0x4b/0x3e0 [ 68.225319][ T5330] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 68.225369][ T5330] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.225378][ T5330] ? __virt_addr_valid+0x4a5/0x5c0 [ 68.225391][ T5330] print_report+0xca/0x240 [ 68.225402][ T5330] ? ext4_find_extent+0xae6/0xcc0 [ 68.225415][ T5330] kasan_report+0x118/0x150 [ 68.225427][ T5330] ? ext4_find_extent+0xae6/0xcc0 [ 68.225441][ T5330] ext4_find_extent+0xae6/0xcc0 [ 68.225454][ T5330] ext4_ext_map_blocks+0x288/0x6ac0 [ 68.225463][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 68.225471][ T5330] ? __kernel_text_address+0xd/0x40 [ 68.225482][ T5330] ? unwind_get_return_address+0x4d/0x90 [ 68.225494][ T5330] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 68.225509][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.225520][ T5330] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 68.225538][ T5330] ? ext4_es_lookup_extent+0x622/0xa70 [ 68.225550][ T5330] ext4_map_blocks+0x860/0x1740 [ 68.225563][ T5330] ? __pfx_ext4_map_blocks+0x10/0x10 [ 68.225572][ T5330] ? __memcg_slab_post_alloc_hook+0x522/0x7f0 [ 68.225582][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.225593][ T5330] _ext4_get_block+0x200/0x4c0 [ 68.225603][ T5330] ? __pfx__ext4_get_block+0x10/0x10 [ 68.225614][ T5330] ? do_raw_spin_unlock+0x4d/0x240 [ 68.225626][ T5330] ? _raw_spin_unlock+0x28/0x50 [ 68.225640][ T5330] ext4_get_block_unwritten+0x2e/0x100 [ 68.225650][ T5330] ext4_block_write_begin+0x993/0x1710 [ 68.225665][ T5330] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 68.225676][ T5330] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 68.225684][ T5330] ? __ext4_journal_start_sb+0x27e/0x5c0 [ 68.225693][ T5330] ext4_page_mkwrite+0x760/0x1190 [ 68.225703][ T5330] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 68.225710][ T5330] ? __pfx_ext4_page_mkwrite+0x10/0x10 [ 68.225720][ T5330] do_page_mkwrite+0x14d/0x310 [ 68.225729][ T5330] do_wp_page+0x268d/0x5800 [ 68.225739][ T5330] ? __pfx_do_wp_page+0x10/0x10 [ 68.225744][ T5330] ? do_raw_spin_lock+0x121/0x290 [ 68.225752][ T5330] ? __handle_mm_fault+0xf87/0x5440 [ 68.225759][ T5330] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 68.225769][ T5330] __handle_mm_fault+0x1033/0x5440 [ 68.225775][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.225783][ T5330] ? __pfx___handle_mm_fault+0x10/0x10 [ 68.225794][ T5330] ? __pfx_do_futex+0x10/0x10 [ 68.225807][ T5330] ? lock_vma_under_rcu+0xdf/0x3d0 [ 68.225817][ T5330] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 68.225830][ T5330] handle_mm_fault+0x40a/0x8e0 [ 68.225843][ T5330] do_user_addr_fault+0xa7c/0x1380 [ 68.225855][ T5330] ? rcu_is_watching+0x15/0xb0 [ 68.225873][ T5330] ? trace_page_fault_user+0x84/0x1e0 [ 68.225882][ T5330] exc_page_fault+0x76/0xf0 [ 68.225889][ T5330] asm_exc_page_fault+0x26/0x30 [ 68.225896][ T5330] RIP: 0033:0x7f8eaaa65399 [ 68.225904][ T5330] Code: ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 c8 fe ff ff e8 68 59 0c 00 85 c0 75 10 48 8b 44 24 68 48 8b b4 24 98 00 00 00 <48> 89 30 64 f0 83 2c 25 90 ff ff ff 01 48 8b 84 24 80 00 00 00 48 [ 68.225910][ T5330] RSP: 002b:00007ffef4b303f0 EFLAGS: 00010246 [ 68.225919][ T5330] RAX: 0000200000003180 RBX: 0000000000000002 RCX: ffffe00000000000 [ 68.225926][ T5330] RDX: 6dc36450cdf58fb6 RSI: 0000000000000000 RDI: 0000555592c7d3c8 [ 68.225933][ T5330] RBP: 00007f8eaade7da0 R08: 00007f8eaa9ff03c R09: 000000000000000f [ 68.225939][ T5330] R10: 0000000000000001 R11: 0000000000000006 R12: 00007f8eaade5fac [ 68.225945][ T5330] R13: 00007f8eaade5fa0 R14: fffffffffffffffe R15: 00007ffef4b30500 [ 68.225956][ T5330] [ 68.225959][ T5330] [ 68.388597][ T5330] The buggy address belongs to the physical page: [ 68.391094][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52b1c [ 68.394863][ T5330] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 68.397894][ T5330] raw: 04fff00000000000 ffffea00014ac748 ffffea00014ac6c8 0000000000000000 [ 68.401585][ T5330] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 68.405372][ T5330] page dumped because: kasan: bad access detected [ 68.408196][ T5330] page_owner info is not present (never set?) [ 68.410786][ T5330] [ 68.411868][ T5330] Memory state around the buggy address: [ 68.414175][ T5330] ffff888052b1ca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.417475][ T5330] ffff888052b1ca80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.420714][ T5330] >ffff888052b1cb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.423907][ T5330] ^ [ 68.426806][ T5330] ffff888052b1cb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.430028][ T5330] ffff888052b1cc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 68.433428][ T5330] ================================================================== [ 68.444633][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.447714][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 68.451462][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.455566][ T5330] Call Trace: [ 68.456993][ T5330] [ 68.458264][ T5330] dump_stack_lvl+0x99/0x250 [ 68.460196][ T5330] ? __asan_memcpy+0x40/0x70 [ 68.462198][ T5330] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.464416][ T5330] ? __pfx__printk+0x10/0x10 [ 68.466384][ T5330] vpanic+0x281/0x750 [ 68.468240][ T5330] ? preempt_schedule+0xae/0xc0 [ 68.470405][ T5330] ? __pfx_vpanic+0x10/0x10 [ 68.472449][ T5330] ? preempt_schedule_common+0x83/0xd0 [ 68.474692][ T5330] ? preempt_schedule+0xae/0xc0 [ 68.476749][ T5330] ? __pfx_preempt_schedule+0x10/0x10 [ 68.479024][ T5330] panic+0xb9/0xc0 [ 68.480666][ T5330] ? __pfx_panic+0x10/0x10 [ 68.482592][ T5330] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 68.485016][ T5330] ? is_module_address+0x17/0xf0 [ 68.487056][ T5330] ? ext4_find_extent+0xae6/0xcc0 [ 68.489226][ T5330] check_panic_on_warn+0x89/0xb0 [ 68.491366][ T5330] ? ext4_find_extent+0xae6/0xcc0 [ 68.493510][ T5330] end_report+0x78/0x160 [ 68.495384][ T5330] kasan_report+0x129/0x150 [ 68.497293][ T5330] ? ext4_find_extent+0xae6/0xcc0 [ 68.499425][ T5330] ext4_find_extent+0xae6/0xcc0 [ 68.501519][ T5330] ext4_ext_map_blocks+0x288/0x6ac0 [ 68.503827][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 68.506127][ T5330] ? __kernel_text_address+0xd/0x40 [ 68.508496][ T5330] ? unwind_get_return_address+0x4d/0x90 [ 68.510779][ T5330] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 68.513341][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.515555][ T5330] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 68.517925][ T5330] ? ext4_es_lookup_extent+0x622/0xa70 [ 68.520181][ T5330] ext4_map_blocks+0x860/0x1740 [ 68.522185][ T5330] ? __pfx_ext4_map_blocks+0x10/0x10 [ 68.524442][ T5330] ? __memcg_slab_post_alloc_hook+0x522/0x7f0 [ 68.527123][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.529101][ T5330] _ext4_get_block+0x200/0x4c0 [ 68.531113][ T5330] ? __pfx__ext4_get_block+0x10/0x10 [ 68.533200][ T5330] ? do_raw_spin_unlock+0x4d/0x240 [ 68.535268][ T5330] ? _raw_spin_unlock+0x28/0x50 [ 68.537323][ T5330] ext4_get_block_unwritten+0x2e/0x100 [ 68.539634][ T5330] ext4_block_write_begin+0x993/0x1710 [ 68.541983][ T5330] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 68.544447][ T5330] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 68.546899][ T5330] ? __ext4_journal_start_sb+0x27e/0x5c0 [ 68.549261][ T5330] ext4_page_mkwrite+0x760/0x1190 [ 68.551384][ T5330] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 68.553956][ T5330] ? __pfx_ext4_page_mkwrite+0x10/0x10 [ 68.556137][ T5330] do_page_mkwrite+0x14d/0x310 [ 68.558143][ T5330] do_wp_page+0x268d/0x5800 [ 68.559993][ T5330] ? __pfx_do_wp_page+0x10/0x10 [ 68.562032][ T5330] ? do_raw_spin_lock+0x121/0x290 [ 68.564278][ T5330] ? __handle_mm_fault+0xf87/0x5440 [ 68.566409][ T5330] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 68.568623][ T5330] __handle_mm_fault+0x1033/0x5440 [ 68.570847][ T5330] ? __lock_acquire+0xab9/0xd20 [ 68.572943][ T5330] ? __pfx___handle_mm_fault+0x10/0x10 [ 68.575129][ T5330] ? __pfx_do_futex+0x10/0x10 [ 68.577106][ T5330] ? lock_vma_under_rcu+0xdf/0x3d0 [ 68.579298][ T5330] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 68.581526][ T5330] handle_mm_fault+0x40a/0x8e0 [ 68.583671][ T5330] do_user_addr_fault+0xa7c/0x1380 [ 68.585831][ T5330] ? rcu_is_watching+0x15/0xb0 [ 68.587911][ T5330] ? trace_page_fault_user+0x84/0x1e0 [ 68.590080][ T5330] exc_page_fault+0x76/0xf0 [ 68.592109][ T5330] asm_exc_page_fault+0x26/0x30 [ 68.594143][ T5330] RIP: 0033:0x7f8eaaa65399 [ 68.596054][ T5330] Code: ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 c8 fe ff ff e8 68 59 0c 00 85 c0 75 10 48 8b 44 24 68 48 8b b4 24 98 00 00 00 <48> 89 30 64 f0 83 2c 25 90 ff ff ff 01 48 8b 84 24 80 00 00 00 48 [ 68.604122][ T5330] RSP: 002b:00007ffef4b303f0 EFLAGS: 00010246 [ 68.606709][ T5330] RAX: 0000200000003180 RBX: 0000000000000002 RCX: ffffe00000000000 [ 68.610111][ T5330] RDX: 6dc36450cdf58fb6 RSI: 0000000000000000 RDI: 0000555592c7d3c8 [ 68.613616][ T5330] RBP: 00007f8eaade7da0 R08: 00007f8eaa9ff03c R09: 000000000000000f [ 68.617017][ T5330] R10: 0000000000000001 R11: 0000000000000006 R12: 00007f8eaade5fac [ 68.620356][ T5330] R13: 00007f8eaade5fa0 R14: fffffffffffffffe R15: 00007ffef4b30500 [ 68.623942][ T5330] [ 68.625619][ T5330] Kernel Offset: disabled [ 68.627449][ T5330] Rebooting in 86400 seconds..