program: bind$alg(0xffffffffffffffff, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="34020000"], 0x234) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.group_wait_time\x00', 0x26e1, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000180)) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x7351, 0x8001) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) socket$nl_generic(0x10, 0x3, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0}) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x10, &(0x7f0000000140)={[{@norecovery}]}, 0xed, 0x474, &(0x7f0000000b80)="$eJzs3EtsG0UfAPD/rvNo+viSr5RHSwuBgqh4JE36oAcuIJA4gIQEhyJOIUmrUrdBTZBoVUHhUI6oEnfEEYk7Eie4IOCAkLjCHVWqql5aOBmtvZs6jp06tRu3+PeT1p7ZXWfm79mxxzN2Auhb49lNErE1Iv6IiNFaduUJ47W7G9fOz/597fxsEpXKm1eT6nnXr52fLU4tHrellqlUIoaz5HCTci++EzFTLs+fyfOTS6fen1w8e+65E6dmjs8fnz89feTIwQN7hg5PH+oovjS/z+K6vuujhd07X3370uuzRy+9+/M3WX235sfr47gtWbQNxmvPbqNHs5snOyrsrvJrdrOtbkcy0PrkiQ2oEO0rRUTWXIPV/j8apRhZPjYar3za08oBd1SlUqk0e3/OXagA/2FJ9LoGQG8Ub/TZ599i26Chx13hyou1D0BZ3DfyrXZkYHnuYLDh8203jUfE0Qv/fJlt0Y15CACAW/g+G/8822z8l8YDdef9L19DGYuI/0fE9oi4LyJ2RMT9EdVzH4yIh9ZZfuMKyerxT3r5tgJrUzb+eyFf21o5/itGfzFWynPbqvEPJsdOlOf358/JvhgczvJTa5Txw8u/f16kNzUcqx//ZVtWfjEWzOtxeaBhgm5uZmmm07gLVz6J2DXQLP4kimWcJCJ2RsSu2yzjxNNf72517Nbxr2GNdaZ2Vb6KeKrW/hdiRfw3myppuT459fzh6UOTm6I8v3+yuCpW++W3i2+0Kr+j+Lsga//NTa//5VXgsWRTxOLZcyer67WL6y/j4p+f1fXpFavLWfzptxHrvv6Hkreq6aF834czS0tnpiKGktdW75+++dgiX5yfxb9vb/P+v72uxg9HRHYR74mIR/JF3KztHouIxyNi7xrx//TSE++1Oraq/UeK+NeYle+iLP65W7V/1Lf/+hOlkz9+13b8Tdv/YDW1L9/TzutfuxXs5LkDAACAe0Va/Q58kk4sp9N0YqL2Hf4dsTktLywuPXNs4YPTc7Xvyo/FYFrMdI3WzYdO5XPDRX66IX8gnzf+ojRSzU/MLpTneh089LktLfp/5q9Sr2sH3HFdWEcD7lH6P/Qv/R/6l/4P/Uv/h/7VrP9/3IN6ABvP+z/0L/0f+pf+D/1L/4e+1PK38WlHP/nvcaL43wkd/J2rvY+i48TInSwi0t4H2BeJgU4u43YSw00P9fiFCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoEv+DQAA//9L2OJW") open(&(0x7f0000000100)='./bus\x00', 0x14927e, 0x1) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x11) pwritev2(r4, &(0x7f0000000cc0)=[{&(0x7f0000000240)=';', 0xffffffbc}], 0x1, 0xfff, 0xc, 0x4) [ 67.142524][ T4652] Bluetooth: hci0: command tx timeout [ 67.175001][ T24] audit: type=1326 audit(1781606404.000:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5318 comm="syz.0.0" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f20d5b9ce59 code=0x0 [ 67.289530][ T5320] loop0: detected capacity change from 0 to 512 [ 67.312599][ T5320] EXT4-fs (loop0): invalid journal inode [ 67.320307][ T5320] EXT4-fs (loop0): can't get journal size [ 67.338372][ T5320] EXT4-fs (loop0): 1 truncate cleaned up [ 67.342146][ T5320] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.367961][ T5320] loop0: detected capacity change from 512 to 64 [ 67.388798][ T5320] syz.0.0: attempt to access beyond end of device [ 67.388798][ T5320] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 67.395399][ T5320] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 36) [ 67.401232][ T5320] Buffer I/O error on device loop0, logical block 36 [ 67.404336][ T5320] syz.0.0: attempt to access beyond end of device [ 67.404336][ T5320] loop0: rw=2049, sector=78, nr_sectors = 2 limit=64 [ 67.409866][ T5320] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 39) [ 67.414301][ T5320] Buffer I/O error on device loop0, logical block 39 [ 67.419445][ T5320] syz.0.0: attempt to access beyond end of device [ 67.419445][ T5320] loop0: rw=2049, sector=80, nr_sectors = 16 limit=64 [ 67.430844][ T42] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #15: comm kworker/u4:3: corrupted inode contents [ 67.439312][ T5320] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 40) [ 67.448558][ T42] EXT4-fs error (device loop0): ext4_dirty_inode:6587: inode #15: comm kworker/u4:3: mark_inode_dirty error [ 67.458532][ T5320] Buffer I/O error on device loop0, logical block 40 [ 67.461953][ T5320] Buffer I/O error on device loop0, logical block 41 [ 67.465297][ T5320] Buffer I/O error on device loop0, logical block 42 [ 67.468332][ T5320] Buffer I/O error on device loop0, logical block 43 [ 67.481561][ T42] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #15: comm kworker/u4:3: corrupted inode contents [ 67.500712][ T42] EXT4-fs error (device loop0): ext4_dirty_inode:6587: inode #15: comm kworker/u4:3: mark_inode_dirty error [ 67.508678][ T5320] Buffer I/O error on device loop0, logical block 44 [ 67.511952][ T5320] Buffer I/O error on device loop0, logical block 45 [ 67.514804][ T5320] Buffer I/O error on device loop0, logical block 46 [ 67.517726][ T5320] Buffer I/O error on device loop0, logical block 47 [ 67.560283][ T52] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #15: comm kworker/u4:4: corrupted inode contents [ 67.566771][ T52] EXT4-fs error (device loop0): ext4_dirty_inode:6587: inode #15: comm kworker/u4:4: mark_inode_dirty error [ 67.574691][ T52] ------------[ cut here ]------------ [ 67.577398][ T52] kernel BUG at fs/ext4/mballoc.c:4780! [ 67.580408][ T52] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 67.583576][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 67.587375][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.591473][ T52] Workqueue: writeback wb_workfn (flush-7:0) [ 67.594367][ T52] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 67.597404][ T52] Code: e8 36 45 a4 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 22 6a 37 ff 90 0f 0b e8 1a 6a 37 ff 90 0f 0b e8 12 6a 37 ff 90 <0f> 0b e8 0a 6a 37 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 67.605756][ T52] RSP: 0018:ffffc90000ace560 EFLAGS: 00010293 [ 67.609008][ T52] RAX: ffffffff828e9d0e RBX: 00000000ffffff92 RCX: ffff8880005ea540 [ 67.612541][ T52] RDX: 0000000000000000 RSI: 0000000000000070 RDI: 0000000000000002 [ 67.616141][ T52] RBP: 1ffff11008f5d0b5 R08: ffff888047aecefb R09: 1ffff11008f5d9df [ 67.620033][ T52] R10: dffffc0000000000 R11: ffffed1008f5d9e0 R12: 0000000000000000 [ 67.623619][ T52] R13: 0000000000000070 R14: 1ffff11008f5d9e2 R15: ffff888047aecf10 [ 67.626987][ T52] FS: 0000000000000000(0000) GS:ffff88808c886000(0000) knlGS:0000000000000000 [ 67.631246][ T52] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.634542][ T52] CR2: 00007f8dadd0a6b0 CR3: 000000001f5e9000 CR4: 0000000000352ef0 [ 67.637644][ T52] Call Trace: [ 67.639085][ T52] [ 67.640389][ T52] ext4_mb_use_preallocated+0x638/0x13e0 [ 67.643136][ T52] ext4_mb_new_blocks+0x5a0/0x4530 [ 67.645808][ T52] ? do_raw_spin_unlock+0x4d/0x210 [ 67.647989][ T52] ? _raw_spin_unlock+0x28/0x50 [ 67.650083][ T52] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 67.652412][ T52] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 67.654632][ T52] ? ext4_block_to_path+0x382/0x700 [ 67.657022][ T52] ext4_ind_map_blocks+0xe96/0x22a0 [ 67.659716][ T52] ? stack_trace_save+0xa9/0x100 [ 67.661985][ T52] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 67.664343][ T52] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 67.666701][ T52] ? down_write+0x16d/0x200 [ 67.668822][ T52] ext4_map_create_blocks+0xbb/0x530 [ 67.671338][ T52] ext4_map_blocks+0x7e4/0x1240 [ 67.673969][ T52] ? __pfx_ext4_map_blocks+0x10/0x10 [ 67.676458][ T52] ? __ext4_journal_ensure_credits+0x30/0x450 [ 67.678869][ T52] ext4_do_writepages+0x19e3/0x47a0 [ 67.680980][ T52] ? veth_xmit+0x66/0xe60 [ 67.682821][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.684781][ T52] ? __pfx_ext4_do_writepages+0x10/0x10 [ 67.687090][ T52] ? unwind_next_frame+0x1baf/0x2550 [ 67.689774][ T52] ? deref_stack_reg+0x18e/0x220 [ 67.692332][ T52] ? unwind_next_frame+0x8f/0x2550 [ 67.694591][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.696587][ T52] ? unwind_next_frame+0x8f/0x2550 [ 67.698654][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.700592][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.702601][ T52] ? lock_release+0x4b/0x3c0 [ 67.704800][ T52] ? unwind_next_frame+0x1baf/0x2550 [ 67.707418][ T52] ? ext4_writepages+0x205/0x3b0 [ 67.709712][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.711583][ T52] ? lock_acquire+0x5f/0x350 [ 67.713429][ T52] ? preempt_count_add+0x91/0x190 [ 67.715450][ T52] ext4_writepages+0x241/0x3b0 [ 67.717564][ T52] ? __pfx_ext4_writepages+0x10/0x10 [ 67.720129][ T52] ? trace_pelt_se_tp+0x3b/0x150 [ 67.722474][ T52] ? __pfx_ext4_writepages+0x10/0x10 [ 67.724740][ T52] do_writepages+0x338/0x560 [ 67.726600][ T52] ? kvm_sched_clock_read+0x11/0x20 [ 67.728831][ T52] ? do_raw_spin_lock+0x12b/0x2f0 [ 67.731298][ T52] __writeback_single_inode+0x12e/0xf90 [ 67.734129][ T52] writeback_sb_inodes+0x9de/0x1b00 [ 67.736772][ T52] ? do_raw_spin_unlock+0x4d/0x210 [ 67.738964][ T52] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 67.741232][ T52] ? __pfx_down_read_trylock+0x10/0x10 [ 67.743553][ T52] __writeback_inodes_wb+0x114/0x240 [ 67.745943][ T52] wb_writeback+0x42f/0xad0 [ 67.748120][ T52] ? queue_io+0x241/0x470 [ 67.749845][ T52] ? __pfx_wb_writeback+0x10/0x10 [ 67.751837][ T52] ? do_raw_spin_lock+0x12b/0x2f0 [ 67.753786][ T52] ? process_scheduled_works+0xa20/0x14e0 [ 67.756172][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.758326][ T52] wb_workfn+0x980/0x10f0 [ 67.760447][ T52] ? __pfx_wb_workfn+0x10/0x10 [ 67.762958][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.765381][ T52] ? trace_hrtimer_start+0x82/0x200 [ 67.767694][ T52] ? hrtimer_start_range_ns_common+0x812/0xb90 [ 67.770311][ T52] ? do_raw_spin_lock+0x12b/0x2f0 [ 67.772467][ T52] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 67.774954][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.777378][ T52] ? process_scheduled_works+0xa20/0x14e0 [ 67.780129][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.782351][ T52] ? rcu_is_watching+0x15/0xb0 [ 67.784537][ T52] ? process_scheduled_works+0xa20/0x14e0 [ 67.787073][ T52] process_scheduled_works+0xa8e/0x14e0 [ 67.790297][ T52] ? __pfx_process_scheduled_works+0x10/0x10 [ 67.793543][ T52] ? do_raw_spin_lock+0x12b/0x2f0 [ 67.795595][ T52] ? assign_work+0x3cf/0x5d0 [ 67.797485][ T52] worker_thread+0xa47/0xfb0 [ 67.799376][ T52] ? __kthread_parkme+0x71/0x1f0 [ 67.801391][ T52] kthread+0x388/0x470 [ 67.803132][ T52] ? __pfx_worker_thread+0x10/0x10 [ 67.805492][ T52] ? __pfx_kthread+0x10/0x10 [ 67.807640][ T52] ret_from_fork+0x514/0xb70 [ 67.809696][ T52] ? __pfx_ret_from_fork+0x10/0x10 [ 67.812003][ T52] ? __switch_to+0xc89/0x1420 [ 67.814034][ T52] ? __pfx_kthread+0x10/0x10 [ 67.815786][ T52] ret_from_fork_asm+0x1a/0x30 [ 67.817690][ T52] [ 67.819027][ T52] Modules linked in: [ 67.821438][ T52] ---[ end trace 0000000000000000 ]--- [ 67.824275][ T52] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 67.826881][ T52] Code: e8 36 45 a4 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 22 6a 37 ff 90 0f 0b e8 1a 6a 37 ff 90 0f 0b e8 12 6a 37 ff 90 <0f> 0b e8 0a 6a 37 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 67.835412][ T52] RSP: 0018:ffffc90000ace560 EFLAGS: 00010293 [ 67.838689][ T52] RAX: ffffffff828e9d0e RBX: 00000000ffffff92 RCX: ffff8880005ea540 [ 67.842205][ T52] RDX: 0000000000000000 RSI: 0000000000000070 RDI: 0000000000000002 [ 67.845519][ T52] RBP: 1ffff11008f5d0b5 R08: ffff888047aecefb R09: 1ffff11008f5d9df [ 67.848921][ T52] R10: dffffc0000000000 R11: ffffed1008f5d9e0 R12: 0000000000000000 [ 67.852236][ T52] R13: 0000000000000070 R14: 1ffff11008f5d9e2 R15: ffff888047aecf10 [ 67.855799][ T52] FS: 0000000000000000(0000) GS:ffff88808c886000(0000) knlGS:0000000000000000 [ 67.860006][ T52] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.862586][ T52] CR2: 00007f8dadd0a6b0 CR3: 000000001f5e9000 CR4: 0000000000352ef0 [ 67.865775][ T52] Kernel panic - not syncing: Fatal exception [ 67.868752][ T52] Kernel Offset: disabled [ 67.870893][ T52] Rebooting in 86400 seconds..