program: r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000001c0), 0xe500, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@bloom_filter={0x1e, 0x0, 0xad, 0x6037a490, 0x0, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x0) ioctl$CDROM_SET_OPTIONS(r0, 0x5320, 0xe) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x6, 0x4, &(0x7f0000002180)=ANY=[@ANYBLOB="180200000000000000000000cfffffff850000001700000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r3, r4, 0x25, 0x4, @val=@netkit={@void, @value=r3}}, 0x1c) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="180200000000000000000000000000001800000008000000000000006e14000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r5, r6}, 0x5) r7 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$CDROM_LOCKDOOR(r7, 0x5329, 0x0) syz_mount_image$ext4(&(0x7f0000000540)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x88, &(0x7f00000005c0)={[{@nogrpid}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@nobarrier}, {@nodiscard}, {@quota}]}, 0x3, 0x438, &(0x7f0000000d80)="$eJzs289rHFUcAPDv7GZT01+Jpf5oWjVaxeCPpElr7cGLouBBQdBDPcYkLbHbRpoItgSNIvUoBe/iUfAv8KQXUU8Fr3oXoUgurZ5WZncm2d1sfnaTrd3PByb5vpm3vPfNzNt9My8bQNcaSn8kEfsj4veI6K8VGysM1X7dXlqY/GdpYTKJSuXtv5NqvVtLC5N51fx1+/JCT0Th8ySOtmh37srVCxPl8vTlrDw6f/GD0bkrV5+fuThxfvr89KXxM2dOnRx78fT4C23JM83r1uDHs8eOvP7u9Tcnz15/75fvkjz/pjzaZGi9g09VKm1urrMO1MVJTwc7wpYUa8M0StXx3x/FWDl5/fHaZx3tHLCjKpVK5cG1Dy9WgHtYEp3uAdAZ+Qd9ev+bb7s09bgr3Hy5dgOU5n0722pHeqKQ1Sk13d+201BEnF389+t0i515DgEA0OCHdP7zXKv5XyHqnwsdzNZQBiLi/og4FBGnI+JwRDwQUa37UEQ8vMX2mxdJVs9/Dm4rr81K538vZWtbjfO/fPYXA8WsdKCafyk5N1OePpH1bDhKe9Ly2Dpt/Pjqb1+2PJA1kc//0i1tP58LZpX+6tnT+LKpifmJO8m53s1PIwZ7WuWfLK8EJBFxJCIGt9nGzDPfHlvr2NCG+a+jDetMlW8inq6d/8Voyj+XrL8+OXpflKdPjOZXxWq/3rj21lrt31H+bZCe/70tr//l/AeS+vXaua23ce2PL9a8p9k4/9bXf2/yTsO+jybm5y+PRfQmb9Q6Xb9/vKne+Er9NP/h463H/6FY+UscjYj0In4kIh6NiMeyvj8eEU9ExPHVqd3ozYKfX3ny/WpQ2k7+OyvNf2pL538l6I3mPa2D4oWfvm9odGAr+afn/1Q1Gs72bOb9bzP92t7VDAAAAP8/hYjYH0lhZDkuFEZGav/Dfzj2Fsqzc/PPnpv98NJU7TsCA1Eq5E+6+uueh45lt/V5ebypfDJ7bvxVsa9aHpmcLU91OnnocvvWGP+pP4ud7h2w43xfC7qX8Q/dy/iH7mX8Q/dqMf77OtEPYPe1+vz/pAP9AHZf0/i37AddxP0/dC/jH7qX8Q9daa4vNv6SvECwKojCXdENwQ4FnX5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaI//AgAA//9Lr+a0") r8 = open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r8, r8, 0x0, 0x7f03) syz_mount_image$romfs(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="00db14b1b2bfdfac35bf2eb8b732f3a3265268dcf974ce65c3f3c204584600da55ec1c4ec085889cf2314c81d8deedeff4d8df5aca4d4a4551198b69bedee50beb0a01d4e9363f576bbf8dbb6c81b9eb000000"], 0x1, 0x12d, &(0x7f0000000200)="$eJzs2r9Kw1AUBvCjCEIfwamQgHXIf62DuyA4+QSG9t704o23JIK0U/EFFIfrI7i6iW4+QmafQN/AKZI2sTZ316Hfb7kfOZeTZDnTcTKVBjx3iPZm92cfm5lKu/3ocMADHtPCCRF1q1CU5YNLhvOfelHOXOOC9VqfvUSfvnAhWWj2AAAAAAAAAAAAAAAAAAAAAABYE9ZnHTojrR65kCz4Vc0n04tYSpblzROb6h0d4lodVfejlX69LyJ7vr8j9PFNVfdX6nbTaXek1Ub7fd5VOvbyydQRaZywhF2GYdT3933/IPTmvbx2R/uu/iYqyuexuU9kPy33id59c5+IOotja0fo2+t29+X/IyAgIDShPT9ouB1Zb9X8cAdKDv9wfhgTDeCffAcAAP//NHw5bA==") r9 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r9, 0x4c02, &(0x7f0000000300)={0x0, {}, 0x0, {}, 0x20007, 0x0, 0x200040, 0xd, "22536af39b7c7cb7435b0a43852dbc3a9ada34cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "04106d0c31ef6c1f02a4aa6d0c5aa9263626c0240010f9db74161ccff2c5cf5e", [0x10000004e, 0x6]}) r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r10, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext3\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f00000002c0)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@barrier}, {@auto_da_alloc}, {@nodioread_nolock}]}, 0x1, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r11, &(0x7f0000000100)="b17e9588", 0x4, 0xc00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) ftruncate(r11, 0x100) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)) ioctl$CDROMEJECT(r7, 0x5309) ioctl$CDROMEJECT_SW(r7, 0x530f, 0x0) qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x99000) [ 93.296879][ T4653] Bluetooth: hci0: command tx timeout [ 93.363665][ T938] cfg80211: failed to load regulatory.db [ 93.668041][ T5333] loop0: detected capacity change from 0 to 512 [ 93.686087][ T5333] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 93.701530][ T5333] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 93.734867][ T5333] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 93.745234][ T5333] EXT4-fs (loop0): 1 truncate cleaned up [ 93.757000][ T5333] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.824075][ T5332] loop0: detected capacity change from 512 to 255 [ 93.871334][ T5332] ================================================================== [ 93.874698][ T5332] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.877696][ T5332] Read of size 18446744073709551600 at addr ffff8880529bb2b8 by task syz.0.0/5332 [ 93.881177][ T5332] [ 93.882140][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.882155][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.882164][ T5332] Call Trace: [ 93.882171][ T5332] [ 93.882177][ T5332] dump_stack_lvl+0xe8/0x150 [ 93.882197][ T5332] print_address_description+0x55/0x1e0 [ 93.882239][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.882253][ T5332] print_report+0x58/0x70 [ 93.882268][ T5332] kasan_report+0x117/0x150 [ 93.882283][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.882295][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.882307][ T5332] kasan_check_range+0x264/0x2c0 [ 93.882320][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.882331][ T5332] __asan_memmove+0x29/0x70 [ 93.882341][ T5332] ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.882357][ T5332] ext4_xattr_ibody_set+0x262/0x710 [ 93.882371][ T5332] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 93.882393][ T5332] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 93.882410][ T5332] ? down_write+0x16d/0x200 [ 93.882467][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 93.882478][ T5332] ? ext4_fc_track_inode+0x4d/0x3f0 [ 93.882493][ T5332] ? ext4_fc_track_inode+0xf3/0x3f0 [ 93.882508][ T5332] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 93.882525][ T5332] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 93.882540][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 93.882549][ T5332] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 93.882561][ T5332] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 93.882574][ T5332] ext4_write_begin+0x349/0x1850 [ 93.882590][ T5332] ? ext4_load_tail_bh+0x453/0x7e0 [ 93.882603][ T5332] ? __pfx_ext4_write_begin+0x10/0x10 [ 93.882616][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 93.882626][ T5332] generic_perform_write+0x2d5/0x8f0 [ 93.882641][ T5332] ? __pfx_generic_perform_write+0x10/0x10 [ 93.882656][ T5332] ext4_buffered_write_iter+0xcb/0x370 [ 93.882672][ T5332] ext4_file_write_iter+0x947/0x1c70 [ 93.882690][ T5332] ? vfs_write+0x22b/0xba0 [ 93.882705][ T5332] ? vfs_write+0x22b/0xba0 [ 93.882718][ T5332] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 93.882736][ T5332] vfs_write+0x612/0xba0 [ 93.882752][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 93.882767][ T5332] ? __fget_files+0x2a/0x420 [ 93.882781][ T5332] __x64_sys_pwrite64+0x196/0x220 [ 93.882796][ T5332] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 93.882813][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.882824][ T5332] do_syscall_64+0x174/0x580 [ 93.882836][ T5332] ? trace_irq_disable+0x3b/0x140 [ 93.882849][ T5332] ? clear_bhb_loop+0x40/0x90 [ 93.882861][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.882873][ T5332] RIP: 0033:0x7f26b559e019 [ 93.882884][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.882893][ T5332] RSP: 002b:00007f26b63cefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 93.882908][ T5332] RAX: ffffffffffffffda RBX: 00007f26b5826090 RCX: 00007f26b559e019 [ 93.882916][ T5332] RDX: 0000000000000004 RSI: 0000200000000100 RDI: 000000000000000f [ 93.882924][ T5332] RBP: 00007f26b563500c R08: 0000000000000000 R09: 0000000000000000 [ 93.882931][ T5332] R10: 0000000000000c00 R11: 0000000000000246 R12: 0000000000000000 [ 93.882938][ T5332] R13: 00007f26b5826128 R14: 00007f26b5826090 R15: 00007ffc66412008 [ 93.882950][ T5332] [ 93.882955][ T5332] [ 94.022422][ T5332] The buggy address belongs to the physical page: [ 94.025175][ T5332] page: refcount:3 mapcount:0 mapping:ffff88801d02d940 index:0x2 pfn:0x529bb [ 94.028711][ T5332] memcg:ffff888043c09980 [ 94.030540][ T5332] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.033207][ T5332] flags: 0x4fff18000004214(referenced|dirty|workingset|private|node=1|zone=1|lastcpupid=0x7ff) [ 94.037443][ T5332] raw: 04fff18000004214 0000000000000000 dead000000000122 ffff88801d02d940 [ 94.041021][ T5332] raw: 0000000000000002 ffff88804425a460 00000003ffffffff ffff888043c09980 [ 94.044628][ T5332] page dumped because: kasan: bad access detected [ 94.047332][ T5332] page_owner tracks the page as allocated [ 94.049634][ T5332] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5332, tgid 5330 (syz.0.0), ts 93869707323, free_ts 93861957669 [ 94.057882][ T5332] post_alloc_hook+0x1f9/0x250 [ 94.059957][ T5332] get_page_from_freelist+0x21fa/0x2270 [ 94.062389][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.064913][ T5332] alloc_pages_mpol+0x212/0x380 [ 94.067093][ T5332] alloc_pages_noprof+0xac/0x2a0 [ 94.069335][ T5332] folio_alloc_noprof+0x1e/0x30 [ 94.071515][ T5332] filemap_alloc_folio_noprof+0x111/0x470 [ 94.073981][ T5332] __filemap_get_folio_mpol+0x402/0x1000 [ 94.076583][ T5332] bdev_getblk+0x1f4/0x6e0 [ 94.078583][ T5332] __ext4_get_inode_loc+0x56c/0xf40 [ 94.080822][ T5332] ext4_reserve_inode_write+0x18b/0x360 [ 94.083059][ T5332] __ext4_mark_inode_dirty+0x13e/0x700 [ 94.085235][ T5332] ext4_dirty_inode+0xd0/0x110 [ 94.087351][ T5332] __mark_inode_dirty+0x3a8/0x13b0 [ 94.089608][ T5332] file_update_time_flags+0x3ee/0x4a0 [ 94.091896][ T5332] ext4_write_checks+0x2a9/0x480 [ 94.094064][ T5332] page last free pid 5332 tgid 5330 stack trace: [ 94.096771][ T5332] free_unref_folios+0xd84/0x14a0 [ 94.098867][ T5332] folios_put_refs+0x9e9/0xb30 [ 94.100911][ T5332] shmem_undo_range+0x4e6/0x15d0 [ 94.103068][ T5332] shmem_evict_inode+0x280/0xa80 [ 94.105274][ T5332] evict+0x624/0xb50 [ 94.107009][ T5332] dentry_kill+0x1b9/0x880 [ 94.108967][ T5332] finish_dput+0x1a/0x260 [ 94.110911][ T5332] __fput+0x675/0xa50 [ 94.112659][ T5332] fput_close_sync+0x11f/0x240 [ 94.114779][ T5332] __x64_sys_close+0x7e/0x110 [ 94.116769][ T5332] do_syscall_64+0x174/0x580 [ 94.118803][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.121366][ T5332] [ 94.122461][ T5332] Memory state around the buggy address: [ 94.124865][ T5332] ffff8880529bb180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.128265][ T5332] ffff8880529bb200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.131670][ T5332] >ffff8880529bb280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.135049][ T5332] ^ [ 94.137560][ T5332] ffff8880529bb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.140983][ T5332] ffff8880529bb380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.144406][ T5332] ================================================================== [ 94.472285][ T5332] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.475314][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.478923][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.483035][ T5332] Call Trace: [ 94.484526][ T5332] [ 94.485785][ T5332] vpanic+0x56c/0xa60 [ 94.487586][ T5332] ? __pfx_vpanic+0x10/0x10 [ 94.489549][ T5332] panic+0xc5/0xd0 [ 94.491217][ T5332] ? __pfx_panic+0x10/0x10 [ 94.493117][ T5332] ? preempt_schedule_thunk+0x16/0x40 [ 94.495424][ T5332] ? preempt_schedule_thunk+0x16/0x40 [ 94.497714][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.499986][ T5332] check_panic_on_warn+0x89/0xb0 [ 94.502065][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.504387][ T5332] end_report+0x73/0x170 [ 94.506186][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.508440][ T5332] kasan_report+0x128/0x150 [ 94.510358][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.512571][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.514909][ T5332] kasan_check_range+0x264/0x2c0 [ 94.516959][ T5332] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.519236][ T5332] __asan_memmove+0x29/0x70 [ 94.521114][ T5332] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.523297][ T5332] ext4_xattr_ibody_set+0x262/0x710 [ 94.525571][ T5332] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.528264][ T5332] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.531083][ T5332] ? down_write+0x16d/0x200 [ 94.532997][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.535384][ T5332] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.537578][ T5332] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.539805][ T5332] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.542556][ T5332] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.545454][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.547834][ T5332] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.550276][ T5332] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 94.552821][ T5332] ext4_write_begin+0x349/0x1850 [ 94.554836][ T5332] ? ext4_load_tail_bh+0x453/0x7e0 [ 94.556859][ T5332] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.558946][ T5332] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.561005][ T5332] generic_perform_write+0x2d5/0x8f0 [ 94.563229][ T5332] ? __pfx_generic_perform_write+0x10/0x10 [ 94.565611][ T5332] ext4_buffered_write_iter+0xcb/0x370 [ 94.567865][ T5332] ext4_file_write_iter+0x947/0x1c70 [ 94.570089][ T5332] ? vfs_write+0x22b/0xba0 [ 94.571987][ T5332] ? vfs_write+0x22b/0xba0 [ 94.573951][ T5332] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.576476][ T5332] vfs_write+0x612/0xba0 [ 94.578319][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 94.580172][ T5332] ? __fget_files+0x2a/0x420 [ 94.582040][ T5332] __x64_sys_pwrite64+0x196/0x220 [ 94.584086][ T5332] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.586273][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.588778][ T5332] do_syscall_64+0x174/0x580 [ 94.590823][ T5332] ? trace_irq_disable+0x3b/0x140 [ 94.592846][ T5332] ? clear_bhb_loop+0x40/0x90 [ 94.594924][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.597425][ T5332] RIP: 0033:0x7f26b559e019 [ 94.599442][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.607222][ T5332] RSP: 002b:00007f26b63cefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.610754][ T5332] RAX: ffffffffffffffda RBX: 00007f26b5826090 RCX: 00007f26b559e019 [ 94.614069][ T5332] RDX: 0000000000000004 RSI: 0000200000000100 RDI: 000000000000000f [ 94.617437][ T5332] RBP: 00007f26b563500c R08: 0000000000000000 R09: 0000000000000000 [ 94.620695][ T5332] R10: 0000000000000c00 R11: 0000000000000246 R12: 0000000000000000 [ 94.623902][ T5332] R13: 00007f26b5826128 R14: 00007f26b5826090 R15: 00007ffc66412008 [ 94.627931][ T5332] [ 94.629676][ T5332] Kernel Offset: disabled [ 94.631591][ T5332] Rebooting in 86400 seconds..