program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f0000000940)={[{@min_batch_time={'min_batch_time', 0x3d, 0x5}}, {@auto_da_alloc}, {@mb_optimize_scan}, {@noload}, {@noload}, {@noblock_validity}, {@barrier_val={'barrier', 0x3d, 0x80}}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000}}]}, 0xfe, 0x497, &(0x7f0000000a00)="$eJzs3M1vVFUbAPDnTjulwMvbivgBglTRSPxoafmQhRuNJiw0MdEFxriobSGVQg2tiZBGqwtcGhL3xoX/g3GlG6NuNHGre0NCTDegbq65c++0pZ07bWk7A/T3S2Y4597TOee5557h3HtmJoAtqy97SiL+FxG/R0RPnr21QF/+z825mZG/52ZGkkjTN/5KauVuzM2M1IvW/25nnknTIr+tQb1X3o4YnpgYu1jkB6bPvz8wdenyc+Pnh8+OnR27MHTy5LGjB7pODB3fkDizuG7s+2hy/95Tb119beT01Xd/SiqRxx1L4tgoffnRbejJja6szXZFOt/NSWf23F3kDv6yUKrRmUA7dURE1l3V2vjviY7YPr+vJ175tK2NAzZVmqZpk3fl2RS4hyXR7hYA7VH/jz67/r0xN5NsxnXwnez6i/kFUBb3zeKR7+mMSp44WK1d326Ovog4PfvPl9kjNuk+BADAYt9l859n5+d/Iwvzj0o8mCe6sqf/F2sovRFxX0Tsjoj7I2JPRDwQUSv7UEQ8vMb6l66QLJ//VK7ddnCrkM3/XijWtm6d/1XqRXo7ityuWvzV5Mz4xNiR4pgcjuq2M+PJ2GCTOr5/+bfPy/Ytnv9lj6z++lywaMe1ziU36EaHp4cj5tYT9rzrn+QdvDz+pLYuMFuU2xsR+26zjvGnO0v3rRx/E+Uvu2rpVxFP5fHPxpL465LS9cnB508MHR/ojomxIwP1s2K5n3+98npZ/euKfwNk/b+jpP8LvUl3xNSly+dq67VTa6/jyh+fNb2mWcP5f2pXcf53JW/WNnQVOz4cnp6+OBjRlby6fPvQwqvV8/XyWfyHDzUe/7tj4Ug8EhH7I+JARDyaXRQWffdYRDweEYeaxPfjS0+8V7avvP9bs1aaxT+6Uv/H4v5fe6Lj3A/frhx/d0SU9f+xWupwsSV//2tutQ1cz7EDAACAu0X+Gfik0r+QTvr788/w74kdlYnJqelnzkx+cGE0/6x8b1Qr9TtdPYvuhw4W94br+aEl+aPFfeMvOrbX8v0jkxOj7Q4etridy8Z/pZKN/8yfHe1uHbDpNmAdDbhLGf+wdRn/sDUlK47/asvaArRe4/H/ztctbwjQco3G/8elpfu/2dTGAC21muv/7S1oB9B6qxj/xfcAy2cFwN3J/X/Yuox/2JJKvxtfWddX/lue+Lf4PcM7pT33fiIqzcp03gEtvEcSnav+MYuyRHX5WE578vGfbdnW8K/a/c4EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwMf4LAAD//zC/53M=") r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000f80), r1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r3) sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={&(0x7f0000000240)={0x34, r4, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)={0x28, r2, 0x101, 0x70bd26, 0x25dfcbfe, {}, [@IEEE802154_ATTR_CSMA_MAX_BE={0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040004}, 0x800c014) open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close(0x3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000200), 0xfea7) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r6, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8, 0xfffffffffffffffe]}) close(0x3) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) [ 98.072019][ T5301] usblp 5-1:250.228:[ 94.727468][ T4647] Bluetooth: hci0: command tx timeout [ 94.790367][ T5320] loop0: detected capacity change from 0 to 512 [ 95.098954][ T5320] EXT4-fs error (device loop0): __ext4_iget:5592: inode #15: block 1803188595: comm syz.0.0: invalid block [ 95.099340][ T5320] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 95.107445][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 95.107490][ C0] EXT4-fs (loop0): initial error at time 1788067967: __ext4_iget:5592: inode 15: block 1803188595 [ 95.107646][ C0] EXT4-fs (loop0): last error at time 1788067967: __ext4_iget:5592: inode 15: block 1803188595 [ 95.120001][ T5320] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 95.120479][ T5320] loop0: lost filesystem error report for type 5 error -117 [ 95.165452][ T5320] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.253908][ T5320] loop0: detected capacity change from 512 to 64 [ 95.276519][ T5320] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #19: comm syz.0.0: corrupted inode contents [ 95.288072][ T5320] EXT4-fs error (device loop0): ext4_dirty_inode:6731: inode #19: comm syz.0.0: mark_inode_dirty error [ 95.288841][ T5320] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #19: comm syz.0.0: corrupted inode contents qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xbd000) [ 95.289326][ T5320] EXT4-fs error (device loop0): ext4_dirty_inode:6731: inode #19: comm syz.0.0: mark_inode_dirty error [ 95.289847][ T5320] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #19: comm syz.0.0: corrupted inode contents [ 95.292450][ T5320] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2537: inode #19: comm syz.0.0: mark_inode_dirty error [ 95.292763][ T5320] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2541: comm syz.0.0: Failed to mark inode 19 dirty [ 95.293426][ T5320] syz.0.0: attempt to access beyond end of device [ 95.293426][ T5320] loop0: rw=1, sector=258, nr_sectors = 24 limit=64 [ 95.293470][ T5320] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 19 starting block 129) [ 95.293594][ T5320] Buffer I/O error on device loop0, logical block 129 [ 95.293624][ T5320] Buffer I/O error on device loop0, logical block 130 [ 95.293633][ T5320] Buffer I/O error on device loop0, logical block 131 [ 95.293641][ T5320] Buffer I/O error on device loop0, logical block 132 [ 95.293647][ T5320] Buffer I/O error on device loop0, logical block 133 [ 95.293655][ T5320] Buffer I/O error on device loop0, logical block 134 [ 95.293661][ T5320] Buffer I/O error on device loop0, logical block 135 [ 95.293668][ T5320] Buffer I/O error on device loop0, logical block 136 [ 95.293674][ T5320] Buffer I/O error on device loop0, logical block 137 [ 95.293681][ T5320] Buffer I/O error on device loop0, logical block 138 [ 95.310169][ T1056] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #19: comm kworker/u4:8: corrupted inode contents [ 95.341168][ T1056] EXT4-fs error (device loop0): ext4_dirty_inode:6731: inode #19: comm kworker/u4:8: mark_inode_dirty error [ 95.344827][ T1056] ------------[ cut here ]------------ [ 95.344841][ T1056] kernel BUG at fs/ext4/mballoc.c:4781! [ 95.344859][ T1056] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 95.418533][ T1056] CPU: 0 UID: 0 PID: 1056 Comm: kworker/u4:8 Not tainted syzkaller #0 PREEMPT(full) [ 95.421983][ T1056] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.425792][ T1056] Workqueue: writeback wb_workfn (flush-7:0) [ 95.428158][ T1056] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.430584][ T1056] Code: e8 06 01 a2 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 e2 9a 30 ff 90 0f 0b e8 da 9a 30 ff 90 0f 0b e8 d2 9a 30 ff 90 <0f> 0b e8 ca 9a 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.438006][ T1056] RSP: 0018:ffffc9000523e540 EFLAGS: 00010293 [ 95.440620][ T1056] RAX: ffffffff8297299e RBX: 00000000ffffffec RCX: ffff8880365a0000 [ 95.444405][ T1056] RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000020 [ 95.448888][ T1056] RBP: 1ffff11008830729 R08: ffff88804418807b R09: 1ffff1100883100f [ 95.452823][ T1056] R10: dffffc0000000000 R11: ffffed1008831010 R12: 0000000000000000 [ 95.456209][ T1056] R13: 0000000000000034 R14: 1ffff11008831012 R15: ffff888044188090 [ 95.459541][ T1056] FS: 0000000000000000(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000 [ 95.463303][ T1056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.465908][ T1056] CR2: 00007f0ac518f000 CR3: 000000000eb48000 CR4: 0000000000352ef0 [ 95.469180][ T1056] Call Trace: [ 95.470658][ T1056] [ 95.471986][ T1056] ext4_mb_use_preallocated+0x638/0x13e0 [ 95.474441][ T1056] ext4_mb_new_blocks+0x5a0/0x4530 [ 95.476624][ T1056] ? rcu_is_watching+0x16/0xb0 [ 95.479639][ T1056] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 95.482247][ T1056] ? unwind_next_frame+0x1baf/0x2550 [ 95.484573][ T1056] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 95.486955][ T1056] ? ret_from_fork_asm+0x1a/0x30 [ 95.489120][ T1056] ? ext4_block_to_path+0x382/0x700 [ 95.491311][ T1056] ext4_ind_map_blocks+0xe96/0x22a0 [ 95.493601][ T1056] ? lockdep_unlock+0x5c/0xd0 [ 95.495512][ T1056] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 95.497779][ T1056] ? down_write+0x16b/0x200 [ 95.499709][ T1056] ext4_map_create_blocks+0xbb/0x530 [ 95.501715][ T1056] ? ext4_fc_track_inode+0xf3/0x3f0 [ 95.503810][ T1056] ext4_map_blocks+0x791/0x12c0 [ 95.505839][ T1056] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 95.508060][ T1056] ? __pfx_ext4_map_blocks+0x10/0x10 [ 95.510274][ T1056] ? kmem_cache_alloc_noprof+0x156/0x600 [ 95.512660][ T1056] ext4_do_writepages+0x1901/0x4770 [ 95.514897][ T1056] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.517332][ T1056] ? __lock_acquire+0x6df/0x2e50 [ 95.519426][ T1056] ? filemap_get_folios_tag+0x118/0x720 [ 95.521770][ T1056] ? filemap_get_folios_tag+0x639/0x720 [ 95.524169][ T1056] ? filemap_get_folios_tag+0x118/0x720 [ 95.526458][ T1056] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 95.528965][ T1056] ? lock_acquire+0x115/0x350 [ 95.530884][ T1056] ext4_writepages+0x241/0x3b0 [ 95.532883][ T1056] ? __pfx_ext4_writepages+0x10/0x10 [ 95.535137][ T1056] ? __pfx_ext4_writepages+0x10/0x10 [ 95.537327][ T1056] do_writepages+0x338/0x560 [ 95.539296][ T1056] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.541467][ T1056] ? reacquire_held_locks+0x117/0x1a0 [ 95.543791][ T1056] ? writeback_sb_inodes+0x450/0x1b00 [ 95.546063][ T1056] __writeback_single_inode+0x136/0x1220 [ 95.548569][ T1056] ? do_raw_spin_unlock+0x4d/0x200 [ 95.550785][ T1056] writeback_sb_inodes+0x9de/0x1b00 [ 95.553097][ T1056] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 95.555482][ T1056] ? __pfx_down_read_trylock+0x10/0x10 [ 95.557816][ T1056] ? __pfx___up_read+0x10/0x10 [ 95.559876][ T1056] __writeback_inodes_wb+0x114/0x240 [ 95.562205][ T1056] wb_writeback+0x42f/0xad0 [ 95.564183][ T1056] ? queue_io+0x221/0x470 [ 95.566009][ T1056] ? __pfx_wb_writeback+0x10/0x10 [ 95.568159][ T1056] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.570336][ T1056] wb_workfn+0x980/0x10f0 [ 95.572258][ T1056] ? __pfx_wb_workfn+0x10/0x10 [ 95.574472][ T1056] ? lapic_next_event+0x11/0x20 [ 95.576556][ T1056] ? clockevents_program_event+0x491/0x630 [ 95.579106][ T1056] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.581299][ T1056] ? lock_acquire+0x115/0x350 [ 95.583321][ T1056] ? rcu_is_watching+0x16/0xb0 [ 95.585427][ T1056] ? process_scheduled_works+0x97a/0x1630 [ 95.587910][ T1056] process_scheduled_works+0xc3d/0x1630 [ 95.590312][ T1056] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.592882][ T1056] ? assign_work+0x3cf/0x5d0 [ 95.594860][ T1056] worker_thread+0xa47/0xfb0 [ 95.596807][ T1056] kthread+0x38b/0x480 [ 95.598393][ T1056] ? __pfx_worker_thread+0x10/0x10 [ 95.600647][ T1056] ? __pfx_kthread+0x10/0x10 [ 95.602751][ T1056] ret_from_fork+0x514/0xb70 [ 95.604844][ T1056] ? __pfx_ret_from_fork+0x10/0x10 [ 95.607082][ T1056] ? __switch_to+0xc89/0x1420 [ 95.609258][ T1056] ? __pfx_kthread+0x10/0x10 [ 95.611346][ T1056] ret_from_fork_asm+0x1a/0x30 [ 95.613511][ T1056] [ 95.614936][ T1056] Modules linked in: [ 95.617684][ T1056] ---[ end trace 0000000000000000 ]--- [ 95.620314][ T1056] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.620336][ T1056] Code: e8 06 01 a2 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 e2 9a 30 ff 90 0f 0b e8 da 9a 30 ff 90 0f 0b e8 d2 9a 30 ff 90 <0f> 0b e8 ca 9a 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.620347][ T1056] RSP: 0018:ffffc9000523e540 EFLAGS: 00010293 [ 95.620359][ T1056] RAX: ffffffff8297299e RBX: 00000000ffffffec RCX: ffff8880365a0000 [ 95.620368][ T1056] RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000020 [ 95.620375][ T1056] RBP: 1ffff11008830729 R08: ffff88804418807b R09: 1ffff1100883100f [ 95.620385][ T1056] R10: dffffc0000000000 R11: ffffed1008831010 R12: 0000000000000000 [ 95.620392][ T1056] R13: 0000000000000034 R14: 1ffff11008831012 R15: ffff888044188090 [ 95.620400][ T1056] FS: 0000000000000000(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000 [ 95.620409][ T1056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.620418][ T1056] CR2: 00007f0ac518f000 CR3: 000000000eb48000 CR4: 0000000000352ef0 [ 95.620454][ T1056] Kernel panic - not syncing: Fatal exception [ 95.662762][ T1056] Kernel Offset: disabled [ 95.664728][ T1056] Rebooting in 86400 seconds..