program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") truncate(&(0x7f0000000280)='./file1\x00', 0x1bf8) io_setup(0x1, &(0x7f00000004c0)=0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x10d) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0x3}, @restrict, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2, 0x7f}}]}}, 0x0, 0x4a, 0x0, 0x1}, 0x20) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000140)='i', 0xa800, 0xe00}]) [ 92.662222][ T4642] Bluetooth: hci0: command tx timeout [ 92.704508][ T9] cfg80211: failed to load regulatory.db [ 92.737827][ T5312] loop0: detected capacity change from 0 to 512 [ 92.914633][ T5312] EXT4-fs (loop0): 1 truncate cleaned up [ 92.916435][ T5312] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 92.977764][ T5312] loop0: detected capacity change from 512 to 64 [ 93.003974][ T5312] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 93.005172][ T5312] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 93.029548][ T5312] syz.0.0: attempt to access beyond end of device [ 93.029548][ T5312] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 93.029573][ T5312] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 36) [ 93.029636][ T5312] Buffer I/O error on device loop0, logical block 36 [ 93.102010][ T140] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:6: corrupted inode contents [ 93.103838][ T140] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm kworker/u4:6: mark_inode_dirty error [ 93.104465][ T140] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:6: corrupted inode contents [ 93.104778][ T140] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm kworker/u4:6: mark_inode_dirty error [ 93.138378][ T5312] syz.0.0: attempt to access beyond end of device [ 93.138378][ T5312] loop0: rw=2049, sector=136, nr_sectors = 18 limit=64 [ 93.138404][ T5312] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 68) [ 93.138423][ T5312] Buffer I/O error on device loop0, logical block 68 [ 93.138544][ T5312] Buffer I/O error on device loop0, logical block 69 [ 93.138552][ T5312] Buffer I/O error on device loop0, logical block 70 [ 93.138558][ T5312] Buffer I/O error on device loop0, logical block 71 [ 93.138565][ T5312] Buffer I/O error on device loop0, logical block 72 [ 93.138576][ T5312] Buffer I/O error on device loop0, logical block 73 [ 93.138583][ T5312] Buffer I/O error on device loop0, logical block 74 [ 93.138588][ T5312] Buffer I/O error on device loop0, logical block 75 [ 93.138595][ T5312] Buffer I/O error on device loop0, logical block 76 [ 93.247849][ T5312] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.0: corrupted inode contents [ 93.248967][ T5312] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm syz.0.0: mark_inode_dirty error [ 93.250007][ T5312] ------------[ cut here ]------------ [ 93.250014][ T5312] kernel BUG at fs/ext4/mballoc.c:4781! [ 93.250065][ T5312] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 93.266284][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.269810][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.273865][ T5312] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 93.279858][ T5312] Code: e8 96 ab a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 82 2c 2f ff 90 0f 0b e8 7a 2c 2f ff 90 0f 0b e8 72 2c 2f ff 90 <0f> 0b e8 6a 2c 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 93.287154][ T5312] RSP: 0018:ffffc9000f61e840 EFLAGS: 00010287 [ 93.289789][ T5312] RAX: ffffffff8298f3de RBX: 00000000fffffff3 RCX: 0000000000100000 [ 93.293161][ T5312] RDX: ffffc9000ed42000 RSI: 000000000000821c RDI: 000000000000821d [ 93.296242][ T5312] RBP: 1ffff11008a624d2 R08: ffff88804531707b R09: 1ffff11008a62e0f [ 93.299608][ T5312] R10: dffffc0000000000 R11: ffffed1008a62e10 R12: 0000000000000000 [ 93.303062][ T5312] R13: 0000000000000022 R14: 1ffff11008a62e12 R15: ffff888045317090 [ 93.306442][ T5312] FS: 00007f5c1b9f76c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 93.310260][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.313182][ T5312] CR2: 000020000000a000 CR3: 00000000130cd000 CR4: 0000000000352ef0 [ 93.316492][ T5312] Call Trace: [ 93.317931][ T5312] [ 93.319179][ T5312] ext4_mb_use_preallocated+0x638/0x13e0 [ 93.321705][ T5312] ext4_mb_new_blocks+0x5a0/0x4530 [ 93.323782][ T5312] ? do_raw_spin_unlock+0x4d/0x200 [ 93.326075][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 93.328366][ T5312] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 93.330700][ T5312] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 93.332866][ T5312] ? ext4_block_to_path+0x382/0x700 [ 93.335078][ T5312] ext4_ind_map_blocks+0xe96/0x22a0 [ 93.337290][ T5312] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 93.339657][ T5312] ? kasan_save_track+0x4f/0x80 [ 93.341662][ T5312] ? __kasan_slab_alloc+0x6c/0x80 [ 93.343807][ T5312] ? down_write+0x16b/0x200 [ 93.345701][ T5312] ext4_map_create_blocks+0xbb/0x530 [ 93.347941][ T5312] ? ext4_fc_track_inode+0xf3/0x3f0 [ 93.350141][ T5312] ext4_map_blocks+0x791/0x12c0 [ 93.352194][ T5312] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 93.354420][ T5312] ? __pfx_ext4_map_blocks+0x10/0x10 [ 93.356685][ T5312] ? kmem_cache_alloc_noprof+0x156/0x600 [ 93.359144][ T5312] ext4_do_writepages+0x1901/0x4770 [ 93.361190][ T5312] ? __lock_acquire+0x747/0x2de0 [ 93.363763][ T5312] ? __pfx_ext4_do_writepages+0x10/0x10 [ 93.366488][ T5312] ? __lock_acquire+0x747/0x2de0 [ 93.368587][ T5312] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 93.370769][ T5312] ? debug_object_free+0x29c/0x340 [ 93.373002][ T5312] ? lock_acquire+0x115/0x350 [ 93.374961][ T5312] ext4_writepages+0x241/0x3b0 [ 93.377000][ T5312] ? __pfx_ext4_writepages+0x10/0x10 [ 93.379418][ T5312] ? __pfx_ext4_writepages+0x10/0x10 [ 93.381707][ T5312] do_writepages+0x338/0x560 [ 93.384914][ T5312] ? do_raw_spin_unlock+0x4d/0x200 [ 93.387170][ T5312] file_write_and_wait_range+0x36e/0x440 [ 93.389517][ T5312] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 93.391969][ T5312] ext4_sync_file+0x252/0xa40 [ 93.393833][ T5312] ext4_buffered_write_iter+0x2d0/0x380 [ 93.396054][ T5312] ext4_file_write_iter+0xae4/0x1cd0 [ 93.398129][ T5312] ? io_submit_one+0x134/0x13d0 [ 93.399958][ T5312] ? kasan_save_track+0x4f/0x80 [ 93.401915][ T5312] ? kasan_save_track+0x3e/0x80 [ 93.403798][ T5312] ? lock_acquire+0x115/0x350 [ 93.405607][ T5312] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 93.408009][ T5312] ? aio_write+0x54a/0x870 [ 93.409894][ T5312] aio_write+0x5d0/0x870 [ 93.411700][ T5312] ? __pfx_aio_write+0x10/0x10 [ 93.413605][ T5312] io_submit_one+0x798/0x13d0 [ 93.415519][ T5312] ? lockdep_hardirqs_on+0x7b/0x110 [ 93.417558][ T5312] ? irqentry_exit+0x218/0x920 [ 93.419429][ T5312] ? __pfx_io_submit_one+0x10/0x10 [ 93.421341][ T5312] ? lock_acquire+0x115/0x350 [ 93.423137][ T5312] ? __might_fault+0xaf/0x130 [ 93.424933][ T5312] __se_sys_io_submit+0x195/0x340 [ 93.426829][ T5312] ? __pfx___se_sys_io_submit+0x10/0x10 [ 93.429052][ T5312] do_syscall_64+0x166/0x520 [ 93.430854][ T5312] ? trace_irq_disable+0x3b/0x140 [ 93.432911][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.435908][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 93.437765][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.440294][ T5312] RIP: 0033:0x7f5c1ab9e1d9 [ 93.442244][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.450031][ T5312] RSP: 002b:00007f5c1b9f6fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 93.453235][ T5312] RAX: ffffffffffffffda RBX: 00007f5c1ae25fa0 RCX: 00007f5c1ab9e1d9 [ 93.456220][ T5312] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 00007f5c1b9b5000 [ 93.459310][ T5312] RBP: 00007f5c1ac35888 R08: 0000000000000000 R09: 0000000000000000 [ 93.462268][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.465192][ T5312] R13: 00007f5c1ae26038 R14: 00007f5c1ae25fa0 R15: 00007fff51581078 [ 93.468254][ T5312] [ 93.469523][ T5312] Modules linked in: [ 93.471755][ T5312] ---[ end trace 0000000000000000 ]--- [ 93.474240][ T5312] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 93.474258][ T5312] Code: e8 96 ab a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 82 2c 2f ff 90 0f 0b e8 7a 2c 2f ff 90 0f 0b e8 72 2c 2f ff 90 <0f> 0b e8 6a 2c 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 93.474265][ T5312] RSP: 0018:ffffc9000f61e840 EFLAGS: 00010287 [ 93.474273][ T5312] RAX: ffffffff8298f3de RBX: 00000000fffffff3 RCX: 0000000000100000 [ 93.474280][ T5312] RDX: ffffc9000ed42000 RSI: 000000000000821c RDI: 000000000000821d [ 93.474285][ T5312] RBP: 1ffff11008a624d2 R08: ffff88804531707b R09: 1ffff11008a62e0f [ 93.474291][ T5312] R10: dffffc0000000000 R11: ffffed1008a62e10 R12: 0000000000000000 [ 93.474298][ T5312] R13: 0000000000000022 R14: 1ffff11008a62e12 R15: ffff888045317090 [ 93.474306][ T5312] FS: 00007f5c1b9f76c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 93.474314][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.474321][ T5312] CR2: 000020000000a000 CR3: 00000000130cd000 CR4: 0000000000352ef0 [ 93.474362][ T5312] Kernel panic - not syncing: Fatal exception [ 93.512742][ T5312] Kernel Offset: disabled [ 93.514592][ T5312] Rebooting in 86400 seconds..