program: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c8000006800e9780000000070dc4f0bf2d00e140000000000000000"], 0x1c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000006800010002000000fcffff7f00000000000000000c0002000100000004000400593eb7f0b2617d134e1749cc63403e6dc86a0ecdddd848d2c0f88c69413774e836fccba6329f6b66a1d6f2bd210ad820db5d1c29ef77399377c37a888f1d16b277bf1cb3721adba7dd0ccd00d0a1a8b367cc05c5ecdef10746e1460b99f45aa5dae50000000000"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001800dd8d00000000000000000a000000000000060000000008001e0002"], 0x30}}, 0x4090) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1496c400"/20], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x30000096) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[@ANYBLOB="640000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800e00010069703665727370616e000000897009ba8126119df3faea0112c5fd30100280140006002001000000000000000000000000000214000700fc02000000000000000000000000000004001200"], 0x64}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000800)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff", 0x2ac}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a610b3738b393eed8633fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9d", 0x1cb}, {&(0x7f00000005c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859007067c10aa7352abbdf98e9bf033a4784a11e84639d3b9164d9c5d729f3dd409d39ff6d5cca97", 0x47}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3f42b445293ca980200000000000000ecfd6cc1b3a9a9263506e88c5557069d0ca055991454ec1307b7411892a1beaef9ae54833107eb88b0411b1bc0ba9bc28d0eb6a73ad76be9facd1d9d82b6a3cc2040e84b398d279e50535b6557df8a633cfc7615fca9879b11834eb07eeb4278", 0xaa}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) r5 = socket(0x10, 0x803, 0x0) unshare(0x4000000) sendto(r5, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000b80), 0x3, &(0x7f0000000dc0)=""/136, 0x88}, 0x2}, {{&(0x7f0000000e80)=@isdn, 0x80, &(0x7f0000001f80), 0x0, &(0x7f0000001fc0)=""/212, 0xd4}, 0x8}, {{&(0x7f00000020c0)=@pppoe, 0x80, &(0x7f00000022c0)=[{&(0x7f0000000680)=""/113, 0x77}, {&(0x7f00000021c0)=""/202, 0xda}], 0x2}, 0xed0}, {{&(0x7f0000002300)=@phonet, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000480)=""/101, 0x65}, {&(0x7f0000000ac0)=""/195}], 0x1, 0x0, 0xfffffffffffffdc4}, 0x6}], 0x4, 0x40012001, &(0x7f0000003700)={0x77359400}) r6 = socket$xdp(0x2c, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f0000000180), 0x2, 0x790, &(0x7f0000006a80)="$eJzs3c1rHOUfAPDvbPPSX9qfjSBoPQUEDZRuTI2tgoeKBxEsFPRsGzbbULPJhuymNCGgRQQvgooHQS89W603r75c9Q/w7kFaqqbFiAeJzL6k22Y33aTZbMt+PjDJ88zM5jvfeWbmebIz7AbQs0bSH5mIwxHxURJxqDY/iYj+Sqkv4mR1vbXVlVw6JbG+/sYfSWWdW6sruWh4TepArfJERPzwfsSRzOa4paXlmclCIb9Qq4+VZ+fHSkvLR8/PTk7np/Nzx8cnJo6deP7E8d3L9a+flw9e//jVZ74++c97j1/98MckTsbB2rLGPHbLSIzU9kl/ugvv8Eq8s9vhuirp9gawI+mpua96lsfhJC33dXuTAIAOS0eh6wBAj0n0/wDQY+rvA9xaXcnVp+6+I7G3brwcEfur+dfvb1aX9NXu2e2v3AcdupXccWckiYjhXYg/EhFffPvWlXSKDt2HBGjm3UsRcXZ4ZPP1P9n0zMJ2PdvGOiN31Tfi/9J/n9GBe/kuHf+80Gz8l9kY/0ST8c9gk3N3J1qe/xsy13YhTEvp+O+lhmfb1hryrxneV6v9vzLm60/OnS/k02vbIxExGv2DaX18ixijN/+92WpZ4/jvz0/e/jKNn/6+vUbmWt/gna+ZmixP3k/OjW5ciniyr57/pYYlyUb7Jy3Gv6fbjPHaix983mpZmn+ab33anH9nrV+OeLpp+99+oi3Z8vnEscrhMFY/KJr45tfPhlrFb2z/dFpbXVlPIq7sfqbNpe0/tHX+w0nj85ql7cf46fKh71sta5J/rv6/UFXz438gebNSHqjNuzhZLi+MRwwkr2+ef+z2a+v1+vpp/qNPNT//tzr+09HJ2Tbz77v++1c7z7+z0vynttX+2y9cXZvZ1yp+e+0/USmN1uZsff2rXrfb3cD73X8AAAAAAAAAAAAAAAAAAAAAAAAA0I5MRByMJJPdKGcy2Wz1O7wfi6FMoVgqHzlXXJybisp3ZQ9Hf6b+UZeHGj4Pdbz2efj1+rG76s9FxKMR8eng/yr1bK5YmOp28gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQc6DF9/+nfhvs9tYBAB2zv9sbAADsOf0/APQe/T8A9B79PwD0Hv0/APQe/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAddvrUqXRa/3t1JZfWpy4sLc4ULxydypdmsrOLuWyuuDCfnS4Wpwv5bK44e6+/VygW5ydibvHiWDlfKo+VlpbPzBYX58pnzs9OTufP5Pv3JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2J7S0vLMZKGQX1B4CAp9tVZ7ULZnR4VMPYm9CjrQxjrr8zdPbTuLB2Bndq7QxYsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEPkvwAAAP//vI8fOA==") r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80342, 0x168) unshare(0x2040400) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a000000040000000700000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r8, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000300)}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, r9}, 0x38) pwrite64(r7, &(0x7f0000000140)='2', 0xfdef, 0xfecc) r10 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x2ac00) ioctl$LOOP_SET_STATUS(r10, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x1000, 0x12, 0x1b, 0x0, "9e959f16deab7b08aa26e66c4056a516950600000000000000eef4fb0efcc1d8a6078ed9d5f8643902dd8f6fac274de9d940ffa5e592bbd48685450d00002000", "f625c10e6e0080ffffffffffffffff7e904dc8df6aa3a893ec00347f41be6908", [0xa, 0x80000476]}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r11 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x101042, 0x65) pwrite64(r11, &(0x7f0000000000)='2', 0x1, 0x84fed0) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f0000000040), &(0x7f0000000200)=0x80) [ 94.808544][ T5281] Bluetooth: hci0: command tx timeout [ 94.949275][ T5319] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.963954][ T5319] netlink: 48 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.996159][ T5319] loop0: detected capacity change from 0 to 2048 [ 95.086902][ T5319] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.160618][ T5319] loop0: detected capacity change from 2048 to 2040 [ 95.183345][ T5319] ================================================================== [ 95.183355][ T5319] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183425][ T5319] Read of size 18446744073709551600 at addr ffff88801395feb8 by task syz.0.0/5319 [ 95.183433][ T5319] [ 95.183439][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.183448][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.183453][ T5319] Call Trace: [ 95.183465][ T5319] [ 95.183468][ T5319] dump_stack_lvl+0xe8/0x150 [ 95.183484][ T5319] print_address_description+0x55/0x1e0 [ 95.183495][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183504][ T5319] print_report+0x58/0x70 [ 95.183513][ T5319] kasan_report+0x117/0x150 [ 95.183521][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183534][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183546][ T5319] kasan_check_range+0x264/0x2c0 [ 95.183556][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183568][ T5319] __asan_memmove+0x29/0x70 [ 95.183599][ T5319] ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.183618][ T5319] ext4_xattr_ibody_set+0x262/0x710 [ 95.183632][ T5319] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 95.183648][ T5319] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 95.183667][ T5319] ? down_write+0x16b/0x200 [ 95.183708][ T5319] ext4_destroy_inline_data+0x83/0xe0 [ 95.183721][ T5319] ext4_do_writepages+0x50a/0x4770 [ 95.183729][ T5319] ? kernel_text_address+0xa5/0xe0 [ 95.183739][ T5319] ? unwind_get_return_address+0x4d/0x90 [ 95.183748][ T5319] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 95.183756][ T5319] ? arch_stack_walk+0xfb/0x150 [ 95.183767][ T5319] ? stack_trace_save+0xa9/0x100 [ 95.183773][ T5319] ? __pfx_hlock_conflict+0x10/0x10 [ 95.183783][ T5319] ? check_path+0x21/0x40 [ 95.183793][ T5319] ? add_lock_to_list+0xc7/0x100 [ 95.183801][ T5319] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.183808][ T5319] ? lockdep_unlock+0x5c/0xd0 [ 95.183814][ T5319] ? __lock_acquire+0x1511/0x2de0 [ 95.183824][ T5319] ? lock_acquire+0x115/0x350 [ 95.183833][ T5319] ext4_writepages+0x241/0x3b0 [ 95.183843][ T5319] ? __lock_acquire+0x747/0x2de0 [ 95.183849][ T5319] ? __pfx_ext4_writepages+0x10/0x10 [ 95.183861][ T5319] ? __pfx_ext4_writepages+0x10/0x10 [ 95.183871][ T5319] do_writepages+0x338/0x560 [ 95.183882][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 95.183892][ T5319] file_write_and_wait_range+0x36e/0x440 [ 95.183900][ T5319] ? __mark_inode_dirty+0x4e7/0x13b0 [ 95.183907][ T5319] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 95.183920][ T5319] ext4_sync_file+0x252/0xa40 [ 95.183929][ T5319] ext4_buffered_write_iter+0x2d0/0x380 [ 95.183936][ T5319] ? preempt_schedule_thunk+0x16/0x40 [ 95.183944][ T5319] ext4_file_write_iter+0xae4/0x1cd0 [ 95.183953][ T5319] ? lock_acquire+0x115/0x350 [ 95.183960][ T5319] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.183968][ T5319] vfs_write+0x612/0xba0 [ 95.183978][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 95.183987][ T5319] ? __pfx_do_futex+0x10/0x10 [ 95.183995][ T5319] ? kmem_cache_free+0x182/0x650 [ 95.184007][ T5319] __x64_sys_pwrite64+0x196/0x220 [ 95.184016][ T5319] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 95.184027][ T5319] do_syscall_64+0x166/0x520 [ 95.184035][ T5319] ? trace_irq_disable+0x3b/0x140 [ 95.184042][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.184049][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 95.184056][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.184063][ T5319] RIP: 0033:0x7f09e779e159 [ 95.184070][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.184077][ T5319] RSP: 002b:00007f09e85cefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 95.184090][ T5319] RAX: ffffffffffffffda RBX: 00007f09e7a25fa0 RCX: 00007f09e779e159 [ 95.184098][ T5319] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 000000000000000e [ 95.184105][ T5319] RBP: 00007f09e783506b R08: 0000000000000000 R09: 0000000000000000 [ 95.184112][ T5319] R10: 000000000084fed0 R11: 0000000000000246 R12: 0000000000000000 [ 95.184119][ T5319] R13: 00007f09e7a26038 R14: 00007f09e7a25fa0 R15: 00007ffeb9699318 [ 95.184131][ T5319] [ 95.184135][ T5319] [ 95.184138][ T5319] The buggy address belongs to the physical page: [ 95.184143][ T5319] page: refcount:2 mapcount:0 mapping:ffff88801d025940 index:0x2 pfn:0x1395f [ 95.184151][ T5319] memcg:ffff8880441ae000 [ 95.184156][ T5319] aops:def_blk_aops ino:700000 dentry name(?):"" [ 95.184215][ T5319] flags: 0xfff58000004234(referenced|dirty|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff) [ 95.184227][ T5319] raw: 00fff58000004234 ffff88801ce95a20 ffffea0000499bc8 ffff88801d025940 [ 95.184234][ T5319] raw: 0000000000000002 ffff8880130017e0 00000002ffffffff ffff8880441ae000 [ 95.184238][ T5319] page dumped because: kasan: bad access detected [ 95.184241][ T5319] page_owner tracks the page as allocated [ 95.184244][ T5319] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5319, tgid 5318 (syz.0.0), ts 95163655080 [ 95.184257][ T5319] post_alloc_hook+0x1f9/0x250 [ 95.184268][ T5319] get_page_from_freelist+0x2209/0x2280 [ 95.184283][ T5319] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.184293][ T5319] alloc_pages_mpol+0x21e/0x390 [ 95.184299][ T5319] alloc_pages_noprof+0xb1/0x2b0 [ 95.184305][ T5319] folio_alloc_noprof+0x1e/0x30 [ 95.184312][ T5319] filemap_alloc_folio_noprof+0x111/0x460 [ 95.184318][ T5319] __filemap_get_folio_mpol+0x402/0x1000 [ 95.184326][ T5319] bdev_getblk+0x1f4/0x6e0 [ 95.184333][ T5319] __ext4_get_inode_loc+0x56c/0xf40 [ 95.184341][ T5319] ext4_get_inode_loc+0x81/0xf0 [ 95.184349][ T5319] ext4_xattr_ibody_get+0x113/0x4b0 [ 95.184358][ T5319] ext4_xattr_get+0x121/0x690 [ 95.184367][ T5319] vfs_getxattr_alloc+0x454/0x5c0 [ 95.184375][ T5319] ima_read_xattr+0x38/0x60 [ 95.184382][ T5319] process_measurement+0x110a/0x1c10 [ 95.184390][ T5319] page last free pid 5319 tgid 5318 ts 95162060104 stack trace: [ 95.184395][ T5319] free_unref_folios+0xdc2/0x14e0 [ 95.184403][ T5319] folios_put_refs+0x9e9/0xb30 [ 95.184412][ T5319] free_pages_and_swap_cache+0x41e/0x490 [ 95.184420][ T5319] tlb_flush_mmu+0x6d3/0xa30 [ 95.184428][ T5319] tlb_finish_mmu+0xf4/0x220 [ 95.184437][ T5319] unmap_region+0x2a5/0x330 [ 95.184448][ T5319] mmap_region+0xc89/0x2270 [ 95.184454][ T5319] do_mmap+0xe0a/0x1300 [ 95.184461][ T5319] vm_mmap_pgoff+0x272/0x4e0 [ 95.184467][ T5319] do_syscall_64+0x166/0x520 [ 95.184476][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.184483][ T5319] [ 95.184484][ T5319] Memory state around the buggy address: [ 95.184488][ T5319] ffff88801395fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.184493][ T5319] ffff88801395fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.184497][ T5319] >ffff88801395fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.184500][ T5319] ^ [ 95.184504][ T5319] ffff88801395ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.184508][ T5319] ffff88801395ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.184512][ T5319] ================================================================== [ 95.187765][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.487396][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.491415][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.495848][ T5319] Call Trace: [ 95.497336][ T5319] [ 95.498669][ T5319] vpanic+0x56d/0xa60 [ 95.500514][ T5319] ? __pfx_vpanic+0x10/0x10 [ 95.502559][ T5319] panic+0xc5/0xd0 [ 95.504259][ T5319] ? __pfx_panic+0x10/0x10 [ 95.506285][ T5319] ? preempt_schedule_thunk+0x16/0x40 [ 95.508703][ T5319] ? preempt_schedule_thunk+0x16/0x40 [ 95.511100][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.513534][ T5319] check_panic_on_warn+0x89/0xb0 [ 95.515746][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.518132][ T5319] end_report+0x73/0x170 [ 95.519976][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.522344][ T5319] kasan_report+0x128/0x150 [ 95.524423][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.526851][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.529285][ T5319] kasan_check_range+0x264/0x2c0 [ 95.531481][ T5319] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.533898][ T5319] __asan_memmove+0x29/0x70 [ 95.535894][ T5319] ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.538188][ T5319] ext4_xattr_ibody_set+0x262/0x710 [ 95.540489][ T5319] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 95.543228][ T5319] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 95.546183][ T5319] ? down_write+0x16b/0x200 [ 95.548179][ T5319] ext4_destroy_inline_data+0x83/0xe0 [ 95.550571][ T5319] ext4_do_writepages+0x50a/0x4770 [ 95.552873][ T5319] ? kernel_text_address+0xa5/0xe0 [ 95.555208][ T5319] ? unwind_get_return_address+0x4d/0x90 [ 95.557694][ T5319] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 95.560436][ T5319] ? arch_stack_walk+0xfb/0x150 [ 95.562535][ T5319] ? stack_trace_save+0xa9/0x100 [ 95.564753][ T5319] ? __pfx_hlock_conflict+0x10/0x10 [ 95.566970][ T5319] ? check_path+0x21/0x40 [ 95.568896][ T5319] ? add_lock_to_list+0xc7/0x100 [ 95.571060][ T5319] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.573521][ T5319] ? lockdep_unlock+0x5c/0xd0 [ 95.575647][ T5319] ? __lock_acquire+0x1511/0x2de0 [ 95.577888][ T5319] ? lock_acquire+0x115/0x350 [ 95.579997][ T5319] ext4_writepages+0x241/0x3b0 [ 95.582152][ T5319] ? __lock_acquire+0x747/0x2de0 [ 95.584366][ T5319] ? __pfx_ext4_writepages+0x10/0x10 [ 95.586610][ T5319] ? __pfx_ext4_writepages+0x10/0x10 [ 95.588885][ T5319] do_writepages+0x338/0x560 [ 95.590967][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 95.593274][ T5319] file_write_and_wait_range+0x36e/0x440 [ 95.595791][ T5319] ? __mark_inode_dirty+0x4e7/0x13b0 [ 95.598137][ T5319] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 95.600895][ T5319] ext4_sync_file+0x252/0xa40 [ 95.603033][ T5319] ext4_buffered_write_iter+0x2d0/0x380 [ 95.605492][ T5319] ? preempt_schedule_thunk+0x16/0x40 [ 95.607858][ T5319] ext4_file_write_iter+0xae4/0x1cd0 [ 95.610272][ T5319] ? lock_acquire+0x115/0x350 [ 95.612326][ T5319] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.614775][ T5319] vfs_write+0x612/0xba0 [ 95.616623][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 95.618654][ T5319] ? __pfx_do_futex+0x10/0x10 [ 95.620750][ T5319] ? kmem_cache_free+0x182/0x650 [ 95.622896][ T5319] __x64_sys_pwrite64+0x196/0x220 [ 95.625072][ T5319] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 95.627579][ T5319] do_syscall_64+0x166/0x520 [ 95.629599][ T5319] ? trace_irq_disable+0x3b/0x140 [ 95.631852][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.634598][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 95.636739][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.639389][ T5319] RIP: 0033:0x7f09e779e159 [ 95.641395][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.649889][ T5319] RSP: 002b:00007f09e85cefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 95.653370][ T5319] RAX: ffffffffffffffda RBX: 00007f09e7a25fa0 RCX: 00007f09e779e159 [ 95.656909][ T5319] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 000000000000000e [ 95.660458][ T5319] RBP: 00007f09e783506b R08: 0000000000000000 R09: 0000000000000000 [ 95.663908][ T5319] R10: 000000000084fed0 R11: 0000000000000246 R12: 0000000000000000 [ 95.667409][ T5319] R13: 00007f09e7a26038 R14: 00007f09e7a25fa0 R15: 00007ffeb9699318 [ 95.670873][ T5319] [ 95.672773][ T5319] Kernel Offset: disabled [ 95.674738][ T5319] Rebooting in 86400 seconds..