program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dcbeec0696c37b64e3b24da3183dbe97e805165c0f63cdc2e82818254950ee03568b88091e6a86450545c0e18e09"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dcbeec0696c37b64e3b24da3183dbe97e805165c0f63cdc2e82818254950ee03568b88091e6a86450545c0e18e09"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r1, r0, 0x2, 0x0, @void}, 0x10) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dcbeec0696c37b64e3b24da3183dbe97e805165c0f63cdc2e82818254950ee03568b88091e6a86450545c0e18e09"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r4, r3, 0x2, 0x0, @void}, 0x10) bpf$LINK_DETACH(0x22, &(0x7f0000000380)=r2, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@abort}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") (async) r6 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@abort}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r7, &(0x7f0000000140)='2', 0x1, 0x8000c61) (async) pwrite64(r7, &(0x7f0000000140)='2', 0x1, 0x8000c61) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) (async) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x3, 0x0) r12 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r12) (async) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r12) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x24, 0x24, 0x200, 0x2, 0x4, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x24, 0x24, 0x200, 0x2, 0x4, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@getchain={0x24, 0x66, 0x8, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xe}, {0xe, 0xb}, {0x9, 0x3}}}, 0x24}}, 0x80) (async) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@getchain={0x24, 0x66, 0x8, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xe}, {0xe, 0xb}, {0x9, 0x3}}}, 0x24}}, 0x80) pwrite64(r9, &(0x7f0000000140)='2', 0xfdef, 0xfecc) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000240)=ANY=[@ANYRES16=r14, @ANYRESHEX=r1, @ANYRES8=r13, @ANYRES32=r6, @ANYRESHEX], 0x841, 0x0) (async) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000240)=ANY=[@ANYRES16=r14, @ANYRESHEX=r1, @ANYRES8=r13, @ANYRES32=r6, @ANYRESHEX], 0x841, 0x0) r15 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r15, &(0x7f00000000c0)={0x18}, 0xfffffdef) (async) write$FUSE_WRITE(r15, &(0x7f00000000c0)={0x18}, 0xfffffdef) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'veth0_to_batadv\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r16, {}, {0xffff, 0xffff}, {0xd, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x800}, @TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x1}]}}]}, 0x40}}, 0x0) [ 68.465177][ T4672] Bluetooth: hci0: command tx timeout [ 68.576771][ T5324] loop0: detected capacity change from 0 to 1024 [ 68.615562][ T5324] ======================================================= [ 68.615562][ T5324] WARNING: The mand mount option has been deprecated and [ 68.615562][ T5324] and is ignored by this kernel. Remove the mand [ 68.615562][ T5324] option from the mount to silence this warning. [ 68.615562][ T5324] ======================================================= [ 68.666868][ T5324] EXT4-fs: Ignoring removed oldalloc option [ 68.669264][ T5324] EXT4-fs: Ignoring removed orlov option [ 68.680995][ T5324] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 68.723790][ T5324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.793809][ T5328] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 68.797910][ T5324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 68.817575][ T5323] ================================================================== [ 68.821140][ T5323] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 68.824817][ T5323] Read of size 4 at addr ffff888051f6652c by task syz.0.0/5323 [ 68.828345][ T5323] [ 68.829372][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 68.829386][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.829393][ T5323] Call Trace: [ 68.829400][ T5323] [ 68.829407][ T5323] dump_stack_lvl+0x189/0x250 [ 68.829427][ T5323] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.829443][ T5323] ? rcu_is_watching+0x15/0xb0 [ 68.829455][ T5323] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.829469][ T5323] ? rcu_is_watching+0x15/0xb0 [ 68.829481][ T5323] ? lock_release+0x4b/0x3e0 [ 68.829492][ T5323] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 68.829551][ T5323] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.829565][ T5323] ? __virt_addr_valid+0x4a5/0x5c0 [ 68.829580][ T5323] print_report+0xca/0x240 [ 68.829593][ T5323] ? ext4_find_extent+0xae6/0xcc0 [ 68.829603][ T5323] kasan_report+0x118/0x150 [ 68.829619][ T5323] ? ext4_find_extent+0xae6/0xcc0 [ 68.829630][ T5323] ext4_find_extent+0xae6/0xcc0 [ 68.829643][ T5323] ext4_ext_map_blocks+0x288/0x6ac0 [ 68.829659][ T5323] ? __lock_acquire+0xab9/0xd20 [ 68.829672][ T5323] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 68.829688][ T5323] ? ext4_es_lookup_extent+0x622/0xa70 [ 68.829703][ T5323] ext4_map_blocks+0x860/0x1740 [ 68.829720][ T5323] ? __pfx_ext4_map_blocks+0x10/0x10 [ 68.829731][ T5323] ? __pfx_hlock_conflict+0x10/0x10 [ 68.829745][ T5323] ? check_path+0x21/0x40 [ 68.829760][ T5323] _ext4_get_block+0x200/0x4c0 [ 68.829774][ T5323] ? __pfx__ext4_get_block+0x10/0x10 [ 68.829790][ T5323] ext4_get_block_unwritten+0x2e/0x100 [ 68.829804][ T5323] ext4_block_write_begin+0x993/0x1710 [ 68.829821][ T5323] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 68.829834][ T5323] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 68.829849][ T5323] ? folio_mapping+0x16f/0x1f0 [ 68.829859][ T5323] ? ext4_inode_journal_mode+0x18c/0x480 [ 68.829875][ T5323] ext4_write_begin+0xc04/0x19a0 [ 68.829893][ T5323] ? __pfx_ext4_write_begin+0x10/0x10 [ 68.829907][ T5323] ext4_da_write_begin+0x445/0xda0 [ 68.829921][ T5323] ? __pfx___might_resched+0x10/0x10 [ 68.829935][ T5323] ? __pfx_ext4_da_write_begin+0x10/0x10 [ 68.829949][ T5323] generic_perform_write+0x2c5/0x900 [ 68.829963][ T5323] ? __pfx_generic_perform_write+0x10/0x10 [ 68.829972][ T5323] ? file_modified_flags+0x4bb/0x560 [ 68.829985][ T5323] ? ext4_write_checks+0x24b/0x2c0 [ 68.829999][ T5323] ext4_buffered_write_iter+0xce/0x3a0 [ 68.830015][ T5323] ext4_file_write_iter+0x298/0x1bc0 [ 68.830034][ T5323] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 68.830051][ T5323] vfs_write+0x5c9/0xb30 [ 68.830065][ T5323] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 68.830079][ T5323] ? __pfx_vfs_write+0x10/0x10 [ 68.830094][ T5323] ? __fget_files+0x2a/0x420 [ 68.830110][ T5323] ksys_write+0x145/0x250 [ 68.830122][ T5323] ? __pfx_ksys_write+0x10/0x10 [ 68.830135][ T5323] ? do_syscall_64+0xbe/0xfa0 [ 68.830151][ T5323] do_syscall_64+0xfa/0xfa0 [ 68.830165][ T5323] ? lockdep_hardirqs_on+0x9c/0x150 [ 68.830179][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.830189][ T5323] ? clear_bhb_loop+0x60/0xb0 [ 68.830201][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.830212][ T5323] RIP: 0033:0x7f3a2bb8f6c9 [ 68.830223][ T5323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.830232][ T5323] RSP: 002b:00007f3a2ca1e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.830245][ T5323] RAX: ffffffffffffffda RBX: 00007f3a2bde5fa0 RCX: 00007f3a2bb8f6c9 [ 68.830252][ T5323] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000014 [ 68.830259][ T5323] RBP: 00007f3a2bc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 68.830266][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.830272][ T5323] R13: 00007f3a2bde6038 R14: 00007f3a2bde5fa0 R15: 00007ffd300cd198 [ 68.830285][ T5323] [ 68.830290][ T5323] [ 68.997141][ T5323] The buggy address belongs to the physical page: [ 68.999932][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51f66 [ 69.003728][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 69.006909][ T5323] raw: 04fff00000000000 ffffea000147d9c8 ffffea000147d948 0000000000000000 [ 69.010722][ T5323] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 69.014415][ T5323] page dumped because: kasan: bad access detected [ 69.017226][ T5323] page_owner info is not present (never set?) [ 69.019935][ T5323] [ 69.021010][ T5323] Memory state around the buggy address: [ 69.023487][ T5323] ffff888051f66400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 69.027079][ T5323] ffff888051f66480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 69.030614][ T5323] >ffff888051f66500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 69.034169][ T5323] ^ [ 69.036544][ T5323] ffff888051f66580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 69.040126][ T5323] ffff888051f66600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 69.043652][ T5323] ================================================================== [ 69.067400][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 69.070576][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 69.074463][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.079169][ T5323] Call Trace: [ 69.080645][ T5323] [ 69.081962][ T5323] dump_stack_lvl+0x99/0x250 [ 69.084015][ T5323] ? __asan_memcpy+0x40/0x70 [ 69.086084][ T5323] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.088311][ T5323] ? __pfx__printk+0x10/0x10 [ 69.090362][ T5323] vpanic+0x237/0x6d0 [ 69.092928][ T5323] ? __pfx_vpanic+0x10/0x10 [ 69.094974][ T5323] ? preempt_schedule+0xae/0xc0 [ 69.097108][ T5323] ? __pfx_preempt_schedule+0x10/0x10 [ 69.099495][ T5323] panic+0xb9/0xc0 [ 69.101099][ T5323] ? __pfx_panic+0x10/0x10 [ 69.103086][ T5323] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 69.105613][ T5323] ? is_module_address+0x17/0xf0 [ 69.107731][ T5323] ? ext4_find_extent+0xae6/0xcc0 [ 69.109904][ T5323] check_panic_on_warn+0x89/0xb0 [ 69.111969][ T5323] ? ext4_find_extent+0xae6/0xcc0 [ 69.114152][ T5323] end_report+0x78/0x160 [ 69.115957][ T5323] kasan_report+0x129/0x150 [ 69.117956][ T5323] ? ext4_find_extent+0xae6/0xcc0 [ 69.120262][ T5323] ext4_find_extent+0xae6/0xcc0 [ 69.122349][ T5323] ext4_ext_map_blocks+0x288/0x6ac0 [ 69.124656][ T5323] ? __lock_acquire+0xab9/0xd20 [ 69.126829][ T5323] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 69.129320][ T5323] ? ext4_es_lookup_extent+0x622/0xa70 [ 69.131769][ T5323] ext4_map_blocks+0x860/0x1740 [ 69.133929][ T5323] ? __pfx_ext4_map_blocks+0x10/0x10 [ 69.136382][ T5323] ? __pfx_hlock_conflict+0x10/0x10 [ 69.138740][ T5323] ? check_path+0x21/0x40 [ 69.140710][ T5323] _ext4_get_block+0x200/0x4c0 [ 69.142857][ T5323] ? __pfx__ext4_get_block+0x10/0x10 [ 69.145216][ T5323] ext4_get_block_unwritten+0x2e/0x100 [ 69.147635][ T5323] ext4_block_write_begin+0x993/0x1710 [ 69.150128][ T5323] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 69.152780][ T5323] ? __pfx_ext4_block_write_begin+0x10/0x10 [ 69.155384][ T5323] ? folio_mapping+0x16f/0x1f0 [ 69.157468][ T5323] ? ext4_inode_journal_mode+0x18c/0x480 [ 69.159781][ T5323] ext4_write_begin+0xc04/0x19a0 [ 69.161739][ T5323] ? __pfx_ext4_write_begin+0x10/0x10 [ 69.163951][ T5323] ext4_da_write_begin+0x445/0xda0 [ 69.166162][ T5323] ? __pfx___might_resched+0x10/0x10 [ 69.168452][ T5323] ? __pfx_ext4_da_write_begin+0x10/0x10 [ 69.170938][ T5323] generic_perform_write+0x2c5/0x900 [ 69.173158][ T5323] ? __pfx_generic_perform_write+0x10/0x10 [ 69.175698][ T5323] ? file_modified_flags+0x4bb/0x560 [ 69.177975][ T5323] ? ext4_write_checks+0x24b/0x2c0 [ 69.180195][ T5323] ext4_buffered_write_iter+0xce/0x3a0 [ 69.182547][ T5323] ext4_file_write_iter+0x298/0x1bc0 [ 69.184874][ T5323] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 69.187380][ T5323] vfs_write+0x5c9/0xb30 [ 69.189270][ T5323] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 69.191807][ T5323] ? __pfx_vfs_write+0x10/0x10 [ 69.193954][ T5323] ? __fget_files+0x2a/0x420 [ 69.195967][ T5323] ksys_write+0x145/0x250 [ 69.197893][ T5323] ? __pfx_ksys_write+0x10/0x10 [ 69.200103][ T5323] ? do_syscall_64+0xbe/0xfa0 [ 69.202141][ T5323] do_syscall_64+0xfa/0xfa0 [ 69.204117][ T5323] ? lockdep_hardirqs_on+0x9c/0x150 [ 69.206319][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.208899][ T5323] ? clear_bhb_loop+0x60/0xb0 [ 69.210857][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.213298][ T5323] RIP: 0033:0x7f3a2bb8f6c9 [ 69.215212][ T5323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.223476][ T5323] RSP: 002b:00007f3a2ca1e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 69.227126][ T5323] RAX: ffffffffffffffda RBX: 00007f3a2bde5fa0 RCX: 00007f3a2bb8f6c9 [ 69.230607][ T5323] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000014 [ 69.234038][ T5323] RBP: 00007f3a2bc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 69.237211][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.240601][ T5323] R13: 00007f3a2bde6038 R14: 00007f3a2bde5fa0 R15: 00007ffd300cd198 [ 69.243807][ T5323] [ 69.245637][ T5323] Kernel Offset: disabled [ 69.247538][ T5323] Rebooting in 86400 seconds..