program: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@noload}, {@nolazytime}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x46d, &(0x7f0000000140)="$eJzs3c9vFFUcAPDvTH/w21bFHyBoFY3EH4WWnwcvGE08aGKiB4yn2haCLFRpTYQQrR7waEi8G48m/gWe9GLUk4lXvRsSYriAGs2YmZ0py7JbWLp00f18klnem3nLvO/MvN037+1uA+hbY/lDErExIn6JiJF69toCY/V/rlw6O/3HpbPTSWTZa78nRbnLl85OV0Wr522oZ7KszK9psd9zb0ZM1Wqzp8r8roUT7+yaP33m2WMnpo7OHp09OXnw4N4924f3T+7rSpx5XJe3fjC3bctLb5x/Zfrw+bd++Cqv78Zye2McXbJurH50W3qiyzvrtU0N6WSwhxWhIwMRkZ+uoaL9j8RArFvaNhIvftzTygG3VZZlWav359JiBvyPJdHrGgC9Ub3R5/e/1bJKXY87wsVDEe8eqMd/pVzqWwYjLcsMNd3fdtNYRBxe/PPzfInbMw4BAHCNbw5FxDOt+n9p3N9Q7q5yDmU0Iu6OiHsi4t6I2BwR90UUZR+IiAc73H/zDMn1/Z/0wi0FdpPy/t9z5dzWUv/v76yIvzQ6UOY2FfEPJUeO1WZ3l8dkZwytyfMTy+zj2xd+/rTdtsb+X77k+6/6gnXphcGmAbqZqYWpFYa95OJHEVsHm+IvJFFN4yQRsSUitnb0P2dZWjxGHHvqy23tSt04/mV0YZ4p+yLiyfr5X4ym+CtJ2/nJiQP7J/ftWhu12d1/ZVlWXBXX+/Gnc6+22/+K4u+C/Pyvb77+C0vxjyZrI+ZPnzlezNfOR/MM8Q2d+/WTtvc0t3r9DyevF+nhct37UwsLpyYihpOXG9b/03SXW5abvHrl5PHv3NEq/rR4jauifSgi8ot4e0Q8HBGPlHV/NCIei4gdy8T//fOPv915/MuMyndRHv/Mjc5/NJ7/zhMDx7/7uvP4K/n531ukdpZrbub172YruJJjBwAAAP8VafEZ+CQdX0qn6fh4/TP8m2N9WpubX3j6yNx7J2fqn5UfjaG0Gv8caRgPnSjHhqv85NWhmSK/pxw3/mxgXZEfn56rzfQ4duh3G9q0/9xvA72uHXDb+b4W9C/tH/qX9g/9S/uH/qX9Q/9q1f4/7EE9gNXn/R/6l/YP/Uv7h/6l/UNfavvd+HRFX/mXWIVE+QsNix08q/pRiS7sPdLOnzUYPT1iSQc/DHHnJAa7XufyT3REuWZNy8K9e00CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADopn8DAAD//7kl5Go=") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@noload}, {@nolazytime}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x46d, &(0x7f0000000140)="$eJzs3c9vFFUcAPDvTH/w21bFHyBoFY3EH4WWnwcvGE08aGKiB4yn2haCLFRpTYQQrR7waEi8G48m/gWe9GLUk4lXvRsSYriAGs2YmZ0py7JbWLp00f18klnem3nLvO/MvN037+1uA+hbY/lDErExIn6JiJF69toCY/V/rlw6O/3HpbPTSWTZa78nRbnLl85OV0Wr522oZ7KszK9psd9zb0ZM1Wqzp8r8roUT7+yaP33m2WMnpo7OHp09OXnw4N4924f3T+7rSpx5XJe3fjC3bctLb5x/Zfrw+bd++Cqv78Zye2McXbJurH50W3qiyzvrtU0N6WSwhxWhIwMRkZ+uoaL9j8RArFvaNhIvftzTygG3VZZlWav359JiBvyPJdHrGgC9Ub3R5/e/1bJKXY87wsVDEe8eqMd/pVzqWwYjLcsMNd3fdtNYRBxe/PPzfInbMw4BAHCNbw5FxDOt+n9p3N9Q7q5yDmU0Iu6OiHsi4t6I2BwR90UUZR+IiAc73H/zDMn1/Z/0wi0FdpPy/t9z5dzWUv/v76yIvzQ6UOY2FfEPJUeO1WZ3l8dkZwytyfMTy+zj2xd+/rTdtsb+X77k+6/6gnXphcGmAbqZqYWpFYa95OJHEVsHm+IvJFFN4yQRsSUitnb0P2dZWjxGHHvqy23tSt04/mV0YZ4p+yLiyfr5X4ym+CtJ2/nJiQP7J/ftWhu12d1/ZVlWXBXX+/Gnc6+22/+K4u+C/Pyvb77+C0vxjyZrI+ZPnzlezNfOR/MM8Q2d+/WTtvc0t3r9DyevF+nhct37UwsLpyYihpOXG9b/03SXW5abvHrl5PHv3NEq/rR4jauifSgi8ot4e0Q8HBGPlHV/NCIei4gdy8T//fOPv915/MuMyndRHv/Mjc5/NJ7/zhMDx7/7uvP4K/n531ukdpZrbub172YruJJjBwAAAP8VafEZ+CQdX0qn6fh4/TP8m2N9WpubX3j6yNx7J2fqn5UfjaG0Gv8caRgPnSjHhqv85NWhmSK/pxw3/mxgXZEfn56rzfQ4duh3G9q0/9xvA72uHXDb+b4W9C/tH/qX9g/9S/uH/qX9Q/9q1f4/7EE9gNXn/R/6l/YP/Uv7h/6l/UNfavvd+HRFX/mXWIVE+QsNix08q/pRiS7sPdLOnzUYPT1iSQc/DHHnJAa7XufyT3REuWZNy8K9e00CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADopn8DAAD//7kl5Go=") r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0/file0\x00', 0x10b442, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x3, 0x1c, &(0x7f00000015c0)=ANY=[@ANYBLOB="18080000b0feffff000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035080100000040fd9500000000000000b7020000000000007b9af8ff000000007509fdff030000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000006e9800000000000056080000000000008500000005110000b70000000000000095"], &(0x7f00000016c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x3, 0x1c, &(0x7f00000015c0)=ANY=[@ANYBLOB="18080000b0feffff000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035080100000040fd9500000000000000b7020000000000007b9af8ff000000007509fdff030000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000006e9800000000000056080000000000008500000005110000b70000000000000095"], &(0x7f00000016c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$FUSE_DIRENT(r0, 0x0, 0xff8b) mkdir(&(0x7f0000000600)='./file1\x00', 0x0) read$midi(r0, &(0x7f0000001700)=""/190, 0xbe) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000740)='./file0\x00', 0x2000010, &(0x7f0000000780)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x85, 0x7a5, &(0x7f00000009c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") openat(0xffffffffffffff9c, &(0x7f0000001180)='./file1\x00', 0x101042, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000001180)='./file1\x00', 0x101042, 0x0) creat(&(0x7f00000011c0)='./bus\x00', 0x0) (async) creat(&(0x7f00000011c0)='./bus\x00', 0x0) mount(&(0x7f0000001200)=@loop={'/dev/loop', 0x0}, &(0x7f0000001240)='./bus\x00', 0x0, 0x5000, 0x0) r2 = open(&(0x7f0000001280)='./bus\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000017c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000001800)='./debug\x00', &(0x7f0000001840)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001880)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x2) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000001880)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x2) write$cgroup_freezer_state(r3, &(0x7f00000018c0)='FROZEN\x00', 0x7) read$FUSE(r3, 0x0, 0x0) (async) read$FUSE(r3, 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r4 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f00000007c0), 0x181041, 0x0) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000007c0), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000800)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000800)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000840)={0x28, 0x5, r6, 0x0, &(0x7f0000001440)="7f", 0x1, 0xfffffffffffff0e9}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000001480)={0x28, 0x6, r6, 0x0, &(0x7f00000014c0)="d5", 0x1, 0x2}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000001500)={0x28, 0x2, r6, 0x0, &(0x7f0000001540)="94", 0x1, 0x1000000008}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(r7, 0x29, 0x36, 0x0, &(0x7f0000001400)) mkdir(&(0x7f0000000640)='./bus\x00', 0x0) (async) mkdir(&(0x7f0000000640)='./bus\x00', 0x0) unlink(&(0x7f0000000680)='./file1\x00') openat$pfkey(0xffffffffffffff9c, &(0x7f00000006c0), 0x200300, 0x0) [ 102.484841][ T4661] Bluetooth: hci0: command tx timeout [ 102.546794][ T5345] loop0: detected capacity change from 0 to 512 [ 102.589699][ T5345] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 102.611410][ T5345] EXT4-fs (loop0): 1 truncate cleaned up [ 102.612783][ T5345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.762935][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 4294901760 (level 0) [ 102.773215][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 2185560079 (level 0) [ 102.790123][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 65535 (level 2) [ 102.812463][ T5344] EXT4-fs error (device loop0): ext4_find_dest_de:2052: inode #2: block 13: comm syz.0.0: bad entry in directory: directory entry overrun - offset=92, inode=0, rec_len=1024, size=1024 fake=0 [ 102.824984][ T5345] EXT4-fs error (device loop0): ext4_find_dest_de:2052: inode #2: block 13: comm syz.0.0: bad entry in directory: directory entry overrun - offset=92, inode=0, rec_len=1024, size=1024 fake=0 [ 102.828497][ T5344] EXT4-fs error (device loop0): ext4_find_dest_de:2052: inode #2: block 13: comm syz.0.0: bad entry in directory: directory entry overrun - offset=92, inode=0, rec_len=1024, size=1024 fake=0 [ 102.831050][ T5344] EXT4-fs error (device loop0): ext4_validate_block_bitmap:436: comm syz.0.0: bg 0: block 18: invalid block bitmap [ 102.831813][ T5344] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6678: Corrupt filesystem [ 102.832217][ T5344] EXT4-fs error (device loop0): ext4_read_inode_bitmap:141: comm syz.0.0: Invalid inode bitmap blk 65548 in block_group 0 [ 102.876966][ T5344] EXT4-fs error (device loop0) in ext4_free_inode:363: Corrupt filesystem [ 102.891234][ T5343] ================================================================== [ 102.891247][ T5343] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891427][ T5343] Read of size 18446744073709551600 at addr ffff88804ef806b8 by task syz.0.0/5343 [ 102.891437][ T5343] [ 102.891470][ T5343] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.891482][ T5343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.891489][ T5343] Call Trace: [ 102.891495][ T5343] [ 102.891500][ T5343] dump_stack_lvl+0xe8/0x150 [ 102.891519][ T5343] print_address_description+0x55/0x1e0 [ 102.891535][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891546][ T5343] print_report+0x58/0x70 [ 102.891559][ T5343] kasan_report+0x117/0x150 [ 102.891574][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891587][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891599][ T5343] kasan_check_range+0x264/0x2c0 [ 102.891612][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891624][ T5343] __asan_memmove+0x29/0x70 [ 102.891635][ T5343] ext4_xattr_set_entry+0x92b/0x1ed0 [ 102.891651][ T5343] ext4_xattr_ibody_set+0x262/0x710 [ 102.891665][ T5343] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 102.891688][ T5343] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 102.891703][ T5343] ? __asan_memcpy+0x40/0x70 [ 102.891713][ T5343] ? ext4_read_inline_data+0x100/0x2b0 [ 102.891723][ T5343] ext4_convert_inline_data_nolock+0x208/0x980 [ 102.891735][ T5343] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10 [ 102.891745][ T5343] ? down_write+0x166/0x200 [ 102.891810][ T5343] ext4_convert_inline_data+0x484/0x5c0 [ 102.891823][ T5343] ? __pfx_ext4_convert_inline_data+0x10/0x10 [ 102.891834][ T5343] ? down_read+0x2b9/0x320 [ 102.891849][ T5343] ext4_page_mkwrite+0x242/0x1470 [ 102.891866][ T5343] ? __lock_acquire+0x747/0x2de0 [ 102.891880][ T5343] ? __pfx_ext4_page_mkwrite+0x10/0x10 [ 102.891894][ T5343] ? __lock_acquire+0x747/0x2de0 [ 102.891908][ T5343] do_page_mkwrite+0x147/0x310 [ 102.891920][ T5343] do_wp_page+0x1a85/0x4b60 [ 102.891939][ T5343] ? __pfx_do_wp_page+0x10/0x10 [ 102.891951][ T5343] ? do_raw_spin_lock+0x12b/0x2f0 [ 102.891961][ T5343] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 102.891974][ T5343] handle_mm_fault+0x15d7/0x3750 [ 102.891990][ T5343] ? handle_mm_fault+0xf1/0x3750 [ 102.892006][ T5343] ? __pfx_handle_mm_fault+0x10/0x10 [ 102.892019][ T5343] ? lock_vma_under_rcu+0x45a/0x500 [ 102.892033][ T5343] ? __pfx_do_futex+0x10/0x10 [ 102.892050][ T5343] do_user_addr_fault+0xb35/0x1480 [ 102.892065][ T5343] ? trace_page_fault_user+0x84/0x1e0 [ 102.892077][ T5343] exc_page_fault+0x6a/0xc0 [ 102.892090][ T5343] asm_exc_page_fault+0x26/0x30 [ 102.892101][ T5343] RIP: 0033:0x7f40a2f6fb88 [ 102.892111][ T5343] Code: 66 89 74 17 02 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 c5 fa 7f 07 c5 fa 7f 4c 17 f0 c3 0f 1f 44 00 00 48 8b 4c 16 f8 48 8b 36 <48> 89 37 48 89 4c 17 f8 c3 62 e1 fe 28 6f 54 16 ff 62 e1 fe 28 6f [ 102.892120][ T5343] RSP: 002b:00007ffd0f2caf78 EFLAGS: 00010206 [ 102.892143][ T5343] RAX: 00002000000007c0 RBX: 0000000000000004 RCX: 00756d6d6f692f76 [ 102.892150][ T5343] RDX: 000000000000000b RSI: 6d6f692f7665642f RDI: 00002000000007c0 [ 102.892158][ T5343] RBP: fffffffffffffffe R08: 00007f40a2dff02c R09: 0000000000000001 [ 102.892165][ T5343] R10: 7ffffffffffffff4 R11: 0000000000000009 R12: 00007ffd0f2cb0a0 [ 102.892172][ T5343] R13: 00007f40a322609c R14: 0000000000018fdd R15: 00007f40a3226090 [ 102.892183][ T5343] [ 102.892187][ T5343] [ 102.892190][ T5343] The buggy address belongs to the physical page: [ 102.892195][ T5343] page: refcount:2 mapcount:0 mapping:ffff88801e425940 index:0xc pfn:0x4ef80 [ 102.892206][ T5343] memcg:ffff8880443b7080 [ 102.892212][ T5343] aops:def_blk_aops ino:700000 dentry name(?):"" [ 102.892262][ T5343] flags: 0x4fff58000000234(referenced|dirty|lru|workingset|node=1|zone=1|lastcpupid=0x7ff) [ 102.892278][ T5343] raw: 04fff58000000234 ffffea00013be048 ffffea00013bdfc8 ffff88801e425940 [ 102.892287][ T5343] raw: 000000000000000c ffff8880144029a0 00000002ffffffff ffff8880443b7080 [ 102.892292][ T5343] page dumped because: kasan: bad access detected [ 102.892298][ T5343] page_owner tracks the page as allocated [ 102.892302][ T5343] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5344, tgid 5343 (syz.0.0), ts 102826556306 [ 102.892324][ T5343] post_alloc_hook+0x1f9/0x250 [ 102.892333][ T5343] get_page_from_freelist+0x220f/0x2280 [ 102.892345][ T5343] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 102.892356][ T5343] alloc_pages_mpol+0x21e/0x390 [ 102.892368][ T5343] alloc_pages_noprof+0xb1/0x2b0 [ 102.892381][ T5343] folio_alloc_noprof+0x1e/0x30 [ 102.892392][ T5343] filemap_alloc_folio_noprof+0x111/0x460 [ 102.892403][ T5343] __filemap_get_folio_mpol+0x3fd/0xff0 [ 102.892414][ T5343] bdev_getblk+0x1ec/0x670 [ 102.892430][ T5343] __ext4_get_inode_loc+0x56c/0xf40 [ 102.892442][ T5343] ext4_reserve_inode_write+0x18b/0x360 [ 102.892456][ T5343] __ext4_mark_inode_dirty+0x141/0x7e0 [ 102.892465][ T5343] ext4_mkdir+0x4ea/0xce0 [ 102.892477][ T5343] vfs_mkdir+0x40e/0x630 [ 102.892499][ T5343] filename_mkdirat+0x285/0x510 [ 102.892510][ T5343] __se_sys_mkdirat+0x35/0x150 [ 102.892522][ T5343] page last free pid 5344 tgid 5343 ts 102809645404 stack trace: [ 102.892530][ T5343] free_unref_folios+0xdc6/0x14e0 [ 102.892539][ T5343] folios_put_refs+0x9e9/0xb30 [ 102.892552][ T5343] shmem_undo_range+0x547/0x15d0 [ 102.892561][ T5343] shmem_evict_inode+0x240/0xb00 [ 102.892574][ T5343] evict+0x624/0xb50 [ 102.892586][ T5343] dentry_kill+0x1b9/0x910 [ 102.892598][ T5343] finish_dput+0x1a/0x260 [ 102.892607][ T5343] __fput+0x65b/0xa40 [ 102.892615][ T5343] fput_close_sync+0x11f/0x240 [ 102.892623][ T5343] __se_sys_close+0xa2/0x160 [ 102.892631][ T5343] do_syscall_64+0x166/0x520 [ 102.892653][ T5343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.892663][ T5343] [ 102.892665][ T5343] Memory state around the buggy address: [ 102.892670][ T5343] ffff88804ef80580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.892677][ T5343] ffff88804ef80600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.892683][ T5343] >ffff88804ef80680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.892688][ T5343] ^ [ 102.892694][ T5343] ffff88804ef80700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.892700][ T5343] ffff88804ef80780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.892704][ T5343] ================================================================== [ 103.080990][ T5343] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.182911][ T5343] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.186736][ T5343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.190984][ T5343] Call Trace: [ 103.192452][ T5343] [ 103.193715][ T5343] vpanic+0x26f/0x710 [ 103.195445][ T5343] panic+0xc5/0xd0 [ 103.197025][ T5343] ? __pfx_panic+0x10/0x10 [ 103.198973][ T5343] ? preempt_schedule_thunk+0x16/0x40 [ 103.201286][ T5343] ? preempt_schedule_thunk+0x16/0x40 [ 103.203571][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.205645][ T5343] check_panic_on_warn+0x89/0xb0 [ 103.207630][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.209743][ T5343] end_report+0x73/0x170 [ 103.211403][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.213468][ T5343] kasan_report+0x128/0x150 [ 103.215144][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.217263][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.219249][ T5343] kasan_check_range+0x264/0x2c0 [ 103.221125][ T5343] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.223451][ T5343] __asan_memmove+0x29/0x70 [ 103.225280][ T5343] ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.227507][ T5343] ext4_xattr_ibody_set+0x262/0x710 [ 103.229686][ T5343] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 103.232250][ T5343] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 103.235017][ T5343] ? __asan_memcpy+0x40/0x70 [ 103.236988][ T5343] ? ext4_read_inline_data+0x100/0x2b0 [ 103.239269][ T5343] ext4_convert_inline_data_nolock+0x208/0x980 [ 103.242305][ T5343] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10 [ 103.245395][ T5343] ? down_write+0x166/0x200 [ 103.247301][ T5343] ext4_convert_inline_data+0x484/0x5c0 [ 103.249679][ T5343] ? __pfx_ext4_convert_inline_data+0x10/0x10 [ 103.252350][ T5343] ? down_read+0x2b9/0x320 [ 103.254263][ T5343] ext4_page_mkwrite+0x242/0x1470 [ 103.256370][ T5343] ? __lock_acquire+0x747/0x2de0 [ 103.258426][ T5343] ? __pfx_ext4_page_mkwrite+0x10/0x10 [ 103.260768][ T5343] ? __lock_acquire+0x747/0x2de0 [ 103.262919][ T5343] do_page_mkwrite+0x147/0x310 [ 103.265021][ T5343] do_wp_page+0x1a85/0x4b60 [ 103.267003][ T5343] ? __pfx_do_wp_page+0x10/0x10 [ 103.269112][ T5343] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.271304][ T5343] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.273259][ T5343] handle_mm_fault+0x15d7/0x3750 [ 103.275066][ T5343] ? handle_mm_fault+0xf1/0x3750 [ 103.277118][ T5343] ? __pfx_handle_mm_fault+0x10/0x10 [ 103.279390][ T5343] ? lock_vma_under_rcu+0x45a/0x500 [ 103.281576][ T5343] ? __pfx_do_futex+0x10/0x10 [ 103.283484][ T5343] do_user_addr_fault+0xb35/0x1480 [ 103.285481][ T5343] ? trace_page_fault_user+0x84/0x1e0 [ 103.287728][ T5343] exc_page_fault+0x6a/0xc0 [ 103.289698][ T5343] asm_exc_page_fault+0x26/0x30 [ 103.291844][ T5343] RIP: 0033:0x7f40a2f6fb88 [ 103.293768][ T5343] Code: 66 89 74 17 02 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 c5 fa 7f 07 c5 fa 7f 4c 17 f0 c3 0f 1f 44 00 00 48 8b 4c 16 f8 48 8b 36 <48> 89 37 48 89 4c 17 f8 c3 62 e1 fe 28 6f 54 16 ff 62 e1 fe 28 6f [ 103.301850][ T5343] RSP: 002b:00007ffd0f2caf78 EFLAGS: 00010206 [ 103.304534][ T5343] RAX: 00002000000007c0 RBX: 0000000000000004 RCX: 00756d6d6f692f76 [ 103.307967][ T5343] RDX: 000000000000000b RSI: 6d6f692f7665642f RDI: 00002000000007c0 [ 103.311527][ T5343] RBP: fffffffffffffffe R08: 00007f40a2dff02c R09: 0000000000000001 [ 103.315121][ T5343] R10: 7ffffffffffffff4 R11: 0000000000000009 R12: 00007ffd0f2cb0a0 [ 103.318467][ T5343] R13: 00007f40a322609c R14: 0000000000018fdd R15: 00007f40a3226090 [ 103.321561][ T5343] [ 103.325476][ T5343] Kernel Offset: disabled [ 103.327386][ T5343] Rebooting in 86400 seconds..