program: syz_mount_image$fuse(0x0, &(0x7f0000002180)='./file0\x00', 0x805883, 0x0, 0x1, 0x0, 0x0) mount$9p_virtio(&(0x7f0000003500), &(0x7f0000003540)='./file0\x00', &(0x7f0000003580), 0x480, &(0x7f00000035c0)={'trans=virtio,', {[{@cache_none}]}}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200404, &(0x7f0000000280)={[{@noblock_validity}, {@nodelalloc}, {@sysvgroups}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@orlov}, {@debug}, {@noauto_da_alloc}, {@nomblk_io_submit}]}, 0x3, 0x56a, &(0x7f0000000700)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwFy9SBBEL4h/g3WPxH/CvKGihSAl68BKZzWy7TbL5uXW3zucD0743M5s3b998335nZ5cNoLBGsn9KEa9GxDdJxOG2bYORbxxZ2W/p8Y3JbEliefmzP5NI8nWt/ZP8/4N55ZWI+PWriJOlte3WFxZnKtVqOpfXRxuzV0frC4unLs9WptPp9Mr4xMSZdybG33/v3a719c0Lf3//6f2Pznx9fOm7nx8euZvEuTiUb2vvxy7caq+MxEj+nAzFuVU7jnWhsX6S9PoA2JGBPM6HIpsDDsdAHvXA/9/NiFgGCioR/1BQrTygdW3fpevgF8ajD1cugNb2f3DlvZHY17w2OrCUPHNllF3vDneh/ayNX/64dzdbYpP3IW52oT2Allu3I+L04ODa+S/J57+dO91883hjq9so2usP9NL9LP95a738p/Qk/4l18p+D68TuTmwe/6WHXWimoyz/+2Dd/PfJ1DU8kNdeauZ8Q8mly9X0dES8HBEnYmhvVt/ofs6ZpQfLnba153/ZkrXfygXz43g4uPfZx0xVGpXd9Lndo9sRrz3Nf5NYM//va+a6q8c/ez4ubLGNY+m91ztt27z/7bqfAS//FPHGuuP/9I5WsvH9ydHm+TDaOivW+uvOsd86tb+9/ndfNv4HNu7/cNJ+v7a+/TZ+3PdP2mnbTs//PcnnzfKefN31SqMxNxaxJ/lk7frxp49t1Vv7Z/0/cXzj+W+9839/RHyxxf7fOXqn4679MP5T2xr/7RcefPzlD53a39r4v90sncjXbGX+2+oB7ua5AwAAAAAAgH5TiohDkZTKT8qlUrm88vmOo3GgVK3VGycv1eavTEXzu7LDMVRq3ek+3PZ5iLH887Ct+viq+kREHImIbwf2N+vlyVp1qtedBwAAAAAAAAAAAAAAAAAAgD5xsMP3/zO/D/T66IDnzk9+Q3FtGv/d+KUnoC95/YfiEv9QXOIfikv8Q3GJfygu8Q/FJf6huMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAdNWF8+ezZXnp8Y3JrD51bWF+pnbt1FRanynPzk+WJ2tzV8vTtdp0NS1P1mY3+3vVWu3q2HjMXx9tpPXGaH1h8eJsbf5K4+Ll2cp0ejEd+k96BQAAAAAAAAAAAAAAAAAAAC+W+sLiTKVaTecUOhbORl8cxo4LyWajfDY/GXbUxGDvO6jwHAo9npgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM2/AQAA///fKTPH") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x14a) syz_mount_image$erofs(&(0x7f0000000200), &(0x7f0000000080)='./bus\x00', 0x0, &(0x7f0000000180)=ANY=[], 0x1, 0x20a, &(0x7f0000000480)="$eJzsmDFrFEEUx/8zu7fnbWEidiIoGPBsNtkNgiAWqVKIICiKjXiYNagbI3tbqCA5Sys/gx9B7CWCrZ1gq4JgI9jYZuTNzO4Ne3t7pyY2vl+x+b+ZN2/em9l9gQPDMP8tXz7//PT0+dcjEhj1sISuHf/mVRLS8c9fXewff78ev7n57vzH1+sf6vFOAlBq/v0p9u6ah8K3A8pZLYAlQAgAVyFJV6vOWHUdApHVtyBxzeoUAjesvufobfKPojt3szS6vZ1tkOiQf0wqoceqmx+l9f2ZwMY4PRU688PHT+4PsizNK4FSBBNTU0TQGGcs2s5P57cmcQFQnh4JlXtf0cj8XcFOdX4xJGKrVyFwxepz6NqzkbX6gWO+PXil7D5T6v8xq9q6COdxpivKh/S2NPnsYPhi+vKjTVNqgQJOOB9yR/aUARPLy09jzkr9GRe8X0LopIK2xNAax/u9uupCLWRZSkkcQIEYGdF9i2pKzjzVS/uZRlir63DZa/4wIK096Fei2mvR5Pov9jJi3D/US4HTTv/0nf6xXGw9NI1la7CZbqYPwj0zcTZZpma8Yp4t/a+n+7PuyT2zQafJsQMEIsCjQVHksXmSvUsq0XbS1HED3f8k+qeMLeyYi/7sFgX960Pfs3aDH8MwDMMwDMMwDMMwDMMwzN9xAgKqifJnSWMll7XxKwAA///S5UhX") creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000002c0)={0x0, {}, 0x0, {}, 0xf, 0x1, 0xe, 0x0, "22536af39b7c7cb7435b0a43852dbc3a9a0700cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "44322c2e9e30b82426f46bc0d6ecd57971becef2c5cf7e00", [0x1, 0x1000080000800]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x98}}, {{&(0x7f0000005840)=@file={0x1, './file2\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4004000}}], 0x2, 0x0) fallocate(r0, 0x20, 0x7, 0x8000) [ 93.127064][ T4651] Bluetooth: hci0: command tx timeout [ 93.130790][ T111] cfg80211: failed to load regulatory.db [ 93.345431][ T5329] loop0: detected capacity change from 0 to 1024 [ 93.370362][ T5329] EXT4-fs: Ignoring removed orlov option [ 93.385288][ T5329] EXT4-fs: Ignoring removed nomblk_io_submit option [ 93.447165][ T5329] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=8043c118, mo2=0002] [ 93.490816][ T5329] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.534417][ T5328] loop0: detected capacity change from 1024 to 1023 [ 93.560831][ T5328] ================================================================== [ 93.565333][ T5328] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.569319][ T5328] Read of size 18446744073709551600 at addr ffff88804353d2c8 by task syz.0.0/5328 [ 93.574461][ T5328] [ 93.575830][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.575852][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.575861][ T5328] Call Trace: [ 93.575871][ T5328] [ 93.575879][ T5328] dump_stack_lvl+0xe8/0x150 [ 93.575907][ T5328] print_address_description+0x55/0x1e0 [ 93.575926][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.575942][ T5328] print_report+0x58/0x70 [ 93.575960][ T5328] kasan_report+0x117/0x150 [ 93.575979][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.575991][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.576003][ T5328] kasan_check_range+0x264/0x2c0 [ 93.576018][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.576032][ T5328] __asan_memmove+0x29/0x70 [ 93.576045][ T5328] ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.576064][ T5328] ext4_xattr_ibody_set+0x262/0x710 [ 93.576079][ T5328] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 93.576099][ T5328] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 93.576119][ T5328] ? __asan_memcpy+0x40/0x70 [ 93.576132][ T5328] ? ext4_read_inline_data+0x100/0x2b0 [ 93.576147][ T5328] ext4_convert_inline_data_nolock+0x208/0x980 [ 93.576167][ T5328] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10 [ 93.576181][ T5328] ? down_write+0x16d/0x200 [ 93.576262][ T5328] ext4_convert_inline_data+0x484/0x5c0 [ 93.576282][ T5328] ? __pfx_ext4_convert_inline_data+0x10/0x10 [ 93.576301][ T5328] ? down_write+0x16d/0x200 [ 93.576316][ T5328] ? __pfx_down_write+0x10/0x10 [ 93.576333][ T5328] ext4_fallocate+0x1e2/0x400 [ 93.576350][ T5328] vfs_fallocate+0x65a/0x7e0 [ 93.576366][ T5328] ? __fget_files+0x2a/0x420 [ 93.576382][ T5328] ? __pfx_vfs_fallocate+0x10/0x10 [ 93.576401][ T5328] __x64_sys_fallocate+0xbf/0x110 [ 93.576413][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.576426][ T5328] do_syscall_64+0x174/0x580 [ 93.576463][ T5328] ? trace_irq_disable+0x3b/0x140 [ 93.576480][ T5328] ? clear_bhb_loop+0x40/0x90 [ 93.576496][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.576509][ T5328] RIP: 0033:0x7f10c1f9e019 [ 93.576524][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.576535][ T5328] RSP: 002b:00007f10c2d8efe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 93.576549][ T5328] RAX: ffffffffffffffda RBX: 00007f10c2225fa0 RCX: 00007f10c1f9e019 [ 93.576558][ T5328] RDX: 0000000000000007 RSI: 0000000000000020 RDI: 0000000000000004 [ 93.576565][ T5328] RBP: 00007f10c203500c R08: 0000000000000000 R09: 0000000000000000 [ 93.576573][ T5328] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 93.576581][ T5328] R13: 00007f10c2226038 R14: 00007f10c2225fa0 R15: 00007fff8c5c9688 [ 93.576594][ T5328] [ 93.576599][ T5328] [ 93.728145][ T5328] The buggy address belongs to the physical page: [ 93.731390][ T5328] page: refcount:2 mapcount:0 mapping:ffff88801d02d940 index:0x2 pfn:0x4353d [ 93.736106][ T5328] memcg:ffff88804426e500 [ 93.738627][ T5328] aops:def_blk_aops ino:700000 dentry name(?):"" [ 93.742729][ T5328] flags: 0x4fff58000004224(referenced|lru|workingset|private|node=1|zone=1|lastcpupid=0x7ff) [ 93.748146][ T5328] raw: 04fff58000004224 ffff888030450a80 ffffea00010f6388 ffff88801d02d940 [ 93.752238][ T5328] raw: 0000000000000002 ffff8880445d9000 00000002ffffffff ffff88804426e500 [ 93.757068][ T5328] page dumped because: kasan: bad access detected [ 93.760372][ T5328] page_owner tracks the page as allocated [ 93.762995][ T5328] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5328, tgid 5326 (syz.0.0), ts 93553429982, free_ts 93430471892 [ 93.771149][ T5328] post_alloc_hook+0x1f9/0x250 [ 93.773268][ T5328] get_page_from_freelist+0x21fa/0x2270 [ 93.775671][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.778281][ T5328] alloc_pages_mpol+0x212/0x380 [ 93.780393][ T5328] alloc_pages_noprof+0xac/0x2a0 [ 93.782380][ T5328] folio_alloc_noprof+0x1e/0x30 [ 93.784326][ T5328] filemap_alloc_folio_noprof+0x111/0x470 [ 93.786702][ T5328] __filemap_get_folio_mpol+0x402/0x1000 [ 93.789343][ T5328] bdev_getblk+0x1f4/0x6e0 [ 93.791585][ T5328] __ext4_get_inode_loc+0x56c/0xf40 [ 93.794049][ T5328] ext4_get_inode_loc+0x81/0xf0 [ 93.796363][ T5328] ext4_convert_inline_data+0x261/0x5c0 [ 93.799142][ T5328] ext4_fallocate+0x1e2/0x400 [ 93.801575][ T5328] vfs_fallocate+0x65a/0x7e0 [ 93.804137][ T5328] __x64_sys_fallocate+0xbf/0x110 [ 93.806792][ T5328] do_syscall_64+0x174/0x580 [ 93.808851][ T5328] page last free pid 5281 tgid 5281 stack trace: [ 93.811604][ T5328] free_unref_folios+0xd84/0x14a0 [ 93.813857][ T5328] folios_put_refs+0x9e9/0xb30 [ 93.816045][ T5328] shmem_undo_range+0x4e6/0x15d0 [ 93.818424][ T5328] shmem_evict_inode+0x280/0xa80 [ 93.820926][ T5328] evict+0x624/0xb50 [ 93.822888][ T5328] dentry_kill+0x1b9/0x880 [ 93.824766][ T5328] finish_dput+0x1a/0x260 [ 93.826582][ T5328] filename_renameat2+0x61b/0x9a0 [ 93.828738][ T5328] __se_sys_rename+0x55/0x2c0 [ 93.830968][ T5328] do_syscall_64+0x174/0x580 [ 93.833235][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.836068][ T5328] [ 93.837272][ T5328] Memory state around the buggy address: [ 93.839754][ T5328] ffff88804353d180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.843198][ T5328] ffff88804353d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.846705][ T5328] >ffff88804353d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.850194][ T5328] ^ [ 93.853016][ T5328] ffff88804353d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.856531][ T5328] ffff88804353d380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.859780][ T5328] ================================================================== [ 93.911294][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.914969][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.918804][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.922881][ T5328] Call Trace: [ 93.924257][ T5328] [ 93.925468][ T5328] vpanic+0x56c/0xa60 [ 93.927099][ T5328] ? __pfx_vpanic+0x10/0x10 [ 93.928865][ T5328] panic+0xc5/0xd0 [ 93.930467][ T5328] ? __pfx_panic+0x10/0x10 [ 93.932399][ T5328] ? preempt_schedule_thunk+0x16/0x40 [ 93.934611][ T5328] ? preempt_schedule_thunk+0x16/0x40 [ 93.936905][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.939064][ T5328] check_panic_on_warn+0x89/0xb0 [ 93.941074][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.943296][ T5328] end_report+0x73/0x170 [ 93.945089][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.947316][ T5328] kasan_report+0x128/0x150 [ 93.949298][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.951660][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.954087][ T5328] kasan_check_range+0x264/0x2c0 [ 93.956357][ T5328] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.958866][ T5328] __asan_memmove+0x29/0x70 [ 93.961199][ T5328] ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.963853][ T5328] ext4_xattr_ibody_set+0x262/0x710 [ 93.966227][ T5328] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 93.968821][ T5328] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 93.971926][ T5328] ? __asan_memcpy+0x40/0x70 [ 93.974272][ T5328] ? ext4_read_inline_data+0x100/0x2b0 [ 93.977008][ T5328] ext4_convert_inline_data_nolock+0x208/0x980 [ 93.980184][ T5328] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10 [ 93.983258][ T5328] ? down_write+0x16d/0x200 [ 93.985235][ T5328] ext4_convert_inline_data+0x484/0x5c0 [ 93.987576][ T5328] ? __pfx_ext4_convert_inline_data+0x10/0x10 [ 93.990248][ T5328] ? down_write+0x16d/0x200 [ 93.992165][ T5328] ? __pfx_down_write+0x10/0x10 [ 93.994217][ T5328] ext4_fallocate+0x1e2/0x400 [ 93.996325][ T5328] vfs_fallocate+0x65a/0x7e0 [ 93.998324][ T5328] ? __fget_files+0x2a/0x420 [ 94.000327][ T5328] ? __pfx_vfs_fallocate+0x10/0x10 [ 94.002645][ T5328] __x64_sys_fallocate+0xbf/0x110 [ 94.005005][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.008393][ T5328] do_syscall_64+0x174/0x580 [ 94.011386][ T5328] ? trace_irq_disable+0x3b/0x140 [ 94.014063][ T5328] ? clear_bhb_loop+0x40/0x90 [ 94.016326][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.019148][ T5328] RIP: 0033:0x7f10c1f9e019 [ 94.021425][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.030514][ T5328] RSP: 002b:00007f10c2d8efe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 94.034477][ T5328] RAX: ffffffffffffffda RBX: 00007f10c2225fa0 RCX: 00007f10c1f9e019 [ 94.039179][ T5328] RDX: 0000000000000007 RSI: 0000000000000020 RDI: 0000000000000004 [ 94.043281][ T5328] RBP: 00007f10c203500c R08: 0000000000000000 R09: 0000000000000000 [ 94.047830][ T5328] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 94.052192][ T5328] R13: 00007f10c2226038 R14: 00007f10c2225fa0 R15: 00007fff8c5c9688 [ 94.056416][ T5328] [ 94.059077][ T5328] Kernel Offset: disabled [ 94.061783][ T5328] Rebooting in 86400 seconds..