program: r0 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000019080)={'gre0\x00', 0x0}) r2 = syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x0, &(0x7f0000000380)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xfe, 0x45e, &(0x7f0000000400)="$eJzs3MuPFMUfAPBv98wu79/uT/EBgq6ikfjYZZfnwYMYTTxoYqIHjKd1dyHIwiq7JkKIogc8GhLvxqOJf4EnvRj1ZOJV74aEGC6gicmY7umeHYeZdYcdGGA+n6ShqruGqm9310x11QwBDKyx7I8kYnNE/BoRI/XsvwuM1f+6duXczJ9Xzs0kUau9/keSl7t65dxMWbR83aZ6plYr8uva1HvhrYjp+fm500V+YunkuxOLZ84+e/zk9LG5Y3Onpg4d2rd35/CBqf09iTOL6+r2Dxd2bHv5zYuvzhy5+PaPX2ft3Vwcb46jV8bqZ7etJ3pdWZ9taUon1Yjn+9gWVq8SEdWIGMr7/0hUYkPj2Ei89ElfGwfcVLVardbu87lwvgbcxZLodwuA/ig/6LPn33K7RUOP28LlwxHvHazHf63Y6keqkRZlhlqeb3tpLCKOnP/ri2yLmzQPAQDQ7NvDEfFMu/FfGvc3lftfsYYyGhH/j4h7IuLeiNgaEfdF5GUfiIgHu6y/dYXk+vFPeumGAlulbPz3XLG21Rj//V3L4y+MVorcljz+oeTo8fm5PcU52R1D67L85Ap1fPfiL591OtY8/su2rP5yLFiXXqq2TNDNTi9NrzHshssfR2yvtsSfS/J1gSjW9bZFxPau/uXlJ4zjT321o1Op/45/BdWuGtS+lV9GPFm//uejJf5S0nF9cvLggan9E+tjfm7PRHlXlJbXUX76+cJrnepfU/w9kF3/ja33f64R/2iyPmLxzNkT+XrtYvd1XPjt047PNDd6/w8nb+Tp4WLfB9NLS6cnI4aTV67fP7X82jJfls/i372rXfxp/h5XnomHIiK7iXdGxMMR8UjR9kcj4rGI2LVC/D+88Pg73ce/wqx8D2Xxz7a7/pVGkdEs/uXr332icuL7b7qPv5Rd/315anexZzXvf6tt4FrOHQAAANwp0vw78Ek63kin6fh4/Tv8W2NjOr+wuPT00YX3T83Wvys/GkNpOdM10jQfOlnMDZf5qZb83mLe+PPKhjw/PrMwP9vv4GHAberQ/zO/V/rdOuCm68E6GnCH0v9hcOn/MLj0fxhc+j8Mrnb9/6M+tAO49Xz+w+DS/2Fw6f8wuPR/GEitP4mvlHvSNf3kX+KuT0Ta/auqcZs0/k5KVFf9n1ncYGJd20P9fmcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADojX8CAAD//w/N7aY=") truncate(&(0x7f0000000880)='./file1\x00', 0xc5d) io_setup(0x1, &(0x7f00000008c0)=0x0) creat(&(0x7f0000000900)='./bus\x00', 0x0) mount(&(0x7f0000000940)=@loop={'/dev/loop', 0x0}, &(0x7f0000000980)='./bus\x00', 0x0, 0x5000, 0x0) r4 = open(&(0x7f00000009c0)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r4, 0x4c04, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3, 0x10000000]}) r5 = openat(r2, &(0x7f0000000b00)='./file1\x00', 0x101042, 0x10d) r6 = openat(0xffffffffffffff9c, &(0x7f0000000b40)='./file1\x00', 0x143042, 0x0) pwritev2(r6, &(0x7f0000000b80)=[{&(0x7f0000000bc0)="ff", 0x1}], 0x1, 0x25412, 0x4, 0x0) io_submit(r3, 0x1, &(0x7f0000000c00)=[&(0x7f0000000c40)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000c80)='i', 0xa800, 0xe00}]) bind$packet(r0, &(0x7f00000190c0)={0x11, 0x0, r1}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000019100)=0xe9, 0x4) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f00000192c0)=0x93bd, 0x4) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NFC_CMD_GET_SE(r8, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0x14, r9, 0x300, 0x70bd29, 0x25dfdbfb, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40cc004) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)=0x0) sendmsg$NFC_CMD_FW_DOWNLOAD(r7, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000800}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, r9, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_FIRMWARE_NAME={0x9, 0x14, 'gre0\x00'}, @NFC_ATTR_FIRMWARE_NAME={0x11, 0x14, '^.+}]+@\\%!}!.'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8084}, 0x8000) sendmsg$netlink(r0, &(0x7f0000019300)={0x0, 0x0, &(0x7f0000019340)=[{&(0x7f0000019380)=ANY=[@ANYBLOB="0201140084dc18000e1a80009f0001852900002f0600ac141430e0000001808a8972bd0b72e41082b1a3d206"], 0xdd12}], 0x1, 0x0, 0x0, 0x14048802}, 0x40488d0) [ 87.352507][ T4665] Bluetooth: hci0: command tx timeout [ 87.436215][ T5346] loop0: detected capacity change from 0 to 512 [ 87.663612][ T5346] EXT4-fs (loop0): 1 truncate cleaned up [ 87.681220][ T5346] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.755375][ T5346] loop0: detected capacity change from 512 to 64 [ 87.763439][ T5346] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 87.775851][ T5346] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 87.837449][ T5347] syz.0.0: attempt to access beyond end of device [ 87.837449][ T5347] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 87.837480][ T5347] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 36) [ 87.837610][ T5347] Buffer I/O error on device loop0, logical block 36 [ 87.837744][ T5347] syz.0.0: attempt to access beyond end of device [ 87.837744][ T5347] loop0: rw=2049, sector=296, nr_sectors = 2 limit=64 [ 87.837759][ T5347] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 148) [ 87.838647][ T5347] Buffer I/O error on device loop0, logical block 148 [ 87.839271][ T5347] syz.0.0: attempt to access beyond end of device [ 87.839271][ T5347] loop0: rw=2049, sector=510, nr_sectors = 2 limit=64 [ 87.839289][ T5347] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 255) [ 87.839304][ T5347] Buffer I/O error on device loop0, logical block 255 [ 87.840223][ T5347] syz.0.0: attempt to access beyond end of device [ 87.840223][ T5347] loop0: rw=2049, sector=308, nr_sectors = 6 limit=64 [ 87.840241][ T5347] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 154) [ 87.840257][ T5347] Buffer I/O error on device loop0, logical block 154 [ 87.840265][ T5347] Buffer I/O error on device loop0, logical block 155 [ 87.840271][ T5347] Buffer I/O error on device loop0, logical block 156 [ 87.939629][ T1161] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:14: corrupted inode contents [ 87.941878][ T1161] EXT4-fs error (device loop0): ext4_dirty_inode:6733: inode #15: comm kworker/u4:14: mark_inode_dirty error [ 87.941985][ T5347] syz.0.0: attempt to access beyond end of device [ 87.941985][ T5347] loop0: rw=2049, sector=314, nr_sectors = 8 limit=64 [ 87.942004][ T5347] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 157) [ 87.942022][ T5347] Buffer I/O error on device loop0, logical block 157 [ 87.942031][ T5347] Buffer I/O error on device loop0, logical block 158 [ 87.942037][ T5347] Buffer I/O error on device loop0, logical block 159 [ 87.942045][ T5347] Buffer I/O error on device loop0, logical block 160 [ 87.942355][ T1161] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:14: corrupted inode contents [ 87.943038][ T1161] EXT4-fs error (device loop0): ext4_dirty_inode:6733: inode #15: comm kworker/u4:14: mark_inode_dirty error [ 88.009186][ T1161] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:14: corrupted inode contents [ 88.011498][ T1161] EXT4-fs error (device loop0): ext4_dirty_inode:6733: inode #15: comm kworker/u4:14: mark_inode_dirty error [ 88.012911][ T1161] ------------[ cut here ]------------ [ 88.012920][ T1161] kernel BUG at fs/ext4/mballoc.c:4781! [ 88.012946][ T1161] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 88.030333][ T1161] CPU: 0 UID: 0 PID: 1161 Comm: kworker/u4:14 Not tainted syzkaller #0 PREEMPT(full) [ 88.034170][ T1161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.038203][ T1161] Workqueue: writeback wb_workfn (flush-7:0) [ 88.041069][ T1161] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 88.043859][ T1161] Code: e8 36 a8 a0 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 83 28 ff 90 0f 0b e8 8a 83 28 ff 90 0f 0b e8 82 83 28 ff 90 <0f> 0b e8 7a 83 28 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 88.052235][ T1161] RSP: 0018:ffffc90001f46540 EFLAGS: 00010293 [ 88.054978][ T1161] RAX: ffffffff82a0945e RBX: 00000000ffffffef RCX: ffff888034bb8000 [ 88.058397][ T1161] RDX: 0000000000000000 RSI: 0000000000000016 RDI: 0000000000000005 [ 88.061929][ T1161] RBP: 1ffff110088e7207 R08: ffff88804473da73 R09: 1ffff110088e7b4e [ 88.065585][ T1161] R10: dffffc0000000000 R11: ffffed10088e7b4f R12: 0000000000000000 [ 88.069024][ T1161] R13: 0000000000000016 R14: 1ffff110088e7b51 R15: ffff88804473da88 [ 88.072163][ T1161] FS: 0000000000000000(0000) GS:ffff88808ac32000(0000) knlGS:0000000000000000 [ 88.075697][ T1161] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.078252][ T1161] CR2: 00007f1981ffa6b8 CR3: 0000000045919000 CR4: 0000000000352ef0 [ 88.081386][ T1161] Call Trace: [ 88.082731][ T1161] [ 88.083910][ T1161] ext4_mb_use_preallocated+0x638/0x13e0 [ 88.086394][ T1161] ext4_mb_new_blocks+0x596/0x4520 [ 88.088588][ T1161] ? do_raw_spin_unlock+0x4d/0x200 [ 88.090840][ T1161] ? _raw_spin_unlock+0x28/0x50 [ 88.093055][ T1161] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 88.095562][ T1161] ? unwind_next_frame+0x1baf/0x2550 [ 88.097911][ T1161] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 88.100315][ T1161] ? ret_from_fork_asm+0x1a/0x30 [ 88.102626][ T1161] ? ext4_block_to_path+0x382/0x700 [ 88.104928][ T1161] ext4_ind_map_blocks+0xe96/0x2290 [ 88.107006][ T1161] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 88.109226][ T1161] ? kasan_save_track+0x4f/0x80 [ 88.111235][ T1161] ? __kasan_slab_alloc+0x6c/0x80 [ 88.113260][ T1161] ? down_write+0x166/0x200 [ 88.115138][ T1161] ext4_map_create_blocks+0xbb/0x530 [ 88.117407][ T1161] ? ext4_fc_track_inode+0xf3/0x3f0 [ 88.119752][ T1161] ext4_map_blocks+0x791/0x12c0 [ 88.121887][ T1161] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 88.124172][ T1161] ? __pfx_ext4_map_blocks+0x10/0x10 [ 88.126467][ T1161] ? kmem_cache_alloc_noprof+0x151/0x600 [ 88.129174][ T1161] ext4_do_writepages+0x1901/0x4770 [ 88.131498][ T1161] ? __pfx_ext4_do_writepages+0x10/0x10 [ 88.133893][ T1161] ? __lock_acquire+0x747/0x2de0 [ 88.136094][ T1161] ? filemap_get_folios_tag+0x639/0x720 [ 88.138523][ T1161] ? filemap_get_folios_tag+0x118/0x720 [ 88.140869][ T1161] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 88.143352][ T1161] ? lock_acquire+0x115/0x350 [ 88.145380][ T1161] ext4_writepages+0x1fe/0x4e0 [ 88.147391][ T1161] ? __pfx_ext4_writepages+0x10/0x10 [ 88.149651][ T1161] ? __pfx_ext4_writepages+0x10/0x10 [ 88.151899][ T1161] do_writepages+0x338/0x560 [ 88.153931][ T1161] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.156078][ T1161] ? reacquire_held_locks+0x117/0x1a0 [ 88.158387][ T1161] ? writeback_sb_inodes+0x450/0x1af0 [ 88.160611][ T1161] __writeback_single_inode+0x136/0x1220 [ 88.163031][ T1161] ? do_raw_spin_unlock+0x4d/0x200 [ 88.165287][ T1161] writeback_sb_inodes+0x9de/0x1af0 [ 88.167585][ T1161] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 88.170045][ T1161] ? __pfx_down_read_trylock+0x10/0x10 [ 88.172367][ T1161] ? __pfx___up_read+0x10/0x10 [ 88.174466][ T1161] __writeback_inodes_wb+0x114/0x240 [ 88.176691][ T1161] wb_writeback+0x42f/0xad0 [ 88.178589][ T1161] ? queue_io+0x211/0x470 [ 88.180382][ T1161] ? __pfx_wb_writeback+0x10/0x10 [ 88.182430][ T1161] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.184517][ T1161] wb_workfn+0x980/0x10f0 [ 88.186432][ T1161] ? __pfx_wb_workfn+0x10/0x10 [ 88.188475][ T1161] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.190671][ T1161] ? lock_acquire+0x115/0x350 [ 88.192746][ T1161] ? rcu_is_watching+0x16/0xb0 [ 88.194964][ T1161] ? process_scheduled_works+0x97a/0x1630 [ 88.197313][ T1161] process_scheduled_works+0xc3d/0x1630 [ 88.199753][ T1161] ? __pfx_process_scheduled_works+0x10/0x10 [ 88.202341][ T1161] ? assign_work+0x3cf/0x5d0 [ 88.204311][ T1161] worker_thread+0xa47/0xfb0 [ 88.206262][ T1161] ? __kthread_parkme+0x71/0x1f0 [ 88.208174][ T1161] kthread+0x38b/0x480 [ 88.209756][ T1161] ? __pfx_worker_thread+0x10/0x10 [ 88.211826][ T1161] ? __pfx_kthread+0x10/0x10 [ 88.213676][ T1161] ret_from_fork+0x514/0xb70 [ 88.215618][ T1161] ? __pfx_ret_from_fork+0x10/0x10 [ 88.217877][ T1161] ? __switch_to+0xc78/0x1410 [ 88.219927][ T1161] ? __pfx_kthread+0x10/0x10 [ 88.221997][ T1161] ret_from_fork_asm+0x1a/0x30 [ 88.224144][ T1161] [ 88.225545][ T1161] Modules linked in: [ 88.228375][ T1161] ---[ end trace 0000000000000000 ]--- [ 88.231131][ T1161] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 88.231152][ T1161] Code: e8 36 a8 a0 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 83 28 ff 90 0f 0b e8 8a 83 28 ff 90 0f 0b e8 82 83 28 ff 90 <0f> 0b e8 7a 83 28 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 88.231161][ T1161] RSP: 0018:ffffc90001f46540 EFLAGS: 00010293 [ 88.231173][ T1161] RAX: ffffffff82a0945e RBX: 00000000ffffffef RCX: ffff888034bb8000 [ 88.231181][ T1161] RDX: 0000000000000000 RSI: 0000000000000016 RDI: 0000000000000005 [ 88.231187][ T1161] RBP: 1ffff110088e7207 R08: ffff88804473da73 R09: 1ffff110088e7b4e [ 88.231195][ T1161] R10: dffffc0000000000 R11: ffffed10088e7b4f R12: 0000000000000000 [ 88.231202][ T1161] R13: 0000000000000016 R14: 1ffff110088e7b51 R15: ffff88804473da88 [ 88.231210][ T1161] FS: 0000000000000000(0000) GS:ffff88808ac32000(0000) knlGS:0000000000000000 [ 88.231219][ T1161] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.231226][ T1161] CR2: 00007f1981ffa6b8 CR3: 0000000045919000 CR4: 0000000000352ef0 [ 88.231266][ T1161] Kernel panic - not syncing: Fatal exception [ 88.276490][ T1161] Kernel Offset: disabled [ 88.278330][ T1161] Rebooting in 86400 seconds..