program: syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x10, &(0x7f0000000140)={[{@norecovery}]}, 0xed, 0x474, &(0x7f0000000b80)="$eJzs3EtsG0UfAPD/rvNo+viSr5RHSwuBgqh4JE36oAcuIJA4gIQEhyJOIUmrUrdBTZBoVUHhUI6oEnfEEYk7Eie4IOCAkLjCHVWqql5aOBmtvZs6jp06tRu3+PeT1p7ZXWfm79mxxzN2Auhb49lNErE1Iv6IiNFaduUJ47W7G9fOz/597fxsEpXKm1eT6nnXr52fLU4tHrellqlUIoaz5HCTci++EzFTLs+fyfOTS6fen1w8e+65E6dmjs8fnz89feTIwQN7hg5PH+oovjS/z+K6vuujhd07X3370uuzRy+9+/M3WX235sfr47gtWbQNxmvPbqNHs5snOyrsrvJrdrOtbkcy0PrkiQ2oEO0rRUTWXIPV/j8apRhZPjYar3za08oBd1SlUqk0e3/OXagA/2FJ9LoGQG8Ub/TZ599i26Chx13hyou1D0BZ3DfyrXZkYHnuYLDh8203jUfE0Qv/fJlt0Y15CACAW/g+G/8822z8l8YDdef9L19DGYuI/0fE9oi4LyJ2RMT9EdVzH4yIh9ZZfuMKyerxT3r5tgJrUzb+eyFf21o5/itGfzFWynPbqvEPJsdOlOf358/JvhgczvJTa5Txw8u/f16kNzUcqx//ZVtWfjEWzOtxeaBhgm5uZmmm07gLVz6J2DXQLP4kimWcJCJ2RsSu2yzjxNNf72517Nbxr2GNdaZ2Vb6KeKrW/hdiRfw3myppuT459fzh6UOTm6I8v3+yuCpW++W3i2+0Kr+j+Lsga//NTa//5VXgsWRTxOLZcyer67WL6y/j4p+f1fXpFavLWfzptxHrvv6Hkreq6aF834czS0tnpiKGktdW75+++dgiX5yfxb9vb/P+v72uxg9HRHYR74mIR/JF3KztHouIxyNi7xrx//TSE++1Oraq/UeK+NeYle+iLP65W7V/1Lf/+hOlkz9+13b8Tdv/YDW1L9/TzutfuxXs5LkDAACAe0Va/Q58kk4sp9N0YqL2Hf4dsTktLywuPXNs4YPTc7Xvyo/FYFrMdI3WzYdO5XPDRX66IX8gnzf+ojRSzU/MLpTneh089LktLfp/5q9Sr2sH3HFdWEcD7lH6P/Qv/R/6l/4P/Uv/h/7VrP9/3IN6ABvP+z/0L/0f+pf+D/1L/4e+1PK38WlHP/nvcaL43wkd/J2rvY+i48TInSwi0t4H2BeJgU4u43YSw00P9fiFCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoEv+DQAA//9L2OJW") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000001000)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d0005807e0500000603000003000000fcffffff05010905a10105091901290a150025017501950a81ea940175068103c0"], 0x135) syz_usb_connect$cdc_ecm(0x2, 0x4d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000302000010"], 0x0) write$UHID_INPUT2(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\x00\x00\x00g\x00!'], 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) pwritev2(r2, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x86) [ 94.095799][ T4645] Bluetooth: hci0: command tx timeout [ 94.201163][ T5317] loop0: detected capacity change from 0 to 512 [ 94.350120][ T5317] EXT4-fs (loop0): invalid journal inode [ 94.350199][ T5317] EXT4-fs (loop0): can't get journal size [ 94.636355][ T5317] EXT4-fs (loop0): 1 truncate cleaned up [ 94.638124][ T5317] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.662825][ T5317] loop0: detected capacity change from 512 to 64 [ 94.697296][ T806] hid-generic 8005:057E:0306.0002: unknown main item tag 0x0 [ 94.737162][ T806] input: syz0 as /devices/virtual/misc/uhid/8005:057E:0306.0002/input/input5 [ 94.868781][ T806] hid-generic 8005:057E:0306.0002: input,hidraw1: HID v0.03 Gamepad [syz0] on syz0 [ 95.042829][ T806] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 95.229581][ T129] kworker/u4:5: attempt to access beyond end of device [ 95.229581][ T129] loop0: rw=1, sector=386, nr_sectors = 2 limit=64 [ 95.229608][ T129] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 193) [ 95.229663][ T129] Buffer I/O error on device loop0, logical block 193 [ 95.229863][ T129] kworker/u4:5: attempt to access beyond end of device [ 95.229863][ T129] loop0: rw=1, sector=392, nr_sectors = 2 limit=64 [ 95.229878][ T129] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 196) [ 95.229969][ T129] Buffer I/O error on device loop0, logical block 196 [ 95.231604][ T129] kworker/u4:5: attempt to access beyond end of device [ 95.231604][ T129] loop0: rw=1, sector=394, nr_sectors = 16 limit=64 [ 95.231624][ T129] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 197) [ 95.231640][ T129] Buffer I/O error on device loop0, logical block 197 [ 95.231648][ T129] Buffer I/O error on device loop0, logical block 198 [ 95.231655][ T129] Buffer I/O error on device loop0, logical block 199 [ 95.231662][ T129] Buffer I/O error on device loop0, logical block 200 [ 95.290462][ T129] Buffer I/O error on device loop0, logical block 201 [ 95.290477][ T129] Buffer I/O error on device loop0, logical block 202 [ 95.290483][ T129] Buffer I/O error on device loop0, logical block 203 [ 95.290489][ T129] Buffer I/O error on device loop0, logical block 204 [ 95.318807][ T5317] ------------[ cut here ]------------ [ 95.318818][ T5317] kernel BUG at fs/ext4/mballoc.c:4781! [ 95.318857][ T5317] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 95.326051][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.329774][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.333833][ T5317] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.336275][ T5317] Code: e8 d6 ab a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 42 f8 2f ff 90 0f 0b e8 3a f8 2f ff 90 0f 0b e8 32 f8 2f ff 90 <0f> 0b e8 2a f8 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.344255][ T5317] RSP: 0018:ffffc9000e1f6920 EFLAGS: 00010283 [ 95.346779][ T5317] RAX: ffffffff829825ae RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.350047][ T5317] RDX: ffffc9000eb2a000 RSI: 0000000000005367 RDI: 0000000000005368 [ 95.353287][ T5317] RBP: 1ffff110084c98ef R08: ffff888042650efb R09: 1ffff110084ca1df [ 95.356773][ T5317] R10: dffffc0000000000 R11: ffffed10084ca1e0 R12: 0000000000000000 [ 95.360300][ T5317] R13: 0000000000000014 R14: 1ffff110084ca1e2 R15: ffff888042650f10 [ 95.363703][ T5317] FS: 00007f4d6a23a6c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000 [ 95.367662][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.370533][ T5317] CR2: 000020000000f000 CR3: 000000000bed6000 CR4: 0000000000352ef0 [ 95.373949][ T5317] Call Trace: [ 95.375254][ T5317] [ 95.376476][ T5317] ext4_mb_use_preallocated+0x638/0x13e0 [ 95.378799][ T5317] ext4_mb_new_blocks+0x5a0/0x4530 [ 95.380985][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 95.383287][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 95.385576][ T5317] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 95.388126][ T5317] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 95.390467][ T5317] ? ext4_block_to_path+0x382/0x700 [ 95.392766][ T5317] ext4_ind_map_blocks+0xe96/0x22a0 [ 95.395116][ T5317] ? lockdep_unlock+0x5c/0xd0 [ 95.397178][ T5317] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 95.399568][ T5317] ? down_write+0x16b/0x200 [ 95.401570][ T5317] ext4_map_create_blocks+0xbb/0x530 [ 95.403975][ T5317] ? ext4_fc_track_inode+0xf3/0x3f0 [ 95.406213][ T5317] ext4_map_blocks+0x791/0x12c0 [ 95.408214][ T5317] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 95.410563][ T5317] ? __pfx_ext4_map_blocks+0x10/0x10 [ 95.412629][ T5317] ? kmem_cache_alloc_noprof+0x156/0x600 [ 95.415056][ T5317] ext4_do_writepages+0x1901/0x4770 [ 95.417157][ T5317] ? add_lock_to_list+0xc7/0x100 [ 95.419204][ T5317] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.421533][ T5317] ? lockdep_unlock+0x5c/0xd0 [ 95.423529][ T5317] ? __lock_acquire+0x1511/0x2de0 [ 95.425646][ T5317] ? lock_acquire+0x115/0x350 [ 95.427551][ T5317] ext4_writepages+0x241/0x3b0 [ 95.429486][ T5317] ? __lock_acquire+0x747/0x2de0 [ 95.431390][ T5317] ? __pfx_ext4_writepages+0x10/0x10 [ 95.433510][ T5317] ? __pfx_ext4_writepages+0x10/0x10 [ 95.435672][ T5317] do_writepages+0x338/0x560 [ 95.437655][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 95.439885][ T5317] file_write_and_wait_range+0x36e/0x440 [ 95.442135][ T5317] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 95.444966][ T5317] ext4_sync_file+0x252/0xa40 [ 95.446633][ T5317] ext4_buffered_write_iter+0x2d0/0x380 [ 95.448903][ T5317] ext4_file_write_iter+0xae4/0x1cd0 [ 95.451292][ T5317] ? __lock_acquire+0x747/0x2de0 [ 95.453550][ T5317] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.455978][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 95.458361][ T5317] ? preempt_schedule_common+0x7f/0xd0 [ 95.460742][ T5317] do_iter_readv_writev+0x612/0x8c0 [ 95.463121][ T5317] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 95.465644][ T5317] vfs_writev+0x343/0x990 [ 95.467514][ T5317] ? __pfx_vfs_writev+0x10/0x10 [ 95.469755][ T5317] ? __fget_files+0x2a/0x420 [ 95.471744][ T5317] ? __fget_files+0x3a2/0x420 [ 95.473524][ T5317] ? __fget_files+0x2a/0x420 [ 95.475555][ T5317] __se_sys_pwritev2+0x177/0x2a0 [ 95.477592][ T5317] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 95.479984][ T5317] ? __x64_sys_pwritev2+0x20/0xc0 [ 95.481932][ T5317] do_syscall_64+0x166/0x520 [ 95.483888][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.486357][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.488641][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.491006][ T5317] RIP: 0033:0x7f4d6939e199 [ 95.492951][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.501347][ T5317] RSP: 002b:00007f4d6a239fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 95.504890][ T5317] RAX: ffffffffffffffda RBX: 00007f4d69625fa0 RCX: 00007f4d6939e199 [ 95.508443][ T5317] RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000008 [ 95.512156][ T5317] RBP: 00007f4d694350b8 R08: 0000000000000000 R09: 0000000000000086 [ 95.515698][ T5317] R10: 0000000000000e7b R11: 0000000000000246 R12: 0000000000000000 [ 95.519169][ T5317] R13: 00007f4d69626038 R14: 00007f4d69625fa0 R15: 00007ffcdbdfd5d8 [ 95.522815][ T5317] [ 95.524219][ T5317] Modules linked in: [ 95.526996][ T5317] ---[ end trace 0000000000000000 ]--- [ 95.529381][ T5317] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.529407][ T5317] Code: e8 d6 ab a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 42 f8 2f ff 90 0f 0b e8 3a f8 2f ff 90 0f 0b e8 32 f8 2f ff 90 <0f> 0b e8 2a f8 2f ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.529418][ T5317] RSP: 0018:ffffc9000e1f6920 EFLAGS: 00010283 [ 95.529430][ T5317] RAX: ffffffff829825ae RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.529439][ T5317] RDX: ffffc9000eb2a000 RSI: 0000000000005367 RDI: 0000000000005368 [ 95.529447][ T5317] RBP: 1ffff110084c98ef R08: ffff888042650efb R09: 1ffff110084ca1df [ 95.529456][ T5317] R10: dffffc0000000000 R11: ffffed10084ca1e0 R12: 0000000000000000 [ 95.529465][ T5317] R13: 0000000000000014 R14: 1ffff110084ca1e2 R15: ffff888042650f10 [ 95.529473][ T5317] FS: 00007f4d6a23a6c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000 [ 95.529483][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.529491][ T5317] CR2: 000020000000f000 CR3: 000000000bed6000 CR4: 0000000000352ef0 [ 95.529530][ T5317] Kernel panic - not syncing: Fatal exception [ 95.572435][ T5317] Kernel Offset: disabled [ 95.574375][ T5317] Rebooting in 86400 seconds..