==================================================================
BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0xa27/0x1eb0 fs/ext4/xattr.c:1710
Read of size 18446744073709551600 at addr ffff888051349eb8 by task kworker/u4:8/4456

CPU: 0 PID: 4456 Comm: kworker/u4:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
 memmove+0x25/0x60 mm/kasan/shadow.c:54
 ext4_xattr_set_entry+0xa27/0x1eb0 fs/ext4/xattr.c:1710
 ext4_xattr_ibody_set+0x25e/0x700 fs/ext4/xattr.c:2217
 ext4_destroy_inline_data_nolock+0x237/0x5f0 fs/ext4/inline.c:468
 ext4_destroy_inline_data+0x7f/0xe0 fs/ext4/inline.c:1931
 ext4_writepages+0x599/0x2e70 fs/ext4/inode.c:2763
 do_writepages+0x3c6/0x640 mm/page-writeback.c:2491
 __writeback_single_inode+0x153/0x1170 fs/fs-writeback.c:1622
 writeback_sb_inodes+0xad5/0x17f0 fs/fs-writeback.c:1913
 wb_writeback+0x470/0xd40 fs/fs-writeback.c:2087
 wb_do_writeback fs/fs-writeback.c:2230 [inline]
 wb_workfn+0x423/0xee0 fs/fs-writeback.c:2270
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

The buggy address belongs to the physical page:
page:ffffea000144d240 refcount:2 mapcount:0 mapping:ffff88801792bf00 index:0x2 pfn:0x51349
memcg:ffff888053506000
aops:def_blk_aops ino:700000
flags: 0xfff5800000205a(referenced|dirty|lru|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff5800000205a ffffea0001448088 ffffea0001cb5408 ffff88801792bf00
raw: 0000000000000002 ffff888071cb6570 00000002ffffffff ffff888053506000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 4544, tgid 4534 (syz.0.31), ts 83919008130, free_ts 83918282753
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292
 filemap_alloc_folio+0xdb/0x480 mm/filemap.c:999
 __filemap_get_folio+0x6ba/0xde0 mm/filemap.c:1993
 pagecache_get_page+0x26/0x260 mm/folio-compat.c:110
 find_or_create_page include/linux/pagemap.h:648 [inline]
 grow_dev_page fs/buffer.c:946 [inline]
 grow_buffers fs/buffer.c:1011 [inline]
 __getblk_slow fs/buffer.c:1038 [inline]
 __getblk_gfp+0x2a0/0xa80 fs/buffer.c:1333
 sb_getblk include/linux/buffer_head.h:356 [inline]
 __ext4_get_inode_loc+0x45f/0xd60 fs/ext4/inode.c:4525
 ext4_get_inode_loc+0x7e/0xf0 fs/ext4/inode.c:4653
 ext4_xattr_ibody_get+0x110/0x4a0 fs/ext4/xattr.c:594
 ext4_xattr_get+0x120/0x660 fs/ext4/xattr.c:655
 __vfs_getxattr+0x3b2/0x3e0 fs/xattr.c:407
 cap_inode_need_killpriv+0x41/0x60 security/commoncap.c:301
 security_inode_need_killpriv+0x5e/0x90 security/security.c:1437
 dentry_needs_remove_privs fs/inode.c:2054 [inline]
 __file_remove_privs+0x232/0x5f0 fs/inode.c:2085
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3555
 release_pages+0x20d1/0x2340 mm/swap.c:1035
 __pagevec_release+0x6d/0xe0 mm/swap.c:1055
 pagevec_release include/linux/pagevec.h:71 [inline]
 folio_batch_release include/linux/pagevec.h:135 [inline]
 shmem_undo_range+0x808/0x21d0 mm/shmem.c:946
 shmem_truncate_range mm/shmem.c:1062 [inline]
 shmem_evict_inode+0x225/0x9f0 mm/shmem.c:1171
 evict+0x4b6/0x8b0 fs/inode.c:705
 __dentry_kill+0x412/0x630 fs/dcache.c:611
 dentry_kill+0xb8/0x290 fs/dcache.c:-1
 dput+0xfa/0x1d0 fs/dcache.c:918
 __fput+0x597/0x8b0 fs/file_table.c:328
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82

Memory state around the buggy address:
 ffff888051349d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888051349e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888051349e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                        ^
 ffff888051349f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888051349f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================