program: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000), 0xfffffecc) (async) r1 = creat(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) close(r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x18, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x139f}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@bsdgroups}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r4 = openat(r0, &(0x7f0000000040)='./file1\x00', 0x402, 0x0) pwrite64(r4, &(0x7f0000000140)='2', 0x1, 0x8000c61) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r5, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) pwrite64(r6, &(0x7f0000000140)='2', 0xfdef, 0xfecc) (async) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000001040)=ANY=[], 0x841, 0x0) (async, rerun: 64) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) (rerun: 64) write$FUSE_WRITE(r7, &(0x7f00000000c0)={0x18}, 0xfffffdef) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000000)={0xfff, "ce4ce029143d79f90fe91dc7c65609a2512801538e183cf9474a9049fe795f37"}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r10, 0x40809440, 0x0) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000040)=0x81) (async) ioctl$SYNC_IOC_MERGE(r8, 0xc0303e03, &(0x7f0000000f80)={"d1ed39d88b014976ab94c1fb10628c46d2e681cdb9e5c1a31965c61e0df52c5e", r9}) (async) close(0x3) (async) r11 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_int(r11, 0x1, 0x1, 0x0, &(0x7f0000001ac0)) (async) r12 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x202080, 0x0) close_range(r12, 0xffffffffffffffff, 0x0) [ 86.271044][ T5297] Bluetooth: hci0: command tx timeout [ 86.446256][ T5321] loop0: detected capacity change from 0 to 1024 [ 86.456568][ T5321] ======================================================= [ 86.456568][ T5321] WARNING: The mand mount option has been deprecated and [ 86.456568][ T5321] and is ignored by this kernel. Remove the mand [ 86.456568][ T5321] option from the mount to silence this warning. [ 86.456568][ T5321] ======================================================= [ 86.519864][ T5321] EXT4-fs: Ignoring removed oldalloc option [ 86.522650][ T5321] EXT4-fs: Ignoring removed orlov option [ 86.557073][ T5321] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 86.591082][ T5321] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 86.625484][ T1087] ================================================================== [ 86.628768][ T1087] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 86.631905][ T1087] Read of size 4 at addr ffff8880131a530c by task kworker/u4:9/1087 [ 86.635429][ T1087] [ 86.636585][ T1087] CPU: 0 UID: 0 PID: 1087 Comm: kworker/u4:9 Not tainted syzkaller #0 PREEMPT(full) [ 86.636600][ T1087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.636609][ T1087] Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work [ 86.636632][ T1087] Call Trace: [ 86.636640][ T1087] [ 86.636646][ T1087] dump_stack_lvl+0xe8/0x150 [ 86.636662][ T1087] print_report+0xba/0x230 [ 86.636675][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.636686][ T1087] kasan_report+0x117/0x150 [ 86.636698][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.636710][ T1087] ext4_find_extent+0xae6/0xcc0 [ 86.636722][ T1087] ext4_ext_map_blocks+0x283/0x58b0 [ 86.636736][ T1087] ? check_path+0x21/0x40 [ 86.636752][ T1087] ? lockdep_unlock+0x5d/0xd0 [ 86.636765][ T1087] ? __lock_acquire+0x146e/0x2cf0 [ 86.636781][ T1087] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 86.636798][ T1087] ext4_map_create_blocks+0x11d/0x540 [ 86.636814][ T1087] ext4_map_blocks+0x7cd/0x11d0 [ 86.636837][ T1087] ? __pfx_ext4_map_blocks+0x10/0x10 [ 86.636850][ T1087] ? ext4_journal_check_start+0x1cf/0x2b0 [ 86.636867][ T1087] ? ext4_chunk_trans_blocks+0x1f0/0x270 [ 86.636876][ T1087] ext4_convert_unwritten_extents+0x2be/0x5f0 [ 86.636886][ T1087] ? __pfx_ext4_convert_unwritten_extents+0x10/0x10 [ 86.636895][ T1087] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.636902][ T1087] ext4_convert_unwritten_io_end_vec+0xff/0x170 [ 86.636911][ T1087] ext4_end_io_end+0xc7/0x410 [ 86.636926][ T1087] ext4_end_io_rsv_work+0x26a/0x340 [ 86.636941][ T1087] ? __pfx_ext4_end_io_rsv_work+0x10/0x10 [ 86.636956][ T1087] ? process_scheduled_works+0xa25/0x1830 [ 86.636969][ T1087] ? process_scheduled_works+0xa25/0x1830 [ 86.636982][ T1087] process_scheduled_works+0xb02/0x1830 [ 86.637002][ T1087] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.637014][ T1087] ? assign_work+0x3d5/0x5e0 [ 86.637022][ T1087] worker_thread+0xa50/0xfc0 [ 86.637035][ T1087] kthread+0x388/0x470 [ 86.637042][ T1087] ? __pfx_worker_thread+0x10/0x10 [ 86.637051][ T1087] ? __pfx_kthread+0x10/0x10 [ 86.637057][ T1087] ret_from_fork+0x51e/0xb90 [ 86.637067][ T1087] ? __pfx_ret_from_fork+0x10/0x10 [ 86.637076][ T1087] ? __switch_to+0xc7d/0x1450 [ 86.637088][ T1087] ? __pfx_kthread+0x10/0x10 [ 86.637098][ T1087] ret_from_fork_asm+0x1a/0x30 [ 86.637117][ T1087] [ 86.637122][ T1087] [ 86.737059][ T1087] The buggy address belongs to the physical page: [ 86.740636][ T1087] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x6a pfn:0x131a5 [ 86.745352][ T1087] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 86.749154][ T1087] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 [ 86.753486][ T1087] raw: 000000000000006a 0000000000000000 00000000ffffffff 0000000000000000 [ 86.759178][ T1087] page dumped because: kasan: bad access detected [ 86.762558][ T1087] page_owner tracks the page as freed [ 86.765250][ T1087] page last allocated via order 0, migratetype Movable, gfp_mask 0x152c4a(GFP_NOFS|__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 1, tgid 1 (init), ts 28805532659, free_ts 82462650132 [ 86.775559][ T1087] post_alloc_hook+0x231/0x280 [ 86.777712][ T1087] get_page_from_freelist+0x24dc/0x2580 [ 86.780009][ T1087] __alloc_frozen_pages_noprof+0x18d/0x380 [ 86.782544][ T1087] alloc_pages_mpol+0x232/0x4a0 [ 86.784919][ T1087] alloc_pages_noprof+0xa8/0x190 [ 86.787048][ T1087] folio_alloc_noprof+0x1e/0x30 [ 86.789085][ T1087] filemap_alloc_folio_noprof+0x111/0x470 [ 86.791452][ T1087] page_cache_ra_unbounded+0x39b/0xa50 [ 86.793778][ T1087] page_cache_ra_order+0xaf2/0xeb0 [ 86.795992][ T1087] filemap_get_pages+0x897/0x1f10 [ 86.798126][ T1087] filemap_read+0x447/0x1230 [ 86.800148][ T1087] __kernel_read+0x504/0x9b0 [ 86.802117][ T1087] integrity_kernel_read+0x89/0xd0 [ 86.804347][ T1087] ima_calc_file_hash+0x12c3/0x17f0 [ 86.806688][ T1087] ima_collect_measurement+0x48b/0x930 [ 86.809153][ T1087] process_measurement+0x12cd/0x1c80 [ 86.811460][ T1087] page last free pid 71 tgid 71 stack trace: [ 86.814035][ T1087] free_unref_folios+0xed5/0x16d0 [ 86.816190][ T1087] shrink_folio_list+0x2a0f/0x5290 [ 86.818410][ T1087] evict_folios+0x4795/0x5880 [ 86.820352][ T1087] try_to_shrink_lruvec+0xb62/0xfa0 [ 86.822430][ T1087] shrink_one+0x25c/0x710 [ 86.824238][ T1087] shrink_node+0x3197/0x3a90 [ 86.826248][ T1087] kswapd+0x1742/0x2e10 [ 86.828002][ T1087] kthread+0x388/0x470 [ 86.829840][ T1087] ret_from_fork+0x51e/0xb90 [ 86.831918][ T1087] ret_from_fork_asm+0x1a/0x30 [ 86.833903][ T1087] [ 86.835012][ T1087] Memory state around the buggy address: [ 86.837431][ T1087] ffff8880131a5200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.840768][ T1087] ffff8880131a5280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.844101][ T1087] >ffff8880131a5300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.847456][ T1087] ^ [ 86.849237][ T1087] ffff8880131a5380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.852611][ T1087] ffff8880131a5400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.855991][ T1087] ================================================================== [ 86.942615][ T1087] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.945817][ T1087] CPU: 0 UID: 0 PID: 1087 Comm: kworker/u4:9 Not tainted syzkaller #0 PREEMPT(full) [ 86.949876][ T1087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.954071][ T1087] Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work [ 86.957089][ T1087] Call Trace: [ 86.958587][ T1087] [ 86.960175][ T1087] vpanic+0x56c/0xa60 [ 86.962487][ T1087] ? __pfx_vpanic+0x10/0x10 [ 86.964669][ T1087] panic+0xc5/0xd0 [ 86.966372][ T1087] ? __pfx_panic+0x10/0x10 [ 86.968331][ T1087] ? preempt_schedule_thunk+0x16/0x30 [ 86.970794][ T1087] ? preempt_schedule_thunk+0x16/0x30 [ 86.973164][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.975362][ T1087] check_panic_on_warn+0x89/0xb0 [ 86.977826][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.980237][ T1087] end_report+0x73/0x180 [ 86.982164][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.984607][ T1087] kasan_report+0x128/0x150 [ 86.986770][ T1087] ? ext4_find_extent+0xae6/0xcc0 [ 86.989288][ T1087] ext4_find_extent+0xae6/0xcc0 [ 86.991754][ T1087] ext4_ext_map_blocks+0x283/0x58b0 [ 86.994304][ T1087] ? check_path+0x21/0x40 [ 86.996467][ T1087] ? lockdep_unlock+0x5d/0xd0 [ 86.998527][ T1087] ? __lock_acquire+0x146e/0x2cf0 [ 87.000732][ T1087] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 87.003110][ T1087] ext4_map_create_blocks+0x11d/0x540 [ 87.005532][ T1087] ext4_map_blocks+0x7cd/0x11d0 [ 87.007658][ T1087] ? __pfx_ext4_map_blocks+0x10/0x10 [ 87.009896][ T1087] ? ext4_journal_check_start+0x1cf/0x2b0 [ 87.012347][ T1087] ? ext4_chunk_trans_blocks+0x1f0/0x270 [ 87.014667][ T1087] ext4_convert_unwritten_extents+0x2be/0x5f0 [ 87.017305][ T1087] ? __pfx_ext4_convert_unwritten_extents+0x10/0x10 [ 87.020148][ T1087] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.022097][ T1087] ext4_convert_unwritten_io_end_vec+0xff/0x170 [ 87.024665][ T1087] ext4_end_io_end+0xc7/0x410 [ 87.026737][ T1087] ext4_end_io_rsv_work+0x26a/0x340 [ 87.028963][ T1087] ? __pfx_ext4_end_io_rsv_work+0x10/0x10 [ 87.031419][ T1087] ? process_scheduled_works+0xa25/0x1830 [ 87.033924][ T1087] ? process_scheduled_works+0xa25/0x1830 [ 87.036465][ T1087] process_scheduled_works+0xb02/0x1830 [ 87.039016][ T1087] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.041678][ T1087] ? assign_work+0x3d5/0x5e0 [ 87.043744][ T1087] worker_thread+0xa50/0xfc0 [ 87.045883][ T1087] kthread+0x388/0x470 [ 87.047597][ T1087] ? __pfx_worker_thread+0x10/0x10 [ 87.049777][ T1087] ? __pfx_kthread+0x10/0x10 [ 87.051619][ T1087] ret_from_fork+0x51e/0xb90 [ 87.053575][ T1087] ? __pfx_ret_from_fork+0x10/0x10 [ 87.055917][ T1087] ? __switch_to+0xc7d/0x1450 [ 87.057944][ T1087] ? __pfx_kthread+0x10/0x10 [ 87.059981][ T1087] ret_from_fork_asm+0x1a/0x30 [ 87.061997][ T1087] [ 87.063685][ T1087] Kernel Offset: disabled [ 87.065845][ T1087] Rebooting in 86400 seconds..