program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./upper/file0\x00', 0xc04, &(0x7f0000000440)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x5}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@test_dummy_encryption_v1}, {@errors_remount}, {@nogrpid}]}, 0x1, 0x43f, &(0x7f0000001d80)="$eJzs281vG0UbAPBn7aR50483oSofTQsECiLiI2nSUnrgAgKJA0hIcCjHkKRVqNugJki0iiAgVI6oEnfEEYm/gBNcEHBC4gp3VKlCubRwMlp7N7Fd2zipExf8+0nbzuyOPfN4d+yZnWwAfWs8/SeJ2B8Rv0bESDVbX2C8+t+t9dW5P9dX55Iol9/4I6mUu7m+OpcXzV+3L88MRBQ+SeJIk3qXL185P1sqLVzK8lMrF96dWr585ZnFC7PnFs4tXJw5ffrkiennTs0825U407hujn2wdPTwK29de23uzLW3f/w6yeNviKNLxtsdfLxc7nJ1vXWgJp0M9LAhbEmx2k1jsNL/R6IYmydvJF7+uKeNA3ZUuVwu39f68FoZ+A9LotctAHoj/6FP57/5tktDj7vCjReqE6A07lvpNpQfGYhClhpsmN9203hEnFn764t0i525DwEAUOfbdPzzdLPxXyFq7wv9P1tDGY2IeyLiYESciohDEXFvRKXs/RHxQLNKktb1Ny6S3D7+KVzfdnAdSMd/z2drW/mW1ZsXGS1muQOV+AeTs4ulhePZZzIRg0NpfrpNHd+99MtnrY7Vjv/SLa0/Hwtm7bg+MFT/mvnZldk7ibnWjY8ixgaaxZ9srASkp+9wRIx1+qbF+uzik18dbVX0n+NvowvrTOUvI56onv+1aIg/l7Rfn5z6X5QWjk/lV8Xtfvr56uut6r+j+LsgPf97m17/G/GPJrXrtctbr+Pqb5+2nNNs9/rfk7xZt+/92ZWVS9MRe5JXq42u3T/TUG5ms3wa/8Sx5v3/YGx+EkciIr2IH4yIhyLi4aztj0TEoxFxrE38P7z42Dvbi3+ozbt2Rxr//JbO/2ZiTzTuaZ4onv/+m7pKRzuNP7Lzf7KSmsj2dPL910m7tnc1AwAAwL9PISL2R1KY3EgXCpOT1b/hPxR7C6Wl5ZWnzi69d3G++ozAaAwW8jtdIzX3Q6ezaX2en2nIn8juG39eHK7kJ+eWSvO9Dh763L4W/T/1e7HXrQN2nOe1oH/p/9C/9H/oX/o/9K8m/X+4F+0Adl+z3/8Pe9AOYPc19H/LftBHzP+hf+n/0L/0f+hLy8PR7Nn44ejw+XmJfk1E4a5ohsQOJXr9zQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAdfwcAAP//0OLkSA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, r1, &(0x7f0000004240)) write$FUSE_BMAP(r0, &(0x7f0000000080)={0x18, 0x0, 0x0, {0x6}}, 0x18) creat(&(0x7f0000000580)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) creat(0x0, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00], 0x5c, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000002400010025bd70e9ffff070000000000060004"], 0x1c}, 0x1, 0x0, 0x0, 0x20008004}, 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101041, 0x15) pwrite64(r4, &(0x7f0000000140)='2', 0xfdef, 0xe7c) [ 93.893835][ T5282] Bluetooth: hci0: command tx timeout [ 94.045603][ T5317] loop0: detected capacity change from 0 to 512 [ 94.067785][ T5317] EXT4-fs (loop0): Test dummy encryption mode enabled [ 94.067808][ T5317] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 94.067815][ T5317] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 94.306269][ T5317] EXT4-fs (loop0): 1 truncate cleaned up [ 94.308092][ T5317] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.330355][ T5317] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2863: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 94.369951][ T5317] fscrypt: AES-256-XTS using blk-crypto-fallback [ 94.402608][ T5317] loop0: detected capacity change from 512 to 64 [ 94.430724][ T5317] ================================================================== [ 94.430742][ T5317] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.430859][ T5317] Read of size 18446744073709551600 at addr ffff88805232e2d0 by task syz.0.0/5317 [ 94.430873][ T5317] [ 94.430883][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.430899][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.430920][ T5317] Call Trace: [ 94.430940][ T5317] [ 94.430948][ T5317] dump_stack_lvl+0xe8/0x150 [ 94.430969][ T5317] print_address_description+0x55/0x1e0 [ 94.431052][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.431070][ T5317] print_report+0x58/0x70 [ 94.431086][ T5317] kasan_report+0x117/0x150 [ 94.431102][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.431120][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.431136][ T5317] kasan_check_range+0x264/0x2c0 [ 94.431175][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.431196][ T5317] __asan_memmove+0x29/0x70 [ 94.431216][ T5317] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.431241][ T5317] ext4_xattr_ibody_set+0x262/0x710 [ 94.431261][ T5317] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.431284][ T5317] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.431306][ T5317] ? down_write+0x16b/0x200 [ 94.431373][ T5317] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.431390][ T5317] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.431411][ T5317] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.431430][ T5317] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.431453][ T5317] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.431473][ T5317] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.431490][ T5317] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.431506][ T5317] ? ext4_try_to_write_inline_data+0x49/0x90 [ 94.431527][ T5317] ext4_write_begin+0x3bd/0x1900 [ 94.431558][ T5317] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.431579][ T5317] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 94.431600][ T5317] generic_perform_write+0x2d5/0x8f0 [ 94.431619][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.431639][ T5317] ? __pfx_generic_perform_write+0x10/0x10 [ 94.431652][ T5317] ? file_update_time_flags+0x3ab/0x440 [ 94.431673][ T5317] ext4_buffered_write_iter+0xd4/0x380 [ 94.431685][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.431701][ T5317] ext4_file_write_iter+0xae4/0x1cd0 [ 94.431718][ T5317] ? lock_acquire+0x115/0x350 [ 94.431731][ T5317] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.431750][ T5317] vfs_write+0x612/0xba0 [ 94.431772][ T5317] ? __pfx_vfs_write+0x10/0x10 [ 94.431793][ T5317] ? __fget_files+0x2a/0x420 [ 94.431811][ T5317] __x64_sys_pwrite64+0x196/0x220 [ 94.431831][ T5317] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.431853][ T5317] do_syscall_64+0x166/0x520 [ 94.431870][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.431885][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.431898][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.431914][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.431929][ T5317] RIP: 0033:0x7ff2f079e159 [ 94.431945][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.431981][ T5317] RSP: 002b:00007ff2f1602fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.431999][ T5317] RAX: ffffffffffffffda RBX: 00007ff2f0a25fa0 RCX: 00007ff2f079e159 [ 94.432011][ T5317] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000009 [ 94.432021][ T5317] RBP: 00007ff2f083506b R08: 0000000000000000 R09: 0000000000000000 [ 94.432031][ T5317] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 94.432041][ T5317] R13: 00007ff2f0a26038 R14: 00007ff2f0a25fa0 R15: 00007ffe0277fab8 [ 94.432057][ T5317] [ 94.432063][ T5317] [ 94.432067][ T5317] The buggy address belongs to the physical page: [ 94.432074][ T5317] page: refcount:3 mapcount:0 mapping:ffff88801d025940 index:0x2 pfn:0x5232e [ 94.432086][ T5317] memcg:ffff888043bf3380 [ 94.432094][ T5317] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.432196][ T5317] flags: 0x4fff18000004214(referenced|dirty|workingset|private|node=1|zone=1|lastcpupid=0x7ff) [ 94.432218][ T5317] raw: 04fff18000004214 0000000000000000 dead000000000122 ffff88801d025940 [ 94.432233][ T5317] raw: 0000000000000002 ffff8880440479a0 00000003ffffffff ffff888043bf3380 [ 94.432242][ T5317] page dumped because: kasan: bad access detected [ 94.432248][ T5317] page_owner tracks the page as allocated [ 94.432254][ T5317] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5317, tgid 5316 (syz.0.0), ts 94429589203 [ 94.432275][ T5317] post_alloc_hook+0x1f9/0x250 [ 94.432295][ T5317] get_page_from_freelist+0x2209/0x2280 [ 94.432314][ T5317] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.432333][ T5317] alloc_pages_mpol+0x21e/0x390 [ 94.432345][ T5317] alloc_pages_noprof+0xb1/0x2b0 [ 94.432368][ T5317] folio_alloc_noprof+0x1e/0x30 [ 94.432381][ T5317] filemap_alloc_folio_noprof+0x111/0x460 [ 94.432397][ T5317] __filemap_get_folio_mpol+0x402/0x1000 [ 94.432411][ T5317] bdev_getblk+0x1f4/0x6e0 [ 94.432423][ T5317] __ext4_get_inode_loc+0x56c/0xf40 [ 94.432438][ T5317] ext4_reserve_inode_write+0x18b/0x360 [ 94.432455][ T5317] __ext4_mark_inode_dirty+0x146/0x7b0 [ 94.432466][ T5317] ext4_dirty_inode+0xd0/0x110 [ 94.432481][ T5317] __mark_inode_dirty+0x3a8/0x13b0 [ 94.432491][ T5317] file_update_time_flags+0x399/0x440 [ 94.432508][ T5317] ext4_write_checks+0x9f/0x220 [ 94.432523][ T5317] page last free pid 5278 tgid 5278 ts 94423304920 stack trace: [ 94.432532][ T5317] free_unref_folios+0xdc2/0x14e0 [ 94.432547][ T5317] folios_put_refs+0x9e9/0xb30 [ 94.432563][ T5317] shmem_undo_range+0x4e6/0x15d0 [ 94.432575][ T5317] shmem_evict_inode+0x247/0xae0 [ 94.432589][ T5317] evict+0x624/0xb50 [ 94.432605][ T5317] dentry_kill+0x1b9/0x880 [ 94.432615][ T5317] finish_dput+0x1a/0x260 [ 94.432628][ T5317] filename_renameat2+0x61b/0x9a0 [ 94.432640][ T5317] __se_sys_rename+0x55/0x2c0 [ 94.432651][ T5317] do_syscall_64+0x166/0x520 [ 94.432666][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.432679][ T5317] [ 94.432683][ T5317] Memory state around the buggy address: [ 94.432691][ T5317] ffff88805232e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.432701][ T5317] ffff88805232e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.432709][ T5317] >ffff88805232e280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.432716][ T5317] ^ [ 94.432724][ T5317] ffff88805232e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.432733][ T5317] ffff88805232e380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.432740][ T5317] ================================================================== [ 94.814890][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.818017][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.821963][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.828481][ T5317] Call Trace: [ 94.830130][ T5317] [ 94.831789][ T5317] vpanic+0x56d/0xa60 [ 94.834007][ T5317] ? __pfx_vpanic+0x10/0x10 [ 94.836568][ T5317] panic+0xc5/0xd0 [ 94.838836][ T5317] ? __pfx_panic+0x10/0x10 [ 94.841032][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.843663][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.846065][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.848628][ T5317] check_panic_on_warn+0x89/0xb0 [ 94.851277][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.853754][ T5317] end_report+0x73/0x170 [ 94.855697][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.858166][ T5317] kasan_report+0x128/0x150 [ 94.860150][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.862918][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.866314][ T5317] kasan_check_range+0x264/0x2c0 [ 94.869150][ T5317] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.871533][ T5317] __asan_memmove+0x29/0x70 [ 94.873627][ T5317] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.876085][ T5317] ext4_xattr_ibody_set+0x262/0x710 [ 94.878212][ T5317] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.881018][ T5317] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.884405][ T5317] ? down_write+0x16b/0x200 [ 94.886934][ T5317] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.890076][ T5317] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.892408][ T5317] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.894717][ T5317] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.897450][ T5317] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.900520][ T5317] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.903149][ T5317] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.905778][ T5317] ? ext4_try_to_write_inline_data+0x49/0x90 [ 94.909012][ T5317] ext4_write_begin+0x3bd/0x1900 [ 94.911772][ T5317] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.914644][ T5317] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 94.917641][ T5317] generic_perform_write+0x2d5/0x8f0 [ 94.920020][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.922370][ T5317] ? __pfx_generic_perform_write+0x10/0x10 [ 94.925340][ T5317] ? file_update_time_flags+0x3ab/0x440 [ 94.928213][ T5317] ext4_buffered_write_iter+0xd4/0x380 [ 94.930717][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.933238][ T5317] ext4_file_write_iter+0xae4/0x1cd0 [ 94.935561][ T5317] ? lock_acquire+0x115/0x350 [ 94.937743][ T5317] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.941201][ T5317] vfs_write+0x612/0xba0 [ 94.943451][ T5317] ? __pfx_vfs_write+0x10/0x10 [ 94.945526][ T5317] ? __fget_files+0x2a/0x420 [ 94.947562][ T5317] __x64_sys_pwrite64+0x196/0x220 [ 94.949928][ T5317] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.952410][ T5317] do_syscall_64+0x166/0x520 [ 94.954582][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.957627][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.961707][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.963862][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.966459][ T5317] RIP: 0033:0x7ff2f079e159 [ 94.968402][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.976408][ T5317] RSP: 002b:00007ff2f1602fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.980221][ T5317] RAX: ffffffffffffffda RBX: 00007ff2f0a25fa0 RCX: 00007ff2f079e159 [ 94.984474][ T5317] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000009 [ 94.987953][ T5317] RBP: 00007ff2f083506b R08: 0000000000000000 R09: 0000000000000000 [ 94.991153][ T5317] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 94.994440][ T5317] R13: 00007ff2f0a26038 R14: 00007ff2f0a25fa0 R15: 00007ffe0277fab8 [ 94.998295][ T5317] [ 95.000376][ T5317] Kernel Offset: disabled [ 95.002181][ T5317] Rebooting in 86400 seconds..