program:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000c80)='./bus\x00', 0x210000, &(0x7f0000000180)={[{@errors_remount}, {@nombcache}, {@nodioread_nolock}, {@norecovery}, {@sysvgroups}, {@resgid}, {@delalloc}, {@grpid}, {@orlov}]}, 0xfc, 0x58a, &(0x7f00000003c0)="$eJzs3U1rG9caAOB3ZNn5vDcOhHDvXVwMWTQljRzb/Uih0HRZ2tBAu0+FrZhgOQqWHGI30GTRbLopoVBKA6U/oPsuQ/9Af0WgDYQSTLsoBZeRRo5qS5biyLYaPQ9Mco5mxmden3mHc2ZkJoChNZH+k4v4b0R8kUQca1mXj2zlRGO7tSe3ZtMlifX1D39NIsk+a26fZP8fySr/iYgfP4s4k9vabnVldaFYLpeWsvpkbfH6ZHVl9ezVxeJ8ab50bXpm5vxrM9NvvvF632J9+dLvX3/w4N3zn59a++r7R8fvJXEhjmbrWuN4DrdbKxPFP7PSaFzYtOFUHxobJMl+HwA7MpLl+Wik14BjMZJlfTcHdv3IgN32aUSsA0Mqkf8wpJrjgObcvu08+NBej0r2zuN3GhOgeuxjrfHnG/dG4mB9bnR4LfnbzCid7473of20jR9+uX8vXWL7+xCbe+EF7hVgL9y+ExHn8vmt1/8ku/41tLmF29W5Hnab2FTv031YoAcP0vHPK+3Gf7mN8U+0Gf8caZO7O9E9/3OP+tBMR+n4762249+NS9f4SFb7V33MN5pcuVounYuIf0fE6Rg9kNa3e55zfu3heqd1reO/dEnbb44Fs+N4lN90s32uWCtGxNjzxN30+E7E//Lt4k82+j9p0//p7+NSj22cLN3/f6d13ePfXevfRbzUtv+fPtFKtn8+OVk/HyabZ8VWv909+VOn9vc7/rT/D28f/3jS+ry2+uxtfHvwj1KndTs9/8eSj+rlZhLcLNZqS1MRY8n7Wz+ffrpvs97cPo3/9Kntr3/tzv908vVxj/HfPXG346aD0P9zXfr/YFZo9P/GidBz4eF7n3zTqf3e+v/Veul09kl2/WsvO1d6PcDn+d0BAAAAAADAoMlFxNFIcoWNci5XKDS+33EiDufKlWrtzJXK8rW5qP+t7HiM5ppPuo+1fB9iKvs+bLM+vak+ExHHI+LLkUP1emG2Up7b7+ABAAAAAAAAAAAAAAAAAABgQBzp8Pf/qZ9H9vvogF1Xf7GBN3rDUOr6yv9+vOkJGEhd8x94Ycl/GF7yH4aX/IfhJf9heMl/GF7yH4aX/AcAAAAAAAAAAAAAAAAAAAAAAAAAAIC+unTxYrqsrz25NZvW526sLC9UbpydK1UXCovLs4XZytL1wnylMl8uFWYri91+XrlSuT41Hcs3J2ulam2yurJ6ebGyfK12+epicb50uTS6J1EBAAAAAAAAAAAAAAAAAADAP0t1ZXWhWC6XlhQ6Ft6OgTiM3QywYUe75wclCoUOhTtZ9z7bXvt4UQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACATf4KAAD//7ReML8=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58)
open(&(0x7f0000000200)='./bus\x00', 0x14507e, 0x0)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x21000, 0x0)
r1 = open(&(0x7f0000000200)='./bus\x00', 0x0, 0x0)
ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000080)=0x3f)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x2, 0x2, 0x1a, 0x11, "47717926d67afc72171b4284b6fcbd0e66a1b753dca0d45cf272552740cc3e46941564976e3bb0171e6d569c8e7e6067ae3c956810183acbf3bc87a26137b4a4", "e062d232d2f857b8206379e354f25ec6995fb4732ad9182cf99f8160a288d286", [0x7, 0x200]})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
fallocate(r2, 0x0, 0x0, 0x8000c62)
copy_file_range(r0, 0x0, r0, &(0x7f0000000100)=0xae8, 0x863, 0x0)
[ 109.400216][ T4649] Bluetooth: hci0: command tx timeout
[ 109.544015][ T5329] loop0: detected capacity change from 0 to 1024
[ 109.562516][ T5329] EXT4-fs: Ignoring removed orlov option
[ 109.624871][ T5329] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 109.656950][ T24] audit: type=1800 audit(1782681008.849:2): pid=5329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="bus" dev="loop0" ino=18 res=0 errno=0
[ 109.680130][ T5329] Trying to write to read-only block-device loop0
[ 109.727620][ T5329] loop0: detected capacity change from 1024 to 1023
[ 109.744024][ T5330] ==================================================================
[ 109.748137][ T5330] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.751545][ T5330] Read of size 18446744073709551600 at addr ffff88804d4712b8 by task syz.0.0/5330
[ 109.755406][ T5330]
[ 109.756476][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.756496][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.756504][ T5330] Call Trace:
[ 109.756513][ T5330]
[ 109.756520][ T5330] dump_stack_lvl+0xe8/0x150
[ 109.756541][ T5330] print_address_description+0x55/0x1e0
[ 109.756556][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.756574][ T5330] print_report+0x58/0x70
[ 109.756587][ T5330] kasan_report+0x117/0x150
[ 109.756603][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.756618][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.756634][ T5330] kasan_check_range+0x264/0x2c0
[ 109.756647][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.756664][ T5330] __asan_memmove+0x29/0x70
[ 109.756680][ T5330] ext4_xattr_set_entry+0x92b/0x1ed0
[ 109.756704][ T5330] ext4_xattr_ibody_set+0x262/0x710
[ 109.756719][ T5330] ext4_destroy_inline_data_nolock+0x23a/0x5f0
[ 109.756742][ T5330] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10
[ 109.756766][ T5330] ? __asan_memcpy+0x40/0x70
[ 109.756785][ T5330] ? ext4_read_inline_data+0x100/0x2b0
[ 109.756802][ T5330] ext4_convert_inline_data_nolock+0x208/0x980
[ 109.756818][ T5330] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10
[ 109.756834][ T5330] ? down_write+0x16d/0x200
[ 109.756915][ T5330] ext4_convert_inline_data+0x484/0x5c0
[ 109.756937][ T5330] ? __pfx_ext4_convert_inline_data+0x10/0x10
[ 109.756954][ T5330] ? down_write+0x16d/0x200
[ 109.756965][ T5330] ? __pfx_down_write+0x10/0x10
[ 109.756980][ T5330] ext4_fallocate+0x1e2/0x400
[ 109.756998][ T5330] vfs_fallocate+0x65a/0x7e0
[ 109.757011][ T5330] ? __fget_files+0x2a/0x420
[ 109.757026][ T5330] ? __pfx_vfs_fallocate+0x10/0x10
[ 109.757039][ T5330] __x64_sys_fallocate+0xbf/0x110
[ 109.757056][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.757068][ T5330] do_syscall_64+0x174/0x580
[ 109.757081][ T5330] ? trace_irq_disable+0x3b/0x140
[ 109.757092][ T5330] ? clear_bhb_loop+0x40/0x90
[ 109.757105][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.757118][ T5330] RIP: 0033:0x7f692b59ce59
[ 109.757133][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 109.757144][ T5330] RSP: 002b:00007f692c3b0fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 109.757158][ T5330] RAX: ffffffffffffffda RBX: 00007f692b816090 RCX: 00007f692b59ce59
[ 109.757167][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
[ 109.757175][ T5330] RBP: 00007f692b632e6f R08: 0000000000000000 R09: 0000000000000000
[ 109.757183][ T5330] R10: 0000000008000c62 R11: 0000000000000246 R12: 0000000000000000
[ 109.757191][ T5330] R13: 00007f692b816128 R14: 00007f692b816090 R15: 00007ffdfada15f8
[ 109.757201][ T5330]
[ 109.757206][ T5330]
[ 109.882740][ T5330] The buggy address belongs to the physical page:
[ 109.885799][ T5330] page: refcount:3 mapcount:0 mapping:ffff88801cc25940 index:0x2 pfn:0x4d471
[ 109.890049][ T5330] memcg:ffff8880432a4e80
[ 109.891948][ T5330] aops:def_blk_aops ino:700000 dentry name(?):""
[ 109.894927][ T5330] flags: 0x4fff18000004204(referenced|workingset|private|node=1|zone=1|lastcpupid=0x7ff)
[ 109.899554][ T5330] raw: 04fff18000004204 0000000000000000 dead000000000122 ffff88801cc25940
[ 109.903912][ T5330] raw: 0000000000000002 ffff888043f229a0 00000003ffffffff ffff8880432a4e80
[ 109.907592][ T5330] page dumped because: kasan: bad access detected
[ 109.910338][ T5330] page_owner tracks the page as allocated
[ 109.912746][ T5330] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5330, tgid 5328 (syz.0.0), ts 109734189142, free_ts 109605941825
[ 109.921828][ T5330] post_alloc_hook+0x1f9/0x250
[ 109.924108][ T5330] get_page_from_freelist+0x21fa/0x2270
[ 109.926607][ T5330] __alloc_frozen_pages_noprof+0x18d/0x380
[ 109.929123][ T5330] alloc_pages_mpol+0x212/0x380
[ 109.931163][ T5330] alloc_pages_noprof+0xac/0x2a0
[ 109.933269][ T5330] folio_alloc_noprof+0x1e/0x30
[ 109.936076][ T5330] filemap_alloc_folio_noprof+0x111/0x470
[ 109.939200][ T5330] __filemap_get_folio_mpol+0x402/0x1000
[ 109.941822][ T5330] bdev_getblk+0x1f4/0x6e0
[ 109.943808][ T5330] __ext4_get_inode_loc+0x56c/0xf40
[ 109.946050][ T5330] ext4_get_inode_loc+0x81/0xf0
[ 109.948155][ T5330] ext4_convert_inline_data+0x261/0x5c0
[ 109.950538][ T5330] ext4_fallocate+0x1e2/0x400
[ 109.952613][ T5330] vfs_fallocate+0x65a/0x7e0
[ 109.955306][ T5330] __x64_sys_fallocate+0xbf/0x110
[ 109.958347][ T5330] do_syscall_64+0x174/0x580
[ 109.960802][ T5330] page last free pid 75 tgid 75 stack trace:
[ 109.963704][ T5330] free_unref_folios+0xd84/0x14a0
[ 109.965976][ T5330] folio_batch_move_lru+0x877/0xa60
[ 109.968330][ T5330] lru_add_drain_cpu+0xbc/0x750
[ 109.970464][ T5330] lru_add_drain+0x121/0x3e0
[ 109.972457][ T5330] shrink_node+0x24e/0x3b60
[ 109.974401][ T5330] kswapd+0x17b6/0x31c0
[ 109.976240][ T5330] kthread+0x388/0x470
[ 109.978133][ T5330] ret_from_fork+0x514/0xb70
[ 109.981179][ T5330] ret_from_fork_asm+0x1a/0x30
[ 109.984077][ T5330]
[ 109.985615][ T5330] Memory state around the buggy address:
[ 109.988284][ T5330] ffff88804d471180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 109.991824][ T5330] ffff88804d471200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 109.995373][ T5330] >ffff88804d471280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 109.998833][ T5330] ^
[ 110.001925][ T5330] ffff88804d471300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 110.005930][ T5330] ffff88804d471380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 110.009159][ T5330] ==================================================================
[ 110.092441][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 110.095604][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 110.099486][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 110.104949][ T5330] Call Trace:
[ 110.106559][ T5330]
[ 110.107830][ T5330] vpanic+0x56c/0xa60
[ 110.109592][ T5330] ? __pfx_vpanic+0x10/0x10
[ 110.111799][ T5330] panic+0xc5/0xd0
[ 110.113845][ T5330] ? __pfx_panic+0x10/0x10
[ 110.116217][ T5330] ? preempt_schedule_thunk+0x16/0x40
[ 110.118604][ T5330] ? preempt_schedule_thunk+0x16/0x40
[ 110.121473][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.124046][ T5330] check_panic_on_warn+0x89/0xb0
[ 110.126189][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.128509][ T5330] end_report+0x73/0x170
[ 110.130461][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.132961][ T5330] kasan_report+0x128/0x150
[ 110.135143][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.137701][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.140141][ T5330] kasan_check_range+0x264/0x2c0
[ 110.142335][ T5330] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.144726][ T5330] __asan_memmove+0x29/0x70
[ 110.146890][ T5330] ext4_xattr_set_entry+0x92b/0x1ed0
[ 110.149458][ T5330] ext4_xattr_ibody_set+0x262/0x710
[ 110.151694][ T5330] ext4_destroy_inline_data_nolock+0x23a/0x5f0
[ 110.154209][ T5330] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10
[ 110.157143][ T5330] ? __asan_memcpy+0x40/0x70
[ 110.159279][ T5330] ? ext4_read_inline_data+0x100/0x2b0
[ 110.162207][ T5330] ext4_convert_inline_data_nolock+0x208/0x980
[ 110.165238][ T5330] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10
[ 110.168306][ T5330] ? down_write+0x16d/0x200
[ 110.170263][ T5330] ext4_convert_inline_data+0x484/0x5c0
[ 110.172740][ T5330] ? __pfx_ext4_convert_inline_data+0x10/0x10
[ 110.176120][ T5330] ? down_write+0x16d/0x200
[ 110.178337][ T5330] ? __pfx_down_write+0x10/0x10
[ 110.180911][ T5330] ext4_fallocate+0x1e2/0x400
[ 110.183088][ T5330] vfs_fallocate+0x65a/0x7e0
[ 110.185075][ T5330] ? __fget_files+0x2a/0x420
[ 110.187212][ T5330] ? __pfx_vfs_fallocate+0x10/0x10
[ 110.189714][ T5330] __x64_sys_fallocate+0xbf/0x110
[ 110.192043][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.194685][ T5330] do_syscall_64+0x174/0x580
[ 110.196864][ T5330] ? trace_irq_disable+0x3b/0x140
[ 110.199334][ T5330] ? clear_bhb_loop+0x40/0x90
[ 110.201837][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.204813][ T5330] RIP: 0033:0x7f692b59ce59
[ 110.206991][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 110.214881][ T5330] RSP: 002b:00007f692c3b0fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 110.218438][ T5330] RAX: ffffffffffffffda RBX: 00007f692b816090 RCX: 00007f692b59ce59
[ 110.223270][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
[ 110.226656][ T5330] RBP: 00007f692b632e6f R08: 0000000000000000 R09: 0000000000000000
[ 110.230075][ T5330] R10: 0000000008000c62 R11: 0000000000000246 R12: 0000000000000000
[ 110.233508][ T5330] R13: 00007f692b816128 R14: 00007f692b816090 R15: 00007ffdfada15f8
[ 110.237745][ T5330]
[ 110.239542][ T5330] Kernel Offset: disabled
[ 110.241446][ T5330] Rebooting in 86400 seconds..