program: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a400000009060102000000000000000007000008080009400000000288000880100007800c0019400000000000000007100007800c00148008000140e00000010c000780080006406dd873f2100007800c0018400000000000000008100007800c0019400000007f4c5fd991cc9400000000020c00078008000940000000090c0007800500030006000000100007800c001b400000000000000003100007800a00110012"], 0xa4}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040000) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x10, &(0x7f0000000140)={[{@norecovery}]}, 0xed, 0x474, &(0x7f0000000b80)="$eJzs3EtsG0UfAPD/rvNo+viSr5RHSwuBgqh4JE36oAcuIJA4gIQEhyJOIUmrUrdBTZBoVUHhUI6oEnfEEYk7Eie4IOCAkLjCHVWqql5aOBmtvZs6jp06tRu3+PeT1p7ZXWfm79mxxzN2Auhb49lNErE1Iv6IiNFaduUJ47W7G9fOz/597fxsEpXKm1eT6nnXr52fLU4tHrellqlUIoaz5HCTci++EzFTLs+fyfOTS6fen1w8e+65E6dmjs8fnz89feTIwQN7hg5PH+oovjS/z+K6vuujhd07X3370uuzRy+9+/M3WX235sfr47gtWbQNxmvPbqNHs5snOyrsrvJrdrOtbkcy0PrkiQ2oEO0rRUTWXIPV/j8apRhZPjYar3za08oBd1SlUqk0e3/OXagA/2FJ9LoGQG8Ub/TZ599i26Chx13hyou1D0BZ3DfyrXZkYHnuYLDh8203jUfE0Qv/fJlt0Y15CACAW/g+G/8822z8l8YDdef9L19DGYuI/0fE9oi4LyJ2RMT9EdVzH4yIh9ZZfuMKyerxT3r5tgJrUzb+eyFf21o5/itGfzFWynPbqvEPJsdOlOf358/JvhgczvJTa5Txw8u/f16kNzUcqx//ZVtWfjEWzOtxeaBhgm5uZmmm07gLVz6J2DXQLP4kimWcJCJ2RsSu2yzjxNNf72517Nbxr2GNdaZ2Vb6KeKrW/hdiRfw3myppuT459fzh6UOTm6I8v3+yuCpW++W3i2+0Kr+j+Lsga//NTa//5VXgsWRTxOLZcyer67WL6y/j4p+f1fXpFavLWfzptxHrvv6Hkreq6aF834czS0tnpiKGktdW75+++dgiX5yfxb9vb/P+v72uxg9HRHYR74mIR/JF3KztHouIxyNi7xrx//TSE++1Oraq/UeK+NeYle+iLP65W7V/1Lf/+hOlkz9+13b8Tdv/YDW1L9/TzutfuxXs5LkDAACAe0Va/Q58kk4sp9N0YqL2Hf4dsTktLywuPXNs4YPTc7Xvyo/FYFrMdI3WzYdO5XPDRX66IX8gnzf+ojRSzU/MLpTneh089LktLfp/5q9Sr2sH3HFdWEcD7lH6P/Qv/R/6l/4P/Uv/h/7VrP9/3IN6ABvP+z/0L/0f+pf+D/1L/4e+1PK38WlHP/nvcaL43wkd/J2rvY+i48TInSwi0t4H2BeJgU4u43YSw00P9fiFCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoEv+DQAA//9L2OJW") r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) prlimit64(0x0, 0xf, &(0x7f00000000c0)={0x8, 0x102}, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x1, 0x0, 0x0, 0x0, 0x3, 0xa0531, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0xb27, 0x2}, 0x200010, 0x10002, 0x20da, 0x5, 0xa, 0x20005, 0x28, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r3 = semget$private(0x0, 0x4000000009, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) semop(r3, &(0x7f0000001480)=[{0x0, 0x2, 0x1000}, {}], 0x2) r4 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x2c93a000) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r5 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x11) pwritev2(r6, &(0x7f0000000cc0)=[{&(0x7f0000000240)=';', 0xffffffbc}], 0x1, 0xfff, 0xc, 0x4) [ 94.834400][ T5284] Bluetooth: hci0: command tx timeout [ 94.941538][ T5327] loop0: detected capacity change from 0 to 512 [ 94.960329][ T5327] EXT4-fs (loop0): invalid journal inode [ 94.967597][ T5327] EXT4-fs (loop0): can't get journal size [ 94.990949][ T5327] EXT4-fs (loop0): 1 truncate cleaned up [ 94.994520][ T5327] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.148298][ T5332] loop0: detected capacity change from 512 to 64 [ 95.208128][ T5332] syz.0.0: attempt to access beyond end of device [ 95.208128][ T5332] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 95.213431][ T5332] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 36) [ 95.227121][ T5332] Buffer I/O error on device loop0, logical block 36 [ 95.230575][ T5332] syz.0.0: attempt to access beyond end of device [ 95.230575][ T5332] loop0: rw=2049, sector=78, nr_sectors = 2 limit=64 [ 95.241687][ T5332] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 39) [ 95.247099][ T5332] Buffer I/O error on device loop0, logical block 39 [ 95.251358][ T5332] syz.0.0: attempt to access beyond end of device [ 95.251358][ T5332] loop0: rw=2049, sector=80, nr_sectors = 16 limit=64 [ 95.258662][ T5332] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 15 starting block 40) [ 95.263322][ T5332] Buffer I/O error on device loop0, logical block 40 [ 95.266156][ T5332] Buffer I/O error on device loop0, logical block 41 [ 95.269386][ T5332] Buffer I/O error on device loop0, logical block 42 [ 95.272748][ T5332] Buffer I/O error on device loop0, logical block 43 [ 95.277694][ T5332] Buffer I/O error on device loop0, logical block 44 [ 95.280422][ T5332] Buffer I/O error on device loop0, logical block 45 [ 95.283074][ T5332] Buffer I/O error on device loop0, logical block 46 [ 95.285876][ T5332] Buffer I/O error on device loop0, logical block 47 [ 95.397548][ T5332] ------------[ cut here ]------------ [ 95.401638][ T5332] kernel BUG at fs/ext4/mballoc.c:4780! [ 95.404684][ T5332] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 95.407526][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.411430][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.415887][ T5332] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.418603][ T5332] Code: e8 b6 81 a3 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 02 51 34 ff 90 0f 0b e8 fa 50 34 ff 90 0f 0b e8 f2 50 34 ff 90 <0f> 0b e8 ea 50 34 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.426174][ T5332] RSP: 0018:ffffc9000e6c66a0 EFLAGS: 00010283 [ 95.428745][ T5332] RAX: ffffffff8292d35e RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.432119][ T5332] RDX: ffffc90020802000 RSI: 000000000000d653 RDI: 000000000000d654 [ 95.435523][ T5332] RBP: 1ffff11008792aef R08: ffff888043c99efb R09: 1ffff110087933df [ 95.438677][ T5332] R10: dffffc0000000000 R11: ffffed10087933e0 R12: 0000000000000000 [ 95.441641][ T5332] R13: 0000000000000074 R14: 1ffff110087933e2 R15: ffff888043c99f10 [ 95.444763][ T5332] FS: 00007f99331d46c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 95.448620][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.451579][ T5332] CR2: 00007fed7ab81000 CR3: 000000004099e000 CR4: 0000000000352ef0 [ 95.455630][ T5332] Call Trace: [ 95.457231][ T5332] [ 95.458470][ T5332] ext4_mb_use_preallocated+0x638/0x13e0 [ 95.460878][ T5332] ext4_mb_new_blocks+0x5a0/0x4530 [ 95.463251][ T5332] ? rcu_is_watching+0x15/0xb0 [ 95.465244][ T5332] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 95.467837][ T5332] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 95.470496][ T5332] ? ext4_block_to_path+0x382/0x700 [ 95.473114][ T5332] ext4_ind_map_blocks+0xe96/0x22a0 [ 95.475345][ T5332] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 95.477613][ T5332] ? kasan_save_track+0x4f/0x80 [ 95.479593][ T5332] ? ext4_map_blocks+0x7cc/0x1240 [ 95.481707][ T5332] ? down_write+0x16d/0x200 [ 95.484070][ T5332] ext4_map_create_blocks+0xbb/0x530 [ 95.486744][ T5332] ? ext4_fc_track_inode+0xf3/0x3f0 [ 95.489424][ T5332] ext4_map_blocks+0x7e4/0x1240 [ 95.492100][ T5332] ? __pfx_ext4_map_blocks+0x10/0x10 [ 95.494892][ T5332] ? __ext4_journal_ensure_credits+0x30/0x450 [ 95.497833][ T5332] ext4_do_writepages+0x19e3/0x47a0 [ 95.500118][ T5332] ? __lock_acquire+0x683/0x2cf0 [ 95.502298][ T5332] ? __pfx_ext4_do_writepages+0x10/0x10 [ 95.504745][ T5332] ? __lock_acquire+0x683/0x2cf0 [ 95.506893][ T5332] ? __free_object+0x432/0x5d0 [ 95.508914][ T5332] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.511129][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.513633][ T5332] ? debug_object_free+0x29c/0x340 [ 95.515867][ T5332] ? ext4_writepages+0x205/0x3b0 [ 95.518121][ T5332] ? ext4_writepages+0x205/0x3b0 [ 95.520245][ T5332] ext4_writepages+0x241/0x3b0 [ 95.522342][ T5332] ? __pfx_ext4_writepages+0x10/0x10 [ 95.524743][ T5332] ? __pfx_ext4_writepages+0x10/0x10 [ 95.527056][ T5332] do_writepages+0x338/0x560 [ 95.529107][ T5332] ? do_raw_spin_unlock+0x4d/0x210 [ 95.531354][ T5332] file_write_and_wait_range+0x36e/0x440 [ 95.533808][ T5332] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 95.536326][ T5332] ? __folio_put+0x4b3/0x590 [ 95.538471][ T5332] ? __pfx_ext4_write_begin+0x10/0x10 [ 95.540742][ T5332] mmb_fsync_noflush+0x73/0x1d0 [ 95.542724][ T5332] ext4_sync_file+0x41a/0xd00 [ 95.544830][ T5332] ? __pfx_ext4_sync_file+0x10/0x10 [ 95.547128][ T5332] ? ext4_buffered_write_iter+0xd6/0x370 [ 95.549997][ T5332] ? sync_lazytime+0x5a/0x4c0 [ 95.552160][ T5332] ext4_buffered_write_iter+0x2c7/0x370 [ 95.554632][ T5332] ext4_file_write_iter+0x947/0x1c70 [ 95.556966][ T5332] ? __lock_acquire+0x683/0x2cf0 [ 95.558998][ T5332] ? __futex_wait+0x358/0x400 [ 95.560843][ T5332] ? __pfx_aa_file_perm+0x10/0x10 [ 95.562752][ T5332] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.564939][ T5332] ? __pfx___futex_wait+0x10/0x10 [ 95.567007][ T5332] do_iter_readv_writev+0x612/0x8c0 [ 95.569089][ T5332] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 95.571355][ T5332] vfs_writev+0x343/0x990 [ 95.573329][ T5332] ? __pfx_vfs_writev+0x10/0x10 [ 95.575426][ T5332] ? __fget_files+0x2a/0x420 [ 95.577200][ T5332] ? __fget_files+0x3a2/0x420 [ 95.579178][ T5332] ? __fget_files+0x2a/0x420 [ 95.581263][ T5332] __se_sys_pwritev2+0x177/0x2a0 [ 95.583240][ T5332] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 95.585409][ T5332] ? __x64_sys_pwritev2+0x20/0xc0 [ 95.587441][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.589883][ T5332] do_syscall_64+0x174/0x580 [ 95.591891][ T5332] ? trace_irq_disable+0x3b/0x140 [ 95.594091][ T5332] ? clear_bhb_loop+0x40/0x90 [ 95.596157][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.598702][ T5332] RIP: 0033:0x7f9936d9df99 [ 95.600705][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.608713][ T5332] RSP: 002b:00007f99331d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 95.612188][ T5332] RAX: ffffffffffffffda RBX: 00007f9937026180 RCX: 00007f9936d9df99 [ 95.615680][ T5332] RDX: 0000000000000001 RSI: 0000200000000cc0 RDI: 000000000000000b [ 95.619069][ T5332] RBP: 00007f9936e34ec4 R08: 000000000000000c R09: 0000000000000004 [ 95.622540][ T5332] R10: 0000000000000fff R11: 0000000000000246 R12: 0000000000000000 [ 95.626006][ T5332] R13: 00007f9937026218 R14: 00007f9937026180 R15: 00007fffe39359b8 [ 95.629415][ T5332] [ 95.630808][ T5332] Modules linked in: [ 95.633041][ T5332] ---[ end trace 0000000000000000 ]--- [ 95.635637][ T5332] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 95.638322][ T5332] Code: e8 b6 81 a3 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 02 51 34 ff 90 0f 0b e8 fa 50 34 ff 90 0f 0b e8 f2 50 34 ff 90 <0f> 0b e8 ea 50 34 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 95.646226][ T5332] RSP: 0018:ffffc9000e6c66a0 EFLAGS: 00010283 [ 95.648979][ T5332] RAX: ffffffff8292d35e RBX: 00000000fffffffe RCX: 0000000000100000 [ 95.652424][ T5332] RDX: ffffc90020802000 RSI: 000000000000d653 RDI: 000000000000d654 [ 95.655831][ T5332] RBP: 1ffff11008792aef R08: ffff888043c99efb R09: 1ffff110087933df [ 95.659665][ T5332] R10: dffffc0000000000 R11: ffffed10087933e0 R12: 0000000000000000 [ 95.663026][ T5332] R13: 0000000000000074 R14: 1ffff110087933e2 R15: ffff888043c99f10 [ 95.666603][ T5332] FS: 00007f99331d46c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 95.670343][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.673197][ T5332] CR2: 00007fed7ab81000 CR3: 000000004099e000 CR4: 0000000000352ef0 [ 95.676714][ T5332] Kernel panic - not syncing: Fatal exception [ 95.679696][ T5332] Kernel Offset: disabled [ 95.681553][ T5332] Rebooting in 86400 seconds..