program: syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@nolazytime}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x46d, &(0x7f00000008c0)="$eJzs3c9vFFUcAPDvTH/w21bFHyBoFY3EH4WWnwcvGE08aGKiB4yn2haCLFRpTYQQrR7waEi8G48m/gWe9GLUk4lXvRsSYriAGs2YmZ0py7JbWLp00f18klnem3nLvO/MvN037+1uA+hbY/lDErExIn6JiJF69toCY/V/rlw6O/3HpbPTSWTZa78nRbnLl85OV0Wr522oZ7KszK9psd9zb0ZM1Wqzp8r8roUT7+yaP33m2WMnpo7OHp09OXnw4N4924f3T+7rSpx5XJe3fjC3bctLb5x/Zfrw+bd++Cqv78Zye2McXbJurH50W3qiyzvrtU0N6WSwhxWhIwMRkZ+uoaL9j8RArFvaNhIvftzTygG3VZZlWav359JiBvyPJdHrGgC9Ub3R5/e/1bJKXY87wsVDEe8eqMd/pVzqWwYjLcsMNd3fdtNYRBxe/PPzfInbMw4BAHCNbw5FxDOt+n9p3N9Q7q5yDmU0Iu6OiHsi4t6I2BwR90UUZR+IiAc73H/zDMn1/Z/0wi0FdpPy/t9z5dzWUv/v76yIvzQ6UOY2FfEPJUeO1WZ3l8dkZwytyfMTy+zj2xd+/rTdtsb+X77k+6/6gnXphcGmAbqZqYWpFYa95OJHEVsHm+IvJFFN4yQRsSUitnb0P2dZWjxGHHvqy23tSt04/mV0YZ4p+yLiyfr5X4ym+CtJ2/nJiQP7J/ftWhu12d1/ZVlWXBXX+/Gnc6+22/+K4u+C/Pyvb77+C0vxjyZrI+ZPnzlezNfOR/MM8Q2d+/WTtvc0t3r9DyevF+nhct37UwsLpyYihpOXG9b/03SXW5abvHrl5PHv3NEq/rR4jauifSgi8ot4e0Q8HBGPlHV/NCIei4gdy8T//fOPv915/MuMyndRHv/Mjc5/NJ7/zhMDx7/7uvP4K/n531ukdpZrbub172YruJJjBwAAAP8VafEZ+CQdX0qn6fh4/TP8m2N9WpubX3j6yNx7J2fqn5UfjaG0Gv8caRgPnSjHhqv85NWhmSK/pxw3/mxgXZEfn56rzfQ4duh3G9q0/9xvA72uHXDb+b4W9C/tH/qX9g/9S/uH/qX9Q/9q1f4/7EE9gNXn/R/6l/YP/Uv7h/6l/UNfavvd+HRFX/mXWIVE+QsNix08q/pRiS7sPdLOnzUYPT1iSQc/DHHnJAa7XufyT3REuWZNy8K9e00CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADopn8DAAD//7kl5Go=") r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/file0\x00', 0x10b442, 0x0) write$FUSE_DIRENT(r0, 0x0, 0xff8b) syz_mount_image$fuse(0x0, &(0x7f00000005c0)='./file1\x00', 0x40000, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f00000001c0), 0x4) r2 = open(&(0x7f0000002280)='./file2\x00', 0x181042, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000200)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7fff, 0x7, 0x7, './file0'}]}}, 0x2a) getpeername$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14) write$P9_RCREATE(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', 0x200041a, &(0x7f0000000f80)=ANY=[@ANYBLOB="6465636f6d706f73652c6e6f626172726965722c6e6c733d69736f383835392d342c0000eb25ba11b788a23b6013ffe5be87fc27664d64fc0e4dd46a49567c77a44ad292e9ed9872dc027d083d66154fe9c6fa40cb8833ec287f8eb2ef9e4c9c6ae7b8da63b8266bd0f93bb7f4b826c2c59bdcfac9aa018a168337d4fddf10b9274d217f93c391628000000000000052ab91faf3e1164568f002f88c10a9ebb50cf5c99b9a9630bd345c1bed71f1f605c74ee209509d4275f16a8a4e18a5eca2dc825655a3f79f25a39e59e97509fb488db249ecae8d5a2341f85ca194d28668ae031384066e9dc4190c4d9bdeeaeb6503"], 0x1, 0x5d6, &(0x7f0000001080)="$eJzs3c9rFO0dAPDv7CabbAp5932NP2oLBgtFFDW7EdtCoWmRkoOI0IvX0KwmuImSrGX1UNLiH2IP6clDL0UoPXjw3IP/QMBjodBj6CVlZmc3q8aYxCS7ef188Nl5Js/Md77zdeYhOxvYAL5as/dieC2SmL1yu5Wub6xPNzbWp5c6/YgYiYhC9i+G0u67iOLziMlot/hhRCR5uORTx3lVe3n+7Z3WpfZaIW/Z9sXd9tubtbzFTJ7kzCHGe/PF8ZLuGaZBb3WCD4Ktz/vvER6+eISx2YfkE/8XlYixiBjN54HOhVs43uwO38DcgAAAAHCEvtmMzWjFeL/zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJMk//7/d+1u9v3+6TKZjKTz/f+l/GeR90+01/1OAAAAAAAAAAAOwYXN2IxWjHfWt5LsM/+L2cpE9vqDeBKrUY+VuBatmItmNGMlqhFR6QlUas01myvVPexZ23HP2gFPYPiA+wEAAAAAAADA98ufY3b7838AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgESUSxvcjaRKdficJQRIxGRCndbi3in53+Sfa63wkAAADAMfhmMzajFeOd9a0ke89/JnvfPxpPYjmasRjNaEQ95rNnAe13/YWN9enGxvr0Uto+jvvr/+wrjSxitJ897HzkqWyL0909ZuO38bu4EpNxN1ZiMf4Qc9GMekzGraw3F0lU8qcXlU6eO+c7897a3c/lei7LpBz3YzHL7Vr8Ph5FI+ajkJ1Dts3uR/xTWp3kV7k91mg+XyYRyY/yMxsMlawiw92KTOW1T6vx7e6V2Od18uGRqlHoPoOaOIKaj+XLtOajA13zWs/Vd2b3SkRcbf79wkJj+eHC/dUrg3NKB/RhJaZ7KnH2q6pEKa9Gexbd32x5Mdt3PBbjTjyK+ajHz+Jm1LI2nS1763p6D/daYX/32k8u5Z3vIpJyezkg0rp+21PX3pmuko31/mS7St8d/ow0dD7vFCOSoW5Og+DDSlR7KnFq90r8ZSt9XW0sP1xZmHu8x+P9NF+mc/PIQM3NpfzqHcrW3r860rFTO45Vs7GJ7ljho7HT3bHP3aml/He4jyPVsrGzO4619zvXM7bTbzkADLyxy2Ol8r/L/yq/KD8vL5Rvj/5m5OcjPy7F8JuhfxT/Vvhr4ZfJ5XgRf9x+/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzc6tNnD+cajfqKztF2xgYjDR2dvXX6PTNxHK43lx5fX3367Ori0tyD+oP68o2pWvXmjeovbly/v9ioT7Vf+50lR2X7pu93JgAAAAAAAAAAAOzHcfw5ab/PEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJNj9l4Mr0US1alrU+n6xvp0I22d/vaWhYgYSpf/iyg+j5iMdotKT7jkU8d5VXt5/u2d1qXtWIXO9sXd9tubtbzFTJ7kzCHGe/PF8ZLuGaZBb3WCQ7/9PwAA//+Gkh7d") mkdirat(0xffffffffffffff9c, &(0x7f0000001680)='./proc\x00', 0x4) mount(0x0, &(0x7f00000016c0)='./proc\x00', &(0x7f0000001700)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000001740)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r4, &(0x7f0000001780)='10', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000017c0)='./dev\x00', 0x1ff) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000300)='./file2\x00', 0x10, &(0x7f00000003c0)=ANY=[@ANYRES8=0x0, @ANYRES64, @ANYRES16], 0x1, 0x25c, &(0x7f0000000600)="$eJzs2k9rXFUYB+D3xkpiSjoR/9GC9KAL6+bSZOVCJEFaEAOKNkIVpLfmRodcZ0LuEBgRGze6ceFHcC0u3QlSceMmGz+BC3fZZNmFeKWdaZuECBlinNI+z2Ze5p3f3HM4h8NZ3J1Xv/10bbXOV4teTGRZTCzEVtzKYjYm4q6tePmlq789/+7V999cXFq69E5KlxevzM2nlM6c//mDz3944Wbv9Hs/nvlpMrZnP9zZ/fLP7We3z+78feWTdp3adep0e6lI17vdXnG9KtNKu17LU3q7Kou6TO1OXW7s669W3fX1fio6KzPT6xtlXaei009rZT/1uqm30U/Fx0W7k/I8TzPTwXEsf3+raWK3efxaZHe/m/kjWpE9mbKnFrJnrmXPbWVnd5umNd6BckLurX/TNE98F6dvWv9Hyp5DfSqi+npzeXN58DnoL65GO6oo42K04q+4vU2GBvXlN5YuXUx3zMZX1Y1h/sbm8mP783PRitnD83ODfNqfn4zpvfn5aMXTh+fnD81PxYUX9+TzaMXvH0U3qliJ29n7+S/mUnr9raUD+XN3fgcA8LDJ0z2H3t/y/N/6g/wI98MD96tTce7UeOdORN3/bK2oqnJDMUpxftTU1DEfOhnjnvLxi8FmuzDceSfxiCaLeBBmeqTi119ee+UBGMawWDh4FIz5YOJ/cX/Rj5qYOtkBAQAAAAAAAAAAcCT/3VuE3wz/cV8rG+XNMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4NH0TwAAAP//vwHHww==") mkdir(&(0x7f0000000880)='./sys_mount\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f0000000d40)='./sys_mount\x00', &(0x7f0000000d80)='sysfs\x00', 0x10000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000dc0)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0) write(r5, &(0x7f0000000e00)='bfq', 0x3) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000e40)='memory.events\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', 0x42, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./file1\x00', 0x183042, 0x25) pwrite64(r7, &(0x7f0000000f00)='2', 0xfdef, 0x10c6b) ioctl$DRM_IOCTL_AGP_ALLOC(r7, 0xc0206434, 0x0) write$binfmt_script(r6, &(0x7f0000000f40), 0xfecc) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000004c0)={'ip_vti0\x00', &(0x7f0000000500)={'syztnl1\x00', r3, 0x40, 0x7800, 0x0, 0x400, {{0x1f, 0x4, 0x2, 0x3a, 0x7c, 0x65, 0x0, 0x80, 0x0, 0x0, @broadcast, @multicast2, {[@cipso={0x86, 0x6, 0x1}, @noop, @lsrr={0x83, 0x1b, 0x7a, [@broadcast, @loopback, @multicast2, @multicast1, @local, @dev={0xac, 0x14, 0x14, 0xf}, @private=0xa010101, @multicast1, @multicast2]}, @cipso={0x86, 0x3f, 0x3, [{0x2, 0x10, "1ff86dec29cb9ad88d5ffbe61b29"}, {0x1, 0xb, "de20862914fec0bcdc"}, {0x0, 0xd, "3188823463b1bdf9638ffb"}, {0x0, 0xffffffffffffffb3, "9f0765fd7e4da22579a1565d1ec93e"}]}, @ra={0x94, 0x4}]}}}}}) [ 94.122967][ T4663] Bluetooth: hci0: command tx timeout [ 94.264942][ T5348] loop0: detected capacity change from 0 to 512 [ 94.288200][ T5348] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 94.313323][ T5348] EXT4-fs (loop0): 1 truncate cleaned up [ 94.316536][ T5348] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.378443][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 4294901760 (level 0) [ 94.380173][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 2185560079 (level 0) [ 94.381853][ T5348] EXT4-fs error (device loop0): ext4_free_branches:1040: inode #13: comm syz.0.0: invalid indirect mapped block 65535 (level 2) [ 94.460318][ T5349] EXT4-fs error (device loop0): ext4_find_dest_de:2052: inode #2: block 13: comm syz.0.0: bad entry in directory: directory entry overrun - offset=92, inode=0, rec_len=1024, size=1024 fake=0 [ 94.461503][ T5349] EXT4-fs error (device loop0): ext4_validate_block_bitmap:436: comm syz.0.0: bg 0: block 18: invalid block bitmap [ 94.462847][ T5349] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6678: Corrupt filesystem [ 94.463189][ T5349] EXT4-fs error (device loop0): ext4_read_inode_bitmap:141: comm syz.0.0: Invalid inode bitmap blk 65548 in block_group 0 [ 94.464386][ T5349] EXT4-fs error (device loop0) in ext4_free_inode:363: Corrupt filesystem [ 94.502447][ T5349] ================================================================== [ 94.502478][ T5349] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502633][ T5349] Read of size 18446744073709551600 at addr ffff888053e1d6b8 by task syz.0.0/5349 [ 94.502658][ T5349] [ 94.502678][ T5349] CPU: 0 UID: 0 PID: 5349 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.502693][ T5349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.502701][ T5349] Call Trace: [ 94.502708][ T5349] [ 94.502715][ T5349] dump_stack_lvl+0xe8/0x150 [ 94.502737][ T5349] print_address_description+0x55/0x1e0 [ 94.502758][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502774][ T5349] print_report+0x58/0x70 [ 94.502791][ T5349] kasan_report+0x117/0x150 [ 94.502822][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502839][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502853][ T5349] kasan_check_range+0x264/0x2c0 [ 94.502869][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502885][ T5349] __asan_memmove+0x29/0x70 [ 94.502899][ T5349] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.502921][ T5349] ext4_xattr_ibody_set+0x262/0x710 [ 94.502938][ T5349] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.502955][ T5349] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.502971][ T5349] ? down_write+0x166/0x200 [ 94.503062][ T5349] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 94.503080][ T5349] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.503099][ T5349] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.503119][ T5349] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.503143][ T5349] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.503163][ T5349] ? ext4_file_write_iter+0xae4/0x1cd0 [ 94.503178][ T5349] ? __x64_sys_pwrite64+0x210/0x2c0 [ 94.503196][ T5349] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 94.503212][ T5349] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.503230][ T5349] ? ext4_try_to_write_inline_data+0x49/0x90 [ 94.503250][ T5349] ext4_write_begin+0x3bd/0x1900 [ 94.503269][ T5349] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.503283][ T5349] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.503297][ T5349] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 94.503319][ T5349] generic_perform_write+0x2d5/0x8e0 [ 94.503341][ T5349] ? __pfx_generic_perform_write+0x10/0x10 [ 94.503367][ T5349] ? ext4_write_checks+0x1b7/0x220 [ 94.503383][ T5349] ext4_buffered_write_iter+0x139/0x540 [ 94.503400][ T5349] ext4_file_write_iter+0xae4/0x1cd0 [ 94.503419][ T5349] ? lock_acquire+0x115/0x350 [ 94.503450][ T5349] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.503471][ T5349] vfs_write+0x612/0xba0 [ 94.503487][ T5349] ? __pfx_vfs_write+0x10/0x10 [ 94.503504][ T5349] ? __fget_files+0x2a/0x420 [ 94.503519][ T5349] ? fdget+0x1ac/0x250 [ 94.503532][ T5349] __x64_sys_pwrite64+0x210/0x2c0 [ 94.503549][ T5349] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.503568][ T5349] do_syscall_64+0x166/0x520 [ 94.503583][ T5349] ? trace_irq_disable+0x3b/0x140 [ 94.503600][ T5349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.503612][ T5349] ? clear_bhb_loop+0x70/0xc0 [ 94.503625][ T5349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.503637][ T5349] RIP: 0033:0x7f934419fb19 [ 94.503659][ T5349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.503670][ T5349] RSP: 002b:00007f9344fedfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.503685][ T5349] RAX: ffffffffffffffda RBX: 00007f9344426090 RCX: 00007f934419fb19 [ 94.503695][ T5349] RDX: 000000000000fdef RSI: 0000200000000f00 RDI: 0000000000000009 [ 94.503703][ T5349] RBP: 00007f9344237b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.503711][ T5349] R10: 0000000000010c6b R11: 0000000000000246 R12: 0000000000000000 [ 94.503719][ T5349] R13: 00007f9344426128 R14: 00007f9344426090 R15: 00007ffe7ca8aff8 [ 94.503734][ T5349] [ 94.503739][ T5349] [ 94.503742][ T5349] The buggy address belongs to the physical page: [ 94.503749][ T5349] page: refcount:2 mapcount:0 mapping:ffff88801e825940 index:0xc pfn:0x53e1d [ 94.503760][ T5349] memcg:ffff88803bedd700 [ 94.503768][ T5349] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.503896][ T5349] flags: 0x4fff58000000234(referenced|dirty|lru|workingset|node=1|zone=1|lastcpupid=0x7ff) [ 94.503914][ T5349] raw: 04fff58000000234 ffffea00014f6508 ffffea00014f8708 ffff88801e825940 [ 94.503926][ T5349] raw: 000000000000000c ffff8880454aaa80 00000002ffffffff ffff88803bedd700 [ 94.503932][ T5349] page dumped because: kasan: bad access detected [ 94.503939][ T5349] page_owner tracks the page as allocated [ 94.503943][ T5349] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5349, tgid 5347 (syz.0.0), ts 94457062055 [ 94.503963][ T5349] post_alloc_hook+0x1f9/0x250 [ 94.503975][ T5349] get_page_from_freelist+0x220f/0x2280 [ 94.503988][ T5349] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 94.504003][ T5349] alloc_pages_mpol+0x21e/0x390 [ 94.504019][ T5349] alloc_pages_noprof+0xb1/0x2b0 [ 94.504035][ T5349] folio_alloc_noprof+0x1e/0x30 [ 94.504051][ T5349] filemap_alloc_folio_noprof+0x111/0x460 [ 94.504063][ T5349] __filemap_get_folio_mpol+0x3fd/0xff0 [ 94.504077][ T5349] bdev_getblk+0x1ec/0x670 [ 94.504094][ T5349] __ext4_get_inode_loc+0x56c/0xf40 [ 94.504109][ T5349] ext4_reserve_inode_write+0x18b/0x360 [ 94.504125][ T5349] __ext4_mark_inode_dirty+0x141/0x7e0 [ 94.504137][ T5349] ext4_mkdir+0x4ea/0xce0 [ 94.504149][ T5349] vfs_mkdir+0x411/0x660 [ 94.504164][ T5349] filename_mkdirat+0x284/0x550 [ 94.504177][ T5349] __se_sys_mkdirat+0x35/0x150 [ 94.504190][ T5349] page last free pid 5349 tgid 5347 ts 94453788605 stack trace: [ 94.504199][ T5349] free_unref_folios+0xdc6/0x14e0 [ 94.504210][ T5349] folios_put_refs+0x9e9/0xb30 [ 94.504225][ T5349] shmem_undo_range+0x547/0x15d0 [ 94.504236][ T5349] shmem_evict_inode+0x240/0xb00 [ 94.504252][ T5349] evict+0x624/0xb50 [ 94.504266][ T5349] dentry_kill+0x1b9/0x910 [ 94.504281][ T5349] finish_dput+0x1a/0x260 [ 94.504291][ T5349] __fput+0x65b/0xa40 [ 94.504301][ T5349] fput_close_sync+0x11f/0x240 [ 94.504312][ T5349] __se_sys_close+0xa2/0x160 [ 94.504323][ T5349] do_syscall_64+0x166/0x520 [ 94.504337][ T5349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.504356][ T5349] [ 94.504359][ T5349] Memory state around the buggy address: [ 94.504366][ T5349] ffff888053e1d580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.504375][ T5349] ffff888053e1d600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.504383][ T5349] >ffff888053e1d680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.504389][ T5349] ^ [ 94.504396][ T5349] ffff888053e1d700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.504405][ T5349] ffff888053e1d780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.504411][ T5349] ================================================================== [ 94.504473][ T5349] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.785207][ T5349] CPU: 0 UID: 0 PID: 5349 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.788958][ T5349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.793206][ T5349] Call Trace: [ 94.794793][ T5349] [ 94.796045][ T5349] vpanic+0x26f/0x710 [ 94.797850][ T5349] panic+0xc5/0xd0 [ 94.799525][ T5349] ? __pfx_panic+0x10/0x10 [ 94.801454][ T5349] ? preempt_schedule_thunk+0x16/0x40 [ 94.803717][ T5349] ? preempt_schedule_thunk+0x16/0x40 [ 94.805976][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.808361][ T5349] check_panic_on_warn+0x89/0xb0 [ 94.810483][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.812837][ T5349] end_report+0x73/0x170 [ 94.814697][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.817022][ T5349] kasan_report+0x128/0x150 [ 94.819008][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.821466][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.823842][ T5349] kasan_check_range+0x264/0x2c0 [ 94.826055][ T5349] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.828461][ T5349] __asan_memmove+0x29/0x70 [ 94.830463][ T5349] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.832750][ T5349] ext4_xattr_ibody_set+0x262/0x710 [ 94.835115][ T5349] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.837738][ T5349] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.840555][ T5349] ? down_write+0x166/0x200 [ 94.842431][ T5349] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 94.844717][ T5349] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.846869][ T5349] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.849100][ T5349] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.851733][ T5349] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.854404][ T5349] ? ext4_file_write_iter+0xae4/0x1cd0 [ 94.856515][ T5349] ? __x64_sys_pwrite64+0x210/0x2c0 [ 94.858550][ T5349] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 94.860835][ T5349] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.863223][ T5349] ? ext4_try_to_write_inline_data+0x49/0x90 [ 94.865674][ T5349] ext4_write_begin+0x3bd/0x1900 [ 94.867725][ T5349] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.869955][ T5349] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.872159][ T5349] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 94.875027][ T5349] generic_perform_write+0x2d5/0x8e0 [ 94.877333][ T5349] ? __pfx_generic_perform_write+0x10/0x10 [ 94.879845][ T5349] ? ext4_write_checks+0x1b7/0x220 [ 94.881971][ T5349] ext4_buffered_write_iter+0x139/0x540 [ 94.884342][ T5349] ext4_file_write_iter+0xae4/0x1cd0 [ 94.886585][ T5349] ? lock_acquire+0x115/0x350 [ 94.888343][ T5349] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.890769][ T5349] vfs_write+0x612/0xba0 [ 94.892609][ T5349] ? __pfx_vfs_write+0x10/0x10 [ 94.894678][ T5349] ? __fget_files+0x2a/0x420 [ 94.896687][ T5349] ? fdget+0x1ac/0x250 [ 94.898486][ T5349] __x64_sys_pwrite64+0x210/0x2c0 [ 94.900648][ T5349] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.903046][ T5349] do_syscall_64+0x166/0x520 [ 94.905058][ T5349] ? trace_irq_disable+0x3b/0x140 [ 94.907173][ T5349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.909749][ T5349] ? clear_bhb_loop+0x70/0xc0 [ 94.911769][ T5349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.914262][ T5349] RIP: 0033:0x7f934419fb19 [ 94.916198][ T5349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.924333][ T5349] RSP: 002b:00007f9344fedfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.927985][ T5349] RAX: ffffffffffffffda RBX: 00007f9344426090 RCX: 00007f934419fb19 [ 94.931389][ T5349] RDX: 000000000000fdef RSI: 0000200000000f00 RDI: 0000000000000009 [ 94.934736][ T5349] RBP: 00007f9344237b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.938008][ T5349] R10: 0000000000010c6b R11: 0000000000000246 R12: 0000000000000000 [ 94.941318][ T5349] R13: 00007f9344426128 R14: 00007f9344426090 R15: 00007ffe7ca8aff8 [ 94.944460][ T5349] [ 94.946260][ T5349] Kernel Offset: disabled [ 94.948064][ T5349] Rebooting in 86400 seconds..