program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") truncate(&(0x7f0000000280)='./file1\x00', 0x1bf8) io_setup(0x1, &(0x7f00000004c0)=0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) creat(&(0x7f0000000180)='./file2\x00', 0x71283578ac7c5cd) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x10d) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x300, r2, &(0x7f0000000140)='i', 0xa800, 0xe00}]) [ 85.318943][ T5283] Bluetooth: hci0: command tx timeout [ 85.336249][ T5324] loop0: detected capacity change from 0 to 512 [ 85.407411][ T5324] EXT4-fs (loop0): 1 truncate cleaned up [ 85.418522][ T5324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.502760][ T5324] loop0: detected capacity change from 512 to 64 [ 85.545029][ T5324] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 85.548887][ T5324] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 85.585332][ T5324] syz.0.0: attempt to access beyond end of device [ 85.585332][ T5324] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 85.585360][ T5324] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 36) [ 85.585493][ T5324] Buffer I/O error on device loop0, logical block 36 [ 85.589184][ T5324] syz.0.0: attempt to access beyond end of device [ 85.589184][ T5324] loop0: rw=2049, sector=54, nr_sectors = 16 limit=64 [ 85.589206][ T5324] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 27) [ 85.589230][ T5324] Buffer I/O error on device loop0, logical block 27 [ 85.589244][ T5324] Buffer I/O error on device loop0, logical block 28 [ 85.589251][ T5324] Buffer I/O error on device loop0, logical block 29 [ 85.589258][ T5324] Buffer I/O error on device loop0, logical block 30 [ 85.589285][ T5324] Buffer I/O error on device loop0, logical block 31 [ 85.635333][ T5324] Buffer I/O error on device loop0, logical block 32 [ 85.635351][ T5324] Buffer I/O error on device loop0, logical block 33 [ 85.635359][ T5324] Buffer I/O error on device loop0, logical block 34 [ 85.649915][ T5324] syz.0.0: attempt to access beyond end of device [ 85.649915][ T5324] loop0: rw=2049, sector=152, nr_sectors = 2 limit=64 [ 85.649934][ T5324] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 76) [ 85.649947][ T5324] Buffer I/O error on device loop0, logical block 76 [ 85.687904][ T1056] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:8: corrupted inode contents [ 85.691314][ T1056] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm kworker/u4:8: mark_inode_dirty error [ 85.703044][ T1056] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm kworker/u4:8: corrupted inode contents [ 85.704594][ T1056] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm kworker/u4:8: mark_inode_dirty error [ 85.754366][ T5324] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #15: comm syz.0.0: corrupted inode contents [ 85.755347][ T5324] EXT4-fs error (device loop0): ext4_dirty_inode:6736: inode #15: comm syz.0.0: mark_inode_dirty error [ 85.757747][ T5324] ------------[ cut here ]------------ [ 85.757756][ T5324] kernel BUG at fs/ext4/mballoc.c:4781! [ 85.757854][ T5324] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 85.774359][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.778102][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.782318][ T5324] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 85.785058][ T5324] Code: e8 76 c1 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 f2 1f 30 ff 90 0f 0b e8 ea 1f 30 ff 90 0f 0b e8 e2 1f 30 ff 90 <0f> 0b e8 da 1f 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 85.792982][ T5324] RSP: 0018:ffffc9000e206840 EFLAGS: 00010283 [ 85.795661][ T5324] RAX: ffffffff8297ffbe RBX: 00000000fffffffb RCX: 0000000000100000 [ 85.798890][ T5324] RDX: ffffc9000ea1a000 RSI: 000000000000906a RDI: 000000000000906b [ 85.802221][ T5324] RBP: 1ffff11008837a98 R08: ffff8880441c1c43 R09: 1ffff11008838388 [ 85.805550][ T5324] R10: dffffc0000000000 R11: ffffed1008838389 R12: 0000000000000000 [ 85.808867][ T5324] R13: 0000000000000022 R14: 1ffff1100883838b R15: ffff8880441c1c58 [ 85.813902][ T5324] FS: 00007f519827b6c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000 [ 85.817702][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.820421][ T5324] CR2: 00007f78b0a53000 CR3: 0000000042dc8000 CR4: 0000000000352ef0 [ 85.823781][ T5324] Call Trace: [ 85.825262][ T5324] [ 85.826531][ T5324] ext4_mb_use_preallocated+0x638/0x13e0 [ 85.828976][ T5324] ext4_mb_new_blocks+0x5a0/0x4530 [ 85.831210][ T5324] ? do_raw_spin_unlock+0x4d/0x200 [ 85.833459][ T5324] ? _raw_spin_unlock+0x28/0x50 [ 85.835598][ T5324] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 85.838038][ T5324] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 85.840245][ T5324] ? ext4_block_to_path+0x382/0x700 [ 85.842161][ T5324] ext4_ind_map_blocks+0xe96/0x22a0 [ 85.844431][ T5324] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 85.846896][ T5324] ? kasan_save_track+0x4f/0x80 [ 85.849054][ T5324] ? __kasan_slab_alloc+0x6c/0x80 [ 85.851230][ T5324] ? down_write+0x16b/0x200 [ 85.853254][ T5324] ext4_map_create_blocks+0xbb/0x530 [ 85.855405][ T5324] ? ext4_fc_track_inode+0xf3/0x3f0 [ 85.857799][ T5324] ext4_map_blocks+0x791/0x12c0 [ 85.860007][ T5324] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 85.862218][ T5324] ? __pfx_ext4_map_blocks+0x10/0x10 [ 85.864438][ T5324] ? kmem_cache_alloc_noprof+0x156/0x600 [ 85.866934][ T5324] ext4_do_writepages+0x1901/0x4770 [ 85.869216][ T5324] ? __lock_acquire+0x747/0x2de0 [ 85.871359][ T5324] ? __pfx_ext4_do_writepages+0x10/0x10 [ 85.873654][ T5324] ? __lock_acquire+0x747/0x2de0 [ 85.875716][ T5324] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 85.878287][ T5324] ? debug_object_free+0x29c/0x340 [ 85.885164][ T5324] ? lock_acquire+0x115/0x350 [ 85.887340][ T5324] ext4_writepages+0x241/0x3b0 [ 85.889462][ T5324] ? __pfx_ext4_writepages+0x10/0x10 [ 85.891576][ T5324] ? __pfx_ext4_writepages+0x10/0x10 [ 85.893622][ T5324] do_writepages+0x338/0x560 [ 85.895382][ T5324] ? do_raw_spin_unlock+0x4d/0x200 [ 85.897422][ T5324] file_write_and_wait_range+0x36e/0x440 [ 85.899652][ T5324] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 85.902284][ T5324] ext4_sync_file+0x252/0xa40 [ 85.904204][ T5324] ext4_buffered_write_iter+0x2d0/0x380 [ 85.906341][ T5324] ext4_file_write_iter+0xae4/0x1cd0 [ 85.908362][ T5324] ? io_submit_one+0x134/0x13d0 [ 85.910343][ T5324] ? kasan_save_track+0x4f/0x80 [ 85.912313][ T5324] ? kasan_save_track+0x3e/0x80 [ 85.914430][ T5324] ? lock_acquire+0x115/0x350 [ 85.916641][ T5324] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 85.919190][ T5324] ? aio_write+0x54a/0x870 [ 85.921189][ T5324] aio_write+0x5d0/0x870 [ 85.922915][ T5324] ? __pfx_aio_write+0x10/0x10 [ 85.927375][ T5324] io_submit_one+0x798/0x13d0 [ 85.929425][ T5324] ? lockdep_hardirqs_on+0x7b/0x110 [ 85.931621][ T5324] ? irqentry_exit+0x218/0x910 [ 85.933663][ T5324] ? __pfx_io_submit_one+0x10/0x10 [ 85.935762][ T5324] ? lock_acquire+0x115/0x350 [ 85.937845][ T5324] ? __might_fault+0xaf/0x130 [ 85.939790][ T5324] __se_sys_io_submit+0x195/0x340 [ 85.942187][ T5324] ? __pfx___se_sys_io_submit+0x10/0x10 [ 85.945073][ T5324] do_syscall_64+0x166/0x520 [ 85.947757][ T5324] ? trace_irq_disable+0x3b/0x140 [ 85.950459][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.953139][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 85.955205][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.957739][ T5324] RIP: 0033:0x7f519739e159 [ 85.959766][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.967818][ T5324] RSP: 002b:00007f519827afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 85.971526][ T5324] RAX: ffffffffffffffda RBX: 00007f5197625fa0 RCX: 00007f519739e159 [ 85.975000][ T5324] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 00007f5198239000 [ 85.978535][ T5324] RBP: 00007f519743506b R08: 0000000000000000 R09: 0000000000000000 [ 85.981913][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.985193][ T5324] R13: 00007f5197626038 R14: 00007f5197625fa0 R15: 00007ffdd18f0708 [ 85.988466][ T5324] [ 85.989746][ T5324] Modules linked in: [ 85.995414][ T5324] ---[ end trace 0000000000000000 ]--- [ 85.997862][ T5324] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 85.997887][ T5324] Code: e8 76 c1 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 f2 1f 30 ff 90 0f 0b e8 ea 1f 30 ff 90 0f 0b e8 e2 1f 30 ff 90 <0f> 0b e8 da 1f 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 85.997898][ T5324] RSP: 0018:ffffc9000e206840 EFLAGS: 00010283 [ 85.997911][ T5324] RAX: ffffffff8297ffbe RBX: 00000000fffffffb RCX: 0000000000100000 [ 85.997919][ T5324] RDX: ffffc9000ea1a000 RSI: 000000000000906a RDI: 000000000000906b [ 85.997927][ T5324] RBP: 1ffff11008837a98 R08: ffff8880441c1c43 R09: 1ffff11008838388 [ 85.997935][ T5324] R10: dffffc0000000000 R11: ffffed1008838389 R12: 0000000000000000 [ 85.997943][ T5324] R13: 0000000000000022 R14: 1ffff1100883838b R15: ffff8880441c1c58 [ 85.997952][ T5324] FS: 00007f519827b6c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000 [ 85.997962][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.997969][ T5324] CR2: 00007f78b0a53000 CR3: 0000000042dc8000 CR4: 0000000000352ef0 [ 85.998007][ T5324] Kernel panic - not syncing: Fatal exception [ 86.040810][ T5324] Kernel Offset: disabled [ 86.042775][ T5324] Rebooting in 86400 seconds..