program:
syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x8004, &(0x7f00000002c0)={[{@discard}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4}}, {@norecovery}]}, 0x1, 0x7b9, &(0x7f00000007c0)="$eJzs3d9rHNUeAPDvbJLmR3tvcuFy7+1b4EJvoHRzU2Or4EPFBxEsFPTZNmy2oWaTLdlNaULAFhF8EVR8EPSlz/6ob776A3zS/8IHaamaFis+SGR2Z5M02c2vJtloPh+YzDkzsznnO+fMzNmdYTeAQ2sw/ZOLOB4RbycR/dnyJCK6aqnOiHP17R4uLvRERCGJpaWXfkpq2zxYXCjEqtekjmaZ/0TEV29EnMytL7cyNz85VioVZ7L8cHXq6nBlbv7UlamxieJEcfrMyOjo6bNPnj2ze7H+8t38sbvvPP+/T8/99vq/b7/1dRLn4li2bnUcu2UwBrN90pXuwkc8t9uFtVnS7gqwI+mh2VE/yuN49EdHLdVC737WDADYK69FxBIAcMgkrv8AcMg0Pgd4sLhQaEzt/URif917NiJ66vE/zKb6ms7snl1P7T5o34PkkTsjSUQM7EL5gxHx4eevnOjI8mk93EsD9sONmxFxaWBw/fk/WffMwnb9f6OVS9212eCaxYft+gPt9EU6/nmq2fgvtzz+iSbjn+76sfuvxy1/8+M/d+dxy9hIOv57pv5s25rx3/JDawMdWe5vtTFfV3L5SqmYntv+HhFD0dWd5kdqmzYfuQ3d//1+q/Kz8d/H6fTzu69+lJafzle2yN3p7H70NeNj1c5vHjfwzL2b0Zcl18SfLLd/0mL8e2GLZbzw9JsftFqXxp/G25jWx7+3lm5FnGja/ittmWz4fOJwrTsMNzpFE599/35fq/JXt386peWn892PtLl7N6PWAZJkZR/U1yzHP5Csfl6zsv0yvr3V/2WrdZvH37T/jx1JXq6lj2TLro9VqzMjEUeSF9cvP73y2ka+sX0a/9B/mx//9WKb9//0PeGlLcbfeffHT3Ye/95K4x/fuP+vaf+ebPHKks0Stx9OdrQqf2vtP1pLDWVL0vbfLK6t1GtnvRkAAAAAAAAAAAAAAAAAAAAAAAAAti8XEcciyeWX07lcPl//De9/Rl+uVK5UT14uz06PR+23sgeiK9f4qsv+Vd+HOpJ9H34jf3pN/omI+EdEvNfdW8vnC+XSeLuDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM0Ra//5/6obvdtQMA9kxPuysAAOw7138AOHy2d/3v3bN6AAD7x/t/ADh8tnz9v7S39QAA9o/3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyxC+fPp9PSr4sLhTQ/fm1udrJ87dR4sTKZn5ot5Avlmav5iXJ5olTMF8pTLf/RjfqsVC5fHY3p2evD1WKlOlyZm784VZ6drl68MjU2UbxY7Nq3yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg6ypz85NjpVJx5i+RuLES2C7/5962xtV3MHbvqkRnHIhqHOhEdxyIauwwsfos0duGMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn8MfAQAA//94WBdi")
msgget$private(0x0, 0x208)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101142, 0x14)
r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x800)
ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x15, 0x5, "ef359f418ab93852f7d6a4ae6dddfbd14e5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f20000000000d3ef0000014000000000f3ff0900", [0x100000008]})
pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c)
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x1000000, &(0x7f0000000400)={[{@nouser_xattr}]}, 0x1, 0x17e, &(0x7f0000000240)="$eJzsmDFP8kAYx/935YW8xvgBXBwkEWMsbVHDwoCJu4mocZNIJWgBAzUREgc/gKODiYuDX8DRycFvoYM6uTA61/TuoCcR0EET4/MbHn5Hnx7Xh+Q/FARB/Fmen14fT5ezBQPAOJJIqO9fjKiHa/0P54dzZ7mVi+v7q7vaxPFN/34MQBB8/vdjAG7zBny1DoL3dyfVZwG85+vgmFW+CQZT+TY4NpS7YNhSvqd5Pew3zd2K55o7da8UihUWOyxOWDL95+ucMJS08zHterPV3i96ntv4Rhk1v06eI6edT/+/urOxtPnZ4LCVZ8CwpjyLRHc2ciTa80/Gov2NH35+EhKS3yZRPgWXDDNaPsW0/Ej71YN0s9Wer1SLZbfs1hwns2QtWNaikxZBJOuQ/Psv8mlM2//fgN44i+Oo6PsNW9be2pH1o8TlIv84UtNyHWZ/fOBp5HWm7mPCUsaQdoIgCIIgCIIgCIIgCIIgiC8wBSbego7AWRXdbwEAAP//gYN3SA==")
llistxattr(&(0x7f0000000180)='./file1\x00', 0x0, 0x2)
keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0)
r2 = add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe)
ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000000))
add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$read(0xb, r2, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
[ 94.827154][ T5284] Bluetooth: hci0: command tx timeout
[ 94.956525][ T5326] loop0: detected capacity change from 0 to 2048
[ 95.051646][ T5326] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 95.134871][ T5326] loop0: detected capacity change from 2048 to 64
[ 95.148226][ T5326] EXT4-fs error (device loop0): xattr_find_entry:337: inode #15: comm syz.0.0: corrupted xattr entries
[ 95.159976][ T5326] EXT4-fs error (device loop0): get_max_inline_xattr_value_size:74: inode #15: comm syz.0.0: corrupt xattr in inline inode
[ 95.171129][ T5326] EXT4-fs error (device loop0): xattr_find_entry:337: inode #15: comm syz.0.0: corrupted xattr entries
[ 95.179546][ T5326] EXT4-fs error (device loop0): ext4_map_blocks:833: inode #15: block 1803188595: comm syz.0.0: lblock 0 mapped to illegal pblock 1803188595 (length 1)
[ 95.188288][ T5326] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117
[ 95.196770][ T5327] ==================================================================
[ 95.199968][ T5327] BUG: KASAN: use-after-free in ext4_xattr_list_entries+0x302/0x3d0
[ 95.202914][ T5327] Read of size 4 at addr ffff88804d4ff014 by task syz.0.0/5327
[ 95.205776][ T5327]
[ 95.206794][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.206807][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.206811][ T5327] Call Trace:
[ 95.206816][ T5327]
[ 95.206820][ T5327] dump_stack_lvl+0xe8/0x150
[ 95.206834][ T5327] print_address_description+0x55/0x1e0
[ 95.206844][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.206856][ T5327] print_report+0x58/0x70
[ 95.206868][ T5327] kasan_report+0x117/0x150
[ 95.206887][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.206901][ T5327] ext4_xattr_list_entries+0x302/0x3d0
[ 95.206916][ T5327] ? ext4_get_inode_loc+0xc5/0xf0
[ 95.206932][ T5327] ext4_listxattr+0x229/0x680
[ 95.206943][ T5327] ? listxattr+0xb9/0x380
[ 95.206958][ T5327] ? __pfx_ext4_listxattr+0x10/0x10
[ 95.206968][ T5327] ? __kvmalloc_node_noprof+0x35c/0x860
[ 95.206980][ T5327] ? listxattr+0xb9/0x380
[ 95.206993][ T5327] ? __pfx_ext4_listxattr+0x10/0x10
[ 95.207003][ T5327] listxattr+0x19d/0x380
[ 95.207018][ T5327] ? __pfx_listxattr+0x10/0x10
[ 95.207033][ T5327] ? strncpy_from_user+0x150/0x2c0
[ 95.208584][ T5327] path_listxattrat+0x1a3/0x3f0
[ 95.208606][ T5327] ? __pfx_path_listxattrat+0x10/0x10
[ 95.208624][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.208636][ T5327] do_syscall_64+0x174/0x580
[ 95.208675][ T5327] ? trace_irq_disable+0x3b/0x140
[ 95.208684][ T5327] ? clear_bhb_loop+0x40/0x90
[ 95.208692][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.208700][ T5327] RIP: 0033:0x7f368339de99
[ 95.208711][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.208719][ T5327] RSP: 002b:00007f368418bfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
[ 95.208733][ T5327] RAX: ffffffffffffffda RBX: 00007f3683626090 RCX: 00007f368339de99
[ 95.208741][ T5327] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000200000000180
[ 95.208749][ T5327] RBP: 00007f3683433eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.208756][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.208762][ T5327] R13: 00007f3683626128 R14: 00007f3683626090 R15: 00007ffe9a973d28
[ 95.208771][ T5327]
[ 95.208774][ T5327]
[ 95.297994][ T5327] The buggy address belongs to the physical page:
[ 95.300517][ T5327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f3677201 pfn:0x4d4ff
[ 95.304105][ T5327] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 95.306963][ T5327] raw: 04fff00000000000 ffffea0001354008 ffffea000135e4c8 0000000000000000
[ 95.310159][ T5327] raw: 00000007f3677201 0000000000000000 00000000ffffffff 0000000000000000
[ 95.313516][ T5327] page dumped because: kasan: bad access detected
[ 95.316136][ T5327] page_owner tracks the page as freed
[ 95.318377][ T5327] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 5327, tgid 5325 (syz.0.0), ts 95195106716, free_ts 95196292522
[ 95.325363][ T5327] post_alloc_hook+0x1f9/0x250
[ 95.327155][ T5327] get_page_from_freelist+0x21fa/0x2270
[ 95.329123][ T5327] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.331414][ T5327] alloc_pages_mpol+0x212/0x380
[ 95.333409][ T5327] folio_alloc_mpol_noprof+0x39/0x160
[ 95.335629][ T5327] vma_alloc_folio_noprof+0xe1/0x1e0
[ 95.337612][ T5327] do_wp_page+0x1163/0x4c70
[ 95.339478][ T5327] handle_mm_fault+0x1490/0x3080
[ 95.341453][ T5327] do_user_addr_fault+0xa4d/0x1340
[ 95.343508][ T5327] exc_page_fault+0x6a/0xc0
[ 95.345213][ T5327] asm_exc_page_fault+0x26/0x30
[ 95.347035][ T5327] page last free pid 5327 tgid 5325 stack trace:
[ 95.349368][ T5327] free_unref_folios+0xd84/0x14a0
[ 95.351037][ T5327] folio_batch_move_lru+0x877/0xa60
[ 95.352774][ T5327] lru_add_drain_cpu+0xbc/0x750
[ 95.354476][ T5327] lru_add_drain+0x121/0x3e0
[ 95.356139][ T5327] __folio_batch_release+0x48/0x90
[ 95.358118][ T5327] shmem_undo_range+0x4e6/0x15d0
[ 95.360074][ T5327] shmem_evict_inode+0x280/0xa80
[ 95.361949][ T5327] evict+0x624/0xb50
[ 95.363492][ T5327] dentry_kill+0x1b9/0x880
[ 95.365348][ T5327] finish_dput+0x1a/0x260
[ 95.367025][ T5327] __fput+0x675/0xa50
[ 95.368592][ T5327] fput_close_sync+0x11f/0x240
[ 95.370429][ T5327] __x64_sys_close+0x7e/0x110
[ 95.372341][ T5327] do_syscall_64+0x174/0x580
[ 95.374165][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.376490][ T5327]
[ 95.377452][ T5327] Memory state around the buggy address:
[ 95.379777][ T5327] ffff88804d4fef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 95.383072][ T5327] ffff88804d4fef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 95.386364][ T5327] >ffff88804d4ff000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 95.389568][ T5327] ^
[ 95.391495][ T5327] ffff88804d4ff080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 95.395521][ T5327] ffff88804d4ff100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 95.398933][ T5327] ==================================================================
[ 95.411937][ T5326] EXT4-fs (loop0): This should not happen!! Data will be lost
[ 95.411937][ T5326]
[ 95.437545][ T5327] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.440548][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.444038][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.448089][ T5327] Call Trace:
[ 95.449466][ T5327]
[ 95.450726][ T5327] vpanic+0x56c/0xa60
[ 95.452425][ T5327] ? __pfx_vpanic+0x10/0x10
[ 95.454339][ T5327] panic+0xc5/0xd0
[ 95.455933][ T5327] ? __pfx_panic+0x10/0x10
[ 95.457796][ T5327] ? preempt_schedule_thunk+0x16/0x40
[ 95.460047][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.462130][ T5327] ? preempt_schedule_thunk+0x16/0x40
[ 95.464265][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.466538][ T5327] check_panic_on_warn+0x89/0xb0
[ 95.468648][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.470950][ T5327] end_report+0x73/0x170
[ 95.472710][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.474943][ T5327] kasan_report+0x128/0x150
[ 95.476801][ T5327] ? ext4_xattr_list_entries+0x302/0x3d0
[ 95.479067][ T5327] ext4_xattr_list_entries+0x302/0x3d0
[ 95.481350][ T5327] ? ext4_get_inode_loc+0xc5/0xf0
[ 95.483476][ T5327] ext4_listxattr+0x229/0x680
[ 95.485476][ T5327] ? listxattr+0xb9/0x380
[ 95.487290][ T5327] ? __pfx_ext4_listxattr+0x10/0x10
[ 95.489453][ T5327] ? __kvmalloc_node_noprof+0x35c/0x860
[ 95.491768][ T5327] ? listxattr+0xb9/0x380
[ 95.493557][ T5327] ? __pfx_ext4_listxattr+0x10/0x10
[ 95.495702][ T5327] listxattr+0x19d/0x380
[ 95.497343][ T5327] ? __pfx_listxattr+0x10/0x10
[ 95.499216][ T5327] ? strncpy_from_user+0x150/0x2c0
[ 95.501382][ T5327] path_listxattrat+0x1a3/0x3f0
[ 95.503299][ T5327] ? __pfx_path_listxattrat+0x10/0x10
[ 95.505376][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.507810][ T5327] do_syscall_64+0x174/0x580
[ 95.509728][ T5327] ? trace_irq_disable+0x3b/0x140
[ 95.511763][ T5327] ? clear_bhb_loop+0x40/0x90
[ 95.513602][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.515817][ T5327] RIP: 0033:0x7f368339de99
[ 95.517587][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.525049][ T5327] RSP: 002b:00007f368418bfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
[ 95.528279][ T5327] RAX: ffffffffffffffda RBX: 00007f3683626090 RCX: 00007f368339de99
[ 95.531471][ T5327] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000200000000180
[ 95.534506][ T5327] RBP: 00007f3683433eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.537541][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.540685][ T5327] R13: 00007f3683626128 R14: 00007f3683626090 R15: 00007ffe9a973d28
[ 95.543768][ T5327]
[ 95.545282][ T5327] Kernel Offset: disabled
[ 95.546939][ T5327] Rebooting in 86400 seconds..