program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f0000000940)={[{@min_batch_time={'min_batch_time', 0x3d, 0x5}}, {@auto_da_alloc}, {@mb_optimize_scan}, {@noload}, {@noload}, {@noblock_validity}, {@barrier_val={'barrier', 0x3d, 0x80}}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000}}]}, 0xfe, 0x497, &(0x7f0000000a00)="$eJzs3M1vVFUbAPDnTjulwMvbivgBglTRSPxoafmQhRuNJiw0MdEFxriobSGVQg2tiZBGqwtcGhL3xoX/g3GlG6NuNHGre0NCTDegbq65c++0pZ07bWk7A/T3S2Y4597TOee5557h3HtmJoAtqy97SiL+FxG/R0RPnr21QF/+z825mZG/52ZGkkjTN/5KauVuzM2M1IvW/25nnknTIr+tQb1X3o4YnpgYu1jkB6bPvz8wdenyc+Pnh8+OnR27MHTy5LGjB7pODB3fkDizuG7s+2hy/95Tb119beT01Xd/SiqRxx1L4tgoffnRbejJja6szXZFOt/NSWf23F3kDv6yUKrRmUA7dURE1l3V2vjviY7YPr+vJ175tK2NAzZVmqZpk3fl2RS4hyXR7hYA7VH/jz67/r0xN5NsxnXwnez6i/kFUBb3zeKR7+mMSp44WK1d326Ovog4PfvPl9kjNuk+BADAYt9l859n5+d/Iwvzj0o8mCe6sqf/F2sovRFxX0Tsjoj7I2JPRDwQUSv7UEQ8vMb6l66QLJ//VK7ddnCrkM3/XijWtm6d/1XqRXo7ityuWvzV5Mz4xNiR4pgcjuq2M+PJ2GCTOr5/+bfPy/Ytnv9lj6z++lywaMe1ziU36EaHp4cj5tYT9rzrn+QdvDz+pLYuMFuU2xsR+26zjvGnO0v3rRx/E+Uvu2rpVxFP5fHPxpL465LS9cnB508MHR/ojomxIwP1s2K5n3+98npZ/euKfwNk/b+jpP8LvUl3xNSly+dq67VTa6/jyh+fNb2mWcP5f2pXcf53JW/WNnQVOz4cnp6+OBjRlby6fPvQwqvV8/XyWfyHDzUe/7tj4Ug8EhH7I+JARDyaXRQWffdYRDweEYeaxPfjS0+8V7avvP9bs1aaxT+6Uv/H4v5fe6Lj3A/frhx/d0SU9f+xWupwsSV//2tutQ1cz7EDAACAu0X+Gfik0r+QTvr788/w74kdlYnJqelnzkx+cGE0/6x8b1Qr9TtdPYvuhw4W94br+aEl+aPFfeMvOrbX8v0jkxOj7Q4etridy8Z/pZKN/8yfHe1uHbDpNmAdDbhLGf+wdRn/sDUlK47/asvaArRe4/H/ztctbwjQco3G/8elpfu/2dTGAC21muv/7S1oB9B6qxj/xfcAy2cFwN3J/X/Yuox/2JJKvxtfWddX/lue+Lf4PcM7pT33fiIqzcp03gEtvEcSnav+MYuyRHX5WE578vGfbdnW8K/a/c4EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwMf4LAAD//zC/53M=") open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000200), 0xfea7) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8, 0xfffffffffffffffe]}) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) [ 108.186349][ T5328] loop0: detected capacity change from 0 to 512 [ 108.194948][ T5286] Bluetooth: hci0: command tx timeout [ 108.378546][ T5328] EXT4-fs error (device loop0): __ext4_iget:5533: inode #15: block 1803188595: comm syz.0.0: invalid block [ 108.384862][ T5328] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 108.385563][ T5328] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 108.389681][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 108.389735][ C0] EXT4-fs (loop0): initial error at time 1785587844: __ext4_iget:5533: inode 15: block 1803188595 [ 108.389758][ C0] EXT4-fs (loop0): last error at time 1785587844: __ext4_iget:5533: inode 15: block 1803188595 [ 108.438500][ T5328] loop0: lost filesystem error report for type 5 error -117 [ 108.460552][ T5328] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 108.541681][ T5328] loop0: detected capacity change from 512 to 64 [ 108.553344][ T5328] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #19: comm syz.0.0: corrupted inode contents [ 108.569448][ T5328] EXT4-fs error (device loop0): ext4_dirty_inode:6639: inode #19: comm syz.0.0: mark_inode_dirty error [ 108.581325][ T5328] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #19: comm syz.0.0: corrupted inode contents [ 108.586609][ T5328] EXT4-fs error (device loop0): ext4_dirty_inode:6639: inode #19: comm syz.0.0: mark_inode_dirty error [ 108.593111][ T5328] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #19: comm syz.0.0: corrupted inode contents [ 108.599293][ T5328] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2559: inode #19: comm syz.0.0: mark_inode_dirty error [ 108.605208][ T5328] EXT4-fs error (device loop0): mpage_map_and_submit_extent:2563: comm syz.0.0: Failed to mark inode 19 dirty [ 108.610927][ T5328] syz.0.0: attempt to access beyond end of device [ 108.610927][ T5328] loop0: rw=1, sector=258, nr_sectors = 24 limit=64 [ 108.616474][ T5328] EXT4-fs warning (device loop0): ext4_end_bio:372: I/O error 10 writing to inode 19 starting block 129) [ 108.621470][ T5328] Buffer I/O error on device loop0, logical block 129 [ 108.624422][ T5328] Buffer I/O error on device loop0, logical block 130 [ 108.627273][ T5328] Buffer I/O error on device loop0, logical block 131 [ 108.630146][ T5328] Buffer I/O error on device loop0, logical block 132 [ 108.632867][ T5328] Buffer I/O error on device loop0, logical block 133 [ 108.635661][ T5328] Buffer I/O error on device loop0, logical block 134 [ 108.638514][ T5328] Buffer I/O error on device loop0, logical block 135 [ 108.641471][ T5328] Buffer I/O error on device loop0, logical block 136 [ 108.644316][ T5328] Buffer I/O error on device loop0, logical block 137 [ 108.647128][ T5328] Buffer I/O error on device loop0, logical block 138 [ 108.679832][ T12] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #19: comm kworker/u4:0: corrupted inode contents [ 108.693024][ T12] EXT4-fs error (device loop0): ext4_dirty_inode:6639: inode #19: comm kworker/u4:0: mark_inode_dirty error [ 108.714894][ T12] ------------[ cut here ]------------ [ 108.718121][ T12] kernel BUG at fs/ext4/mballoc.c:4780! [ 108.720670][ T12] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 108.723448][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:0 Not tainted syzkaller #0 PREEMPT(full) [ 108.727396][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.731733][ T12] Workqueue: writeback wb_workfn (flush-7:0) [ 108.734306][ T12] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 108.736825][ T12] Code: e8 16 81 a3 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 4e 34 ff 90 0f 0b e8 8a 4e 34 ff 90 0f 0b e8 82 4e 34 ff 90 <0f> 0b e8 7a 4e 34 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 108.744895][ T12] RSP: 0000:ffffc9000025e560 EFLAGS: 00010293 [ 108.747418][ T12] RAX: ffffffff8292d69e RBX: 00000000ffffffec RCX: ffff88801cedca80 [ 108.750716][ T12] RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000020 [ 108.753914][ T12] RBP: 1ffff11008556929 R08: ffff888042ab907b R09: 1ffff1100855720f [ 108.757071][ T12] R10: dffffc0000000000 R11: ffffed1008557210 R12: 0000000000000000 [ 108.760278][ T12] R13: 0000000000000034 R14: 1ffff11008557212 R15: ffff888042ab9090 [ 108.763515][ T12] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 108.767199][ T12] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.769969][ T12] CR2: 00007f59cbe22000 CR3: 000000001252f000 CR4: 0000000000352ef0 [ 108.773393][ T12] Call Trace: [ 108.774828][ T12] [ 108.776200][ T12] ext4_mb_use_preallocated+0x638/0x13e0 [ 108.778635][ T12] ext4_mb_new_blocks+0x5a0/0x4530 [ 108.780842][ T12] ? rcu_is_watching+0x15/0xb0 [ 108.782881][ T12] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 108.785359][ T12] ? unwind_next_frame+0x1baf/0x2550 [ 108.787574][ T12] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 108.789886][ T12] ? ret_from_fork_asm+0x1a/0x30 [ 108.791998][ T12] ? ext4_block_to_path+0x382/0x700 [ 108.794218][ T12] ext4_ind_map_blocks+0xe96/0x22a0 [ 108.796440][ T12] ? lockdep_unlock+0x5d/0xd0 [ 108.798446][ T12] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 108.800619][ T12] ? ext4_map_blocks+0x7cc/0x1240 [ 108.802675][ T12] ? down_write+0x16d/0x200 [ 108.804607][ T12] ext4_map_create_blocks+0xbb/0x530 [ 108.806739][ T12] ? ext4_fc_track_inode+0xf3/0x3f0 [ 108.808911][ T12] ext4_map_blocks+0x7e4/0x1240 [ 108.811004][ T12] ? __pfx_ext4_map_blocks+0x10/0x10 [ 108.813249][ T12] ? __ext4_journal_ensure_credits+0x30/0x450 [ 108.815916][ T12] ext4_do_writepages+0x19e3/0x47a0 [ 108.818119][ T12] ? __pfx_ext4_do_writepages+0x10/0x10 [ 108.820405][ T12] ? __lock_acquire+0x683/0x2cf0 [ 108.822479][ T12] ? filemap_get_folios_tag+0x118/0x720 [ 108.824784][ T12] ? filemap_get_folios_tag+0x639/0x720 [ 108.827189][ T12] ? filemap_get_folios_tag+0x118/0x720 [ 108.830029][ T12] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 108.833239][ T12] ? ext4_writepages+0x205/0x3b0 [ 108.835820][ T12] ? ext4_writepages+0x205/0x3b0 [ 108.838355][ T12] ext4_writepages+0x241/0x3b0 [ 108.840745][ T12] ? __pfx_ext4_writepages+0x10/0x10 [ 108.843672][ T12] ? unwind_next_frame+0x8f/0x2550 [ 108.845997][ T12] ? __pfx_ext4_writepages+0x10/0x10 [ 108.848252][ T12] do_writepages+0x338/0x560 [ 108.850220][ T12] ? reacquire_held_locks+0x104/0x190 [ 108.852451][ T12] ? writeback_sb_inodes+0x450/0x1b00 [ 108.854647][ T12] __writeback_single_inode+0x12e/0xf90 [ 108.857010][ T12] writeback_sb_inodes+0x9de/0x1b00 [ 108.859765][ T12] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 108.862794][ T12] ? __pfx_down_read_trylock+0x10/0x10 [ 108.865200][ T12] ? __pfx___up_read+0x10/0x10 [ 108.867308][ T12] __writeback_inodes_wb+0x114/0x240 [ 108.869613][ T12] wb_writeback+0x42f/0xad0 [ 108.871551][ T12] ? queue_io+0x251/0x470 [ 108.873419][ T12] ? __pfx_wb_writeback+0x10/0x10 [ 108.875592][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.877934][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 108.880282][ T12] wb_workfn+0x980/0x10f0 [ 108.882042][ T12] ? __pfx_wb_workfn+0x10/0x10 [ 108.884039][ T12] ? do_raw_spin_unlock+0x4d/0x210 [ 108.886152][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 108.888645][ T12] ? rcu_is_watching+0x15/0xb0 [ 108.890791][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 108.893237][ T12] process_scheduled_works+0xa8e/0x14e0 [ 108.895501][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 108.897927][ T12] ? assign_work+0x3cf/0x5d0 [ 108.899885][ T12] worker_thread+0xa47/0xfb0 [ 108.901793][ T12] kthread+0x388/0x470 [ 108.903465][ T12] ? __pfx_worker_thread+0x10/0x10 [ 108.905529][ T12] ? __pfx_kthread+0x10/0x10 [ 108.907440][ T12] ret_from_fork+0x514/0xb70 [ 108.909249][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 108.911322][ T12] ? __switch_to+0xc89/0x1420 [ 108.913275][ T12] ? __pfx_kthread+0x10/0x10 [ 108.915137][ T12] ret_from_fork_asm+0x1a/0x30 [ 108.917030][ T12] [ 108.918355][ T12] Modules linked in: [ 108.920575][ T12] ---[ end trace 0000000000000000 ]--- [ 108.923077][ T12] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 108.925668][ T12] Code: e8 16 81 a3 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 92 4e 34 ff 90 0f 0b e8 8a 4e 34 ff 90 0f 0b e8 82 4e 34 ff 90 <0f> 0b e8 7a 4e 34 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 108.933255][ T12] RSP: 0000:ffffc9000025e560 EFLAGS: 00010293 [ 108.935416][ T12] RAX: ffffffff8292d69e RBX: 00000000ffffffec RCX: ffff88801cedca80 [ 108.938595][ T12] RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000020 [ 108.941721][ T12] RBP: 1ffff11008556929 R08: ffff888042ab907b R09: 1ffff1100855720f [ 108.944991][ T12] R10: dffffc0000000000 R11: ffffed1008557210 R12: 0000000000000000 [ 108.948533][ T12] R13: 0000000000000034 R14: 1ffff11008557212 R15: ffff888042ab9090 [ 108.951829][ T12] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 108.955773][ T12] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.958975][ T12] CR2: 00007f59cbe22000 CR3: 000000001252f000 CR4: 0000000000352ef0 [ 108.962312][ T12] Kernel panic - not syncing: Fatal exception [ 108.965089][ T12] Kernel Offset: disabled [ 108.966871][ T12] Rebooting in 86400 seconds..