program: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x8004, &(0x7f0000000240)={[{@discard}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4}}, {@norecovery}]}, 0x1, 0x7b9, &(0x7f0000001240)="$eJzs3d9rHNUeAPDvbJLmR3tvcuFy7+1b4EJvoHRzU2Or4EPFBxEsFPTZNmy2oWaTLdlNaULAFhF8EVR8EPSlz/6ob776A3zS/8IHaamaFis+SGR2Z5M02c2vJtloPh+YzDkzsznnO+fMzNmdYTeAQ2sw/ZOLOB4RbycR/dnyJCK6aqnOiHP17R4uLvRERCGJpaWXfkpq2zxYXCjEqtekjmaZ/0TEV29EnMytL7cyNz85VioVZ7L8cHXq6nBlbv7UlamxieJEcfrMyOjo6bNPnj2ze7H+8t38sbvvPP+/T8/99vq/b7/1dRLn4li2bnUcu2UwBrN90pXuwkc8t9uFtVnS7gqwI+mh2VE/yuN49EdHLdVC737WDADYK69FxBIAcMgkrv8AcMg0Pgd4sLhQaEzt/URif917NiJ66vE/zKb6ms7snl1P7T5o34PkkTsjSUQM7EL5gxHx4eevnOjI8mk93EsD9sONmxFxaWBw/fk/WffMwnb9f6OVS9212eCaxYft+gPt9EU6/nmq2fgvtzz+iSbjn+76sfuvxy1/8+M/d+dxy9hIOv57pv5s25rx3/JDawMdWe5vtTFfV3L5SqmYntv+HhFD0dWd5kdqmzYfuQ3d//1+q/Kz8d/H6fTzu69+lJafzle2yN3p7H70NeNj1c5vHjfwzL2b0Zcl18SfLLd/0mL8e2GLZbzw9JsftFqXxp/G25jWx7+3lm5FnGja/ittmWz4fOJwrTsMNzpFE599/35fq/JXt386peWn892PtLl7N6PWAZJkZR/U1yzHP5Csfl6zsv0yvr3V/2WrdZvH37T/jx1JXq6lj2TLro9VqzMjEUeSF9cvP73y2ka+sX0a/9B/mx//9WKb9//0PeGlLcbfeffHT3Ye/95K4x/fuP+vaf+ebPHKks0Stx9OdrQqf2vtP1pLDWVL0vbfLK6t1GtnvRkAAAAAAAAAAAAAAAAAAAAAAAAAti8XEcciyeWX07lcPl//De9/Rl+uVK5UT14uz06PR+23sgeiK9f4qsv+Vd+HOpJ9H34jf3pN/omI+EdEvNfdW8vnC+XSeLuDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM0Ra//5/6obvdtQMA9kxPuysAAOw7138AOHy2d/3v3bN6AAD7x/t/ADh8tnz9v7S39QAA9o/3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyxC+fPp9PSr4sLhTQ/fm1udrJ87dR4sTKZn5ot5Avlmav5iXJ5olTMF8pTLf/RjfqsVC5fHY3p2evD1WKlOlyZm784VZ6drl68MjU2UbxY7Nq3yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg6ypz85NjpVJx5i+RuLES2C7/5962xtV3MHbvqkRnHIhqHOhEdxyIauwwsfos0duGMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn8MfAQAA//94WBdi") openat(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x42, 0x0) io_setup(0x1, &(0x7f0000001a40)=0x0) creat(&(0x7f0000001a80)='./bus\x00', 0x0) mount(&(0x7f0000001ac0)=@loop={'/dev/loop', 0x0}, &(0x7f0000001b00)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000001b40)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000001b80)={0x0, 0x0, 0x0, 0xf, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359838e229a4c668104000000002a584923020000000000000100", [0x3]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000001c80)='./file1\x00', 0x101042, 0x10d) io_submit(r0, 0x1, &(0x7f0000001cc0)=[&(0x7f0000001d00)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000001d40)='i', 0xa800, 0x1400}]) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000080)={[{@nojournal_checksum}, {@nombcache}, {@barrier}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@nodelalloc}, {@usrquota}, {@noauto_da_alloc}, {@acl}, {@init_itable}]}, 0xff, 0x551, &(0x7f0000000cc0)="$eJzs3d9vU1UcAPDv7Tp+KyMhJPpgFnkQg3Rs8wcmPuCjUSKJvmOzXRaylpK1I2ySCA/y4oshJsZIYvwDfPeR+A/4V5AoCTFk0Qdfam53ywprt9EVNuznk9xyzj23nHt67vdwbs8lDWBojWcvhYhXIuLbJOJwR1kx8sLx1eNWHl6fybYkms3P/koiyfe1j0/yPw+2M8WI376OOFl4rMqx7KW+tDxfrlTShXznRKN6ZaK+tHzqUrU8l86ll6emp8+8Mz31/nvvDqytb57/54dP73505pvjK9//cv/I7STOxqG8rLMd23CjMzMe4/lnMhpnnzhwcgCV7SbJTp8AfRnJ43w0sjHgcIzkUQ/8/30VEU1gSCXiH4ZUex7Qvrcf0H3wC+PBh6s3QOvbX1z9biT2te6NDqwkj90ZJe0vMrYpq+PXP+/czrYY3PcQAJu6cTMiTheL68e/JB//+nd6C8c8WYfxD56fu9n8561u85/Co/lPdJn/HOwSu/3YPP4L9wdQTU/Z/O+DrvPffNFqLMZG8txLrexocvFSJc3Gtpcj4kSM7s3yG63nnFm51+xV1jn/y7as/vZcMD+P+8W9j79nttwob6/Vax7cjHi16/w3edT/SZf+zz6P81us41h657VeZZu3/9lq/hzxRtf+X1vRSjZen5xoXQ8T7ativb9vHfu9V/073f6s/w9s3P6xpHO9tv70dfy079+0V1m/1/+e5PNWek++71q50ViYjNiTfLJ+/9Tae9v59vFZ+08c33j863b974+IL7bY/ltHb/U8dFv9P4BF16z9s0/V/0+fuPfxlz/23/6s/99upU7ke7Yy/m31BLfz2QEAAAAAAMBuU4iIQ5EUSo/ShUKptPp8x9E4UKjU6o2TF2uvR6us9fxDob3SfbjjeYjJ/HnYdn7qifx0RByJiO9G9rfypZlaZXanGw8AAAAAAAAAAAAAAAAAAAC7xMEe//8/88fITp8d8Mz5yW8YXpvG/yB+6QnYlfz7D8NL/MPwEv8wvMQ/DC/xD8NL/MPwEv8wvMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAADNT5c+eyrbny8PpMlp+9urQ4X7t6ajatz5eqizOlmdrCldJcrTZXSUsztepmf1+lVrsyORWL1yYaab0xUV9avlCtLV5uXLhULc+lF9LR59IqAAAAAAAAAAAAAAAAAAAAeLHUl5bny5VKuiAh0VeiuDtOQ2LAiZ0emQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzX8BAAD//7VBN58=") r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./file1\x00', 0x42, 0x0) pwrite64(r3, &(0x7f0000000000)='a', 0x1, 0x9000) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(r1, 0x80184151, &(0x7f00000002c0)={0x0, &(0x7f0000000300)="2d0b0e51ba3c608a39ce03f4584fcb3c2ffe41c69a56c5aea0984ee4521c6465da9a88388bb7f3428ec65d7145296170e45e4226a83ba5bde5bc80bb40f2fad4bf90858bfeeb088c696de29b626c43ac3bc0d2f89f5747661c783b45371b1c5c107bc05f0ef490ff8aedb0b833ef92ddbb5087207db0f4984a70e45ba96b5854a419c4b3300d1d0135e43b65adb6c4259d7e9359cd138b0e2cf40e44b7a4a9fdec23bec478c9e8335f07f12f69c2ce1192e0f045559f9f1ff3b3003a20cb6d7044aad532551d4c6e0f3c18385782940495f3ff", 0xd3}) [ 102.821989][ T5297] Bluetooth: hci0: command tx timeout [ 102.873324][ T5345] loop0: detected capacity change from 0 to 2048 [ 102.965108][ T5345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.084919][ T5345] loop0: detected capacity change from 2048 to 64 [ 103.108057][ T5345] ================================================================== [ 103.108070][ T5345] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108253][ T5345] Read of size 18446744073709551600 at addr ffff888013384ec8 by task syz.0.0/5345 [ 103.108264][ T5345] [ 103.108271][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.108283][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.108290][ T5345] Call Trace: [ 103.108295][ T5345] [ 103.108300][ T5345] dump_stack_lvl+0xe8/0x150 [ 103.108347][ T5345] print_address_description+0x55/0x1e0 [ 103.108365][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108398][ T5345] print_report+0x58/0x70 [ 103.108413][ T5345] kasan_report+0x117/0x150 [ 103.108440][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108454][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108469][ T5345] kasan_check_range+0x264/0x2c0 [ 103.108484][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108497][ T5345] __asan_memmove+0x29/0x70 [ 103.108510][ T5345] ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.108529][ T5345] ext4_xattr_ibody_set+0x262/0x710 [ 103.108543][ T5345] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 103.108558][ T5345] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 103.108571][ T5345] ? down_write+0x166/0x200 [ 103.108672][ T5345] ext4_destroy_inline_data+0x83/0xe0 [ 103.108685][ T5345] ext4_do_writepages+0x57f/0x44a0 [ 103.108701][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.108749][ T5345] ? __es_insert_extent+0xb2b/0x1780 [ 103.108767][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.108781][ T5345] ? look_up_lock_class+0x57/0x110 [ 103.108798][ T5345] ? register_lock_class+0x31/0x2e0 [ 103.108810][ T5345] ? rcu_is_watching+0x16/0xb0 [ 103.108824][ T5345] ? __pfx_ext4_do_writepages+0x10/0x10 [ 103.108837][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.108852][ T5345] ? lock_acquire+0x115/0x350 [ 103.108865][ T5345] ? count_memcg_event_mm+0x21/0x260 [ 103.108891][ T5345] ? lock_acquire+0x115/0x350 [ 103.108906][ T5345] ext4_writepages+0x1fe/0x4e0 [ 103.108918][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.108931][ T5345] ? __pfx_ext4_writepages+0x10/0x10 [ 103.108945][ T5345] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 103.108962][ T5345] ? __pfx_ext4_writepages+0x10/0x10 [ 103.108974][ T5345] do_writepages+0x338/0x560 [ 103.108995][ T5345] ? do_raw_spin_unlock+0x4d/0x200 [ 103.109007][ T5345] file_write_and_wait_range+0x36e/0x440 [ 103.109019][ T5345] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 103.109040][ T5345] ext4_sync_file+0x252/0xa40 [ 103.109055][ T5345] ext4_buffered_write_iter+0x471/0x540 [ 103.109069][ T5345] ext4_file_write_iter+0xae4/0x1cd0 [ 103.109083][ T5345] ? io_submit_one+0x134/0x13d0 [ 103.109099][ T5345] ? kasan_save_track+0x4f/0x80 [ 103.109111][ T5345] ? kasan_save_track+0x3e/0x80 [ 103.109125][ T5345] ? lock_acquire+0x115/0x350 [ 103.109138][ T5345] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 103.109151][ T5345] ? aio_write+0x545/0x870 [ 103.109167][ T5345] aio_write+0x5cb/0x870 [ 103.109183][ T5345] ? __pfx_aio_write+0x10/0x10 [ 103.109204][ T5345] io_submit_one+0x798/0x13d0 [ 103.109220][ T5345] ? lockdep_hardirqs_on+0x7b/0x110 [ 103.109235][ T5345] ? irqentry_exit+0x2a0/0x9b0 [ 103.109250][ T5345] ? __pfx_io_submit_one+0x10/0x10 [ 103.109264][ T5345] ? lock_acquire+0x115/0x350 [ 103.109281][ T5345] ? __might_fault+0xaf/0x130 [ 103.109292][ T5345] __se_sys_io_submit+0x195/0x340 [ 103.109307][ T5345] ? __pfx___se_sys_io_submit+0x10/0x10 [ 103.109324][ T5345] do_syscall_64+0x166/0x520 [ 103.109337][ T5345] ? trace_irq_disable+0x3b/0x140 [ 103.109352][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.109378][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 103.109390][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.109400][ T5345] RIP: 0033:0x7fa1d8b9fb19 [ 103.109412][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.109421][ T5345] RSP: 002b:00007fa1d4ff4fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 103.109433][ T5345] RAX: ffffffffffffffda RBX: 00007fa1d8e25fa0 RCX: 00007fa1d8b9fb19 [ 103.109441][ T5345] RDX: 0000200000001cc0 RSI: 0000000000000001 RDI: 00007fa1d9973000 [ 103.109448][ T5345] RBP: 00007fa1d8c37b70 R08: 0000000000000000 R09: 0000000000000000 [ 103.109455][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.109462][ T5345] R13: 00007fa1d8e26038 R14: 00007fa1d8e25fa0 R15: 00007fff3aee6018 [ 103.109475][ T5345] [ 103.109479][ T5345] [ 103.109482][ T5345] The buggy address belongs to the physical page: [ 103.109487][ T5345] page: refcount:2 mapcount:0 mapping:ffff88801e825940 index:0x2 pfn:0x13384 [ 103.109497][ T5345] memcg:ffff88803c338580 [ 103.109504][ T5345] aops:def_blk_aops ino:700000 dentry name(?):"" [ 103.109535][ T5345] flags: 0xfff58000000234(referenced|dirty|lru|workingset|node=0|zone=1|lastcpupid=0x7ff) [ 103.109553][ T5345] raw: 00fff58000000234 ffffea00008f8c88 ffffea00004fb3c8 ffff88801e825940 [ 103.109563][ T5345] raw: 0000000000000002 ffff888014a07c40 00000002ffffffff ffff88803c338580 [ 103.109569][ T5345] page dumped because: kasan: bad access detected [ 103.109574][ T5345] page_owner tracks the page as allocated [ 103.109578][ T5345] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5345, tgid 5344 (syz.0.0), ts 103098589563 [ 103.109596][ T5345] post_alloc_hook+0x1f9/0x250 [ 103.109608][ T5345] get_page_from_freelist+0x2224/0x2290 [ 103.109620][ T5345] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 103.109630][ T5345] alloc_pages_mpol+0x21e/0x390 [ 103.109646][ T5345] alloc_pages_noprof+0xb1/0x2b0 [ 103.109659][ T5345] folio_alloc_noprof+0x1e/0x30 [ 103.109671][ T5345] filemap_alloc_folio_noprof+0x111/0x460 [ 103.109681][ T5345] __filemap_get_folio_mpol+0x3fd/0xff0 [ 103.109692][ T5345] bdev_getblk+0x1ec/0x670 [ 103.109701][ T5345] __ext4_get_inode_loc+0x56c/0xf40 [ 103.109714][ T5345] ext4_get_inode_loc+0x81/0xf0 [ 103.109725][ T5345] ext4_xattr_ibody_get+0x113/0x4b0 [ 103.109737][ T5345] ext4_xattr_get+0x121/0x690 [ 103.109747][ T5345] __vfs_getxattr+0x412/0x440 [ 103.109757][ T5345] cap_inode_need_killpriv+0x45/0x60 [ 103.109814][ T5345] security_inode_need_killpriv+0x85/0x240 [ 103.109826][ T5345] page last free pid 83 tgid 83 ts 103034644258 stack trace: [ 103.109834][ T5345] free_unref_folios+0xdc6/0x14e0 [ 103.109843][ T5345] shrink_folio_list+0x276b/0x4d90 [ 103.109853][ T5345] evict_folios+0x3326/0x4390 [ 103.109868][ T5345] try_to_shrink_lruvec+0xf22/0x1630 [ 103.109877][ T5345] shrink_one+0x312/0x10f0 [ 103.109891][ T5345] shrink_node+0x631e/0x6c50 [ 103.109904][ T5345] kswapd+0x1ff4/0x3a20 [ 103.109911][ T5345] kthread+0x38b/0x480 [ 103.109921][ T5345] ret_from_fork+0x514/0xb70 [ 103.109932][ T5345] ret_from_fork_asm+0x1a/0x30 [ 103.109942][ T5345] [ 103.109945][ T5345] Memory state around the buggy address: [ 103.109950][ T5345] ffff888013384d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.109957][ T5345] ffff888013384e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.109963][ T5345] >ffff888013384e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.109968][ T5345] ^ [ 103.109974][ T5345] ffff888013384f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.109979][ T5345] ffff888013384f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.109983][ T5345] ================================================================== [ 103.112706][ T5345] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.431441][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.435312][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.439612][ T5345] Call Trace: [ 103.441059][ T5345] [ 103.442375][ T5345] vpanic+0x26f/0x710 [ 103.444093][ T5345] panic+0xc5/0xd0 [ 103.445760][ T5345] ? __pfx_panic+0x10/0x10 [ 103.447842][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 103.450111][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 103.452397][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.454640][ T5345] check_panic_on_warn+0x89/0xb0 [ 103.456836][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.459154][ T5345] end_report+0x73/0x170 [ 103.460999][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.463381][ T5345] kasan_report+0x128/0x150 [ 103.465359][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.467719][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.470303][ T5345] kasan_check_range+0x264/0x2c0 [ 103.472886][ T5345] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.475105][ T5345] __asan_memmove+0x29/0x70 [ 103.478103][ T5345] ext4_xattr_set_entry+0x92b/0x1ed0 [ 103.480288][ T5345] ext4_xattr_ibody_set+0x262/0x710 [ 103.482344][ T5345] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 103.484777][ T5345] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 103.487633][ T5345] ? down_write+0x166/0x200 [ 103.489560][ T5345] ext4_destroy_inline_data+0x83/0xe0 [ 103.491950][ T5345] ext4_do_writepages+0x57f/0x44a0 [ 103.494143][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.496310][ T5345] ? __es_insert_extent+0xb2b/0x1780 [ 103.498575][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.500778][ T5345] ? look_up_lock_class+0x57/0x110 [ 103.502974][ T5345] ? register_lock_class+0x31/0x2e0 [ 103.505251][ T5345] ? rcu_is_watching+0x16/0xb0 [ 103.507355][ T5345] ? __pfx_ext4_do_writepages+0x10/0x10 [ 103.509818][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.512094][ T5345] ? lock_acquire+0x115/0x350 [ 103.514114][ T5345] ? count_memcg_event_mm+0x21/0x260 [ 103.516395][ T5345] ? lock_acquire+0x115/0x350 [ 103.518388][ T5345] ext4_writepages+0x1fe/0x4e0 [ 103.520396][ T5345] ? __lock_acquire+0x747/0x2de0 [ 103.522647][ T5345] ? __pfx_ext4_writepages+0x10/0x10 [ 103.524956][ T5345] ? ext4_inode_journal_mode+0x18c/0x4d0 [ 103.527382][ T5345] ? __pfx_ext4_writepages+0x10/0x10 [ 103.529679][ T5345] do_writepages+0x338/0x560 [ 103.531747][ T5345] ? do_raw_spin_unlock+0x4d/0x200 [ 103.533954][ T5345] file_write_and_wait_range+0x36e/0x440 [ 103.536318][ T5345] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 103.538935][ T5345] ext4_sync_file+0x252/0xa40 [ 103.540974][ T5345] ext4_buffered_write_iter+0x471/0x540 [ 103.543331][ T5345] ext4_file_write_iter+0xae4/0x1cd0 [ 103.545612][ T5345] ? io_submit_one+0x134/0x13d0 [ 103.547662][ T5345] ? kasan_save_track+0x4f/0x80 [ 103.549790][ T5345] ? kasan_save_track+0x3e/0x80 [ 103.551887][ T5345] ? lock_acquire+0x115/0x350 [ 103.553892][ T5345] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 103.556230][ T5345] ? aio_write+0x545/0x870 [ 103.558134][ T5345] aio_write+0x5cb/0x870 [ 103.562509][ T5345] ? __pfx_aio_write+0x10/0x10 [ 103.564557][ T5345] io_submit_one+0x798/0x13d0 [ 103.567566][ T5345] ? lockdep_hardirqs_on+0x7b/0x110 [ 103.569868][ T5345] ? irqentry_exit+0x2a0/0x9b0 [ 103.571872][ T5345] ? __pfx_io_submit_one+0x10/0x10 [ 103.573927][ T5345] ? lock_acquire+0x115/0x350 [ 103.575845][ T5345] ? __might_fault+0xaf/0x130 [ 103.577797][ T5345] __se_sys_io_submit+0x195/0x340 [ 103.579866][ T5345] ? __pfx___se_sys_io_submit+0x10/0x10 [ 103.582270][ T5345] do_syscall_64+0x166/0x520 [ 103.584338][ T5345] ? trace_irq_disable+0x3b/0x140 [ 103.586398][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.588930][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 103.591004][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.593525][ T5345] RIP: 0033:0x7fa1d8b9fb19 [ 103.597097][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.606175][ T5345] RSP: 002b:00007fa1d4ff4fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 103.609736][ T5345] RAX: ffffffffffffffda RBX: 00007fa1d8e25fa0 RCX: 00007fa1d8b9fb19 [ 103.613161][ T5345] RDX: 0000200000001cc0 RSI: 0000000000000001 RDI: 00007fa1d9973000 [ 103.616569][ T5345] RBP: 00007fa1d8c37b70 R08: 0000000000000000 R09: 0000000000000000 [ 103.619960][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.623452][ T5345] R13: 00007fa1d8e26038 R14: 00007fa1d8e25fa0 R15: 00007fff3aee6018 [ 103.626913][ T5345] [ 103.628712][ T5345] Kernel Offset: disabled [ 103.630618][ T5345] Rebooting in 86400 seconds..