program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") truncate(&(0x7f0000000280)='./file1\x00', 0x1bf8) io_setup(0x1, &(0x7f00000004c0)=0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) truncate(&(0x7f0000000180)='./bus\x00', 0x24dc) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000000380)='zonefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x3]}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c0000001300050026bd7000ffdbdf2507000000", @ANYRES32=r4, @ANYBLOB="00000000000000000c001a800800058004000880"], 0x2c}, 0x1, 0x0, 0x0, 0x800c000}, 0x20000000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendfile(r5, r6, 0x0, 0xfffe82) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x56b5586a390a993e, 0x9, 0x4, 0x7ff, 0x400, r1, 0x3, '\x00', r4, r5, 0x3, 0x0, 0x3}, 0x50) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x10d) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000010}, 0x40) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0xffffff7f00000000, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f0000000140)='i', 0xa800, 0xe00}]) [ 159.100512][ T46] Bluetooth: hci0: command tx timeout [ 159.222824][ T5335] loop0: detected capacity change from 0 to 512 [ 159.331591][ T5335] EXT4-fs (loop0): 1 truncate cleaned up [ 159.333148][ T5335] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 159.432227][ T5335] loop0: detected capacity change from 512 to 64 [ 159.475702][ T5335] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 159.478484][ T26] audit: type=1800 audit(1790415706.917:2): pid=5335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 159.510341][ T5335] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 159.518911][ T5335] syz.0.0: attempt to access beyond end of device [ 159.518911][ T5335] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 159.518937][ T5335] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 36) [ 159.519021][ T5335] Buffer I/O error on device loop0, logical block 36 [ 159.537618][ T5336] EXT4-fs error (device loop0): xattr_find_entry:333: inode #15: comm syz.0.0: corrupted xattr entries [ 159.549282][ T5335] syz.0.0: attempt to access beyond end of device [ 159.549282][ T5335] loop0: rw=2049, sector=72, nr_sectors = 2 limit=64 [ 159.549308][ T5335] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 36) [ 159.549329][ T5335] Buffer I/O error on device loop0, logical block 36 [ 159.568871][ T5335] syz.0.0: attempt to access beyond end of device [ 159.568871][ T5335] loop0: rw=2049, sector=132, nr_sectors = 22 limit=64 [ 159.568895][ T5335] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 66) [ 159.568914][ T5335] Buffer I/O error on device loop0, logical block 66 [ 159.568921][ T5335] Buffer I/O error on device loop0, logical block 67 [ 159.568928][ T5335] Buffer I/O error on device loop0, logical block 68 [ 159.568953][ T5335] Buffer I/O error on device loop0, logical block 69 [ 159.568961][ T5335] Buffer I/O error on device loop0, logical block 70 [ 159.568968][ T5335] Buffer I/O error on device loop0, logical block 71 [ 159.568975][ T5335] Buffer I/O error on device loop0, logical block 72 [ 159.569074][ T5335] Buffer I/O error on device loop0, logical block 73 [ 159.610716][ T5336] syz.0.0: attempt to access beyond end of device [ 159.610716][ T5336] loop0: rw=2049, sector=136, nr_sectors = 10 limit=64 [ 159.610742][ T5336] EXT4-fs warning (device loop0): ext4_end_bio:364: I/O error 10 writing to inode 15 starting block 68) [ 159.625068][ T5336] ------------[ cut here ]------------ [ 159.625080][ T5336] kernel BUG at fs/ext4/mballoc.c:4781! [ 159.625098][ T5336] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 159.632758][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 159.636598][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 159.640796][ T5336] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 159.643488][ T5336] Code: e8 96 c1 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 f2 1e 30 ff 90 0f 0b e8 ea 1e 30 ff 90 0f 0b e8 e2 1e 30 ff 90 <0f> 0b e8 da 1e 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 159.651102][ T5336] RSP: 0018:ffffc9000da86840 EFLAGS: 00010283 [ 159.654006][ T5336] RAX: ffffffff8297ce2e RBX: 00000000fffffffd RCX: 0000000000100000 [ 159.657392][ T5336] RDX: ffffc90020001000 RSI: 00000000000025c3 RDI: 00000000000025c4 [ 159.660791][ T5336] RBP: 1ffff1100881530c R08: ffff8880440ade13 R09: 1ffff11008815bc2 [ 159.664156][ T5336] R10: dffffc0000000000 R11: ffffed1008815bc3 R12: 0000000000000000 [ 159.667605][ T5336] R13: 0000000000000034 R14: 1ffff11008815bc5 R15: ffff8880440ade28 [ 159.671041][ T5336] FS: 00007fd02eb156c0(0000) GS:ffff88808c2bf000(0000) knlGS:0000000000000000 [ 159.674709][ T5336] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 159.677413][ T5336] CR2: 00007fd02ddf36b8 CR3: 000000001fcdd000 CR4: 0000000000352ef0 [ 159.680719][ T5336] Call Trace: [ 159.682229][ T5336] [ 159.683627][ T5336] ext4_mb_use_preallocated+0x638/0x13e0 [ 159.686007][ T5336] ext4_mb_new_blocks+0x5a0/0x4530 [ 159.688208][ T5336] ? rcu_is_watching+0x16/0xb0 [ 159.690306][ T5336] ? __pfx_ext4_new_meta_blocks+0x10/0x10 [ 159.692750][ T5336] ? __pfx_ext4_mb_new_blocks+0x10/0x10 [ 159.695148][ T5336] ? ext4_block_to_path+0x382/0x700 [ 159.697410][ T5336] ext4_ind_map_blocks+0xe96/0x22a0 [ 159.699699][ T5336] ? lockdep_unlock+0x5c/0xd0 [ 159.701797][ T5336] ? __pfx_ext4_ind_map_blocks+0x10/0x10 [ 159.704752][ T5336] ? down_write+0x16b/0x200 [ 159.707268][ T5336] ext4_map_create_blocks+0xbb/0x530 [ 159.710157][ T5336] ? ext4_fc_track_inode+0xf3/0x3f0 [ 159.712458][ T5336] ext4_map_blocks+0x791/0x12c0 [ 159.714662][ T5336] ? ext4_alloc_io_end_vec+0x2b/0x160 [ 159.717099][ T5336] ? __pfx_ext4_map_blocks+0x10/0x10 [ 159.719367][ T5336] ? kmem_cache_alloc_noprof+0x156/0x600 [ 159.721769][ T5336] ext4_do_writepages+0x1901/0x4770 [ 159.724017][ T5336] ? __pfx_ext4_do_writepages+0x10/0x10 [ 159.726307][ T5336] ? __lock_acquire+0x747/0x2de0 [ 159.728518][ T5336] ? lock_acquire+0x115/0x350 [ 159.730617][ T5336] ? count_memcg_event_mm+0x21/0x260 [ 159.732983][ T5336] ? lock_acquire+0x115/0x350 [ 159.735127][ T5336] ext4_writepages+0x241/0x3b0 [ 159.737286][ T5336] ? __lock_acquire+0x747/0x2de0 [ 159.739344][ T5336] ? __pfx_ext4_writepages+0x10/0x10 [ 159.741551][ T5336] ? ext4_inode_journal_mode+0x18d/0x470 [ 159.743991][ T5336] ? __pfx_ext4_writepages+0x10/0x10 [ 159.746238][ T5336] do_writepages+0x338/0x560 [ 159.748259][ T5336] ? do_raw_spin_unlock+0x4d/0x200 [ 159.750535][ T5336] file_write_and_wait_range+0x36e/0x440 [ 159.752826][ T5336] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 159.755473][ T5336] ext4_sync_file+0x252/0xa40 [ 159.757524][ T5336] ext4_buffered_write_iter+0x2d0/0x380 [ 159.759884][ T5336] ext4_file_write_iter+0xae4/0x1cd0 [ 159.762204][ T5336] ? io_submit_one+0x134/0x13d0 [ 159.764325][ T5336] ? kasan_save_track+0x4f/0x80 [ 159.766310][ T5336] ? kasan_save_track+0x3e/0x80 [ 159.768494][ T5336] ? lock_acquire+0x115/0x350 [ 159.770577][ T5336] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 159.773098][ T5336] ? aio_write+0x54a/0x870 [ 159.775008][ T5336] aio_write+0x5d0/0x870 [ 159.776849][ T5336] ? __pfx_aio_write+0x10/0x10 [ 159.778886][ T5336] io_submit_one+0x798/0x13d0 [ 159.780905][ T5336] ? lockdep_hardirqs_on+0x7b/0x110 [ 159.783131][ T5336] ? irqentry_exit+0x218/0x910 [ 159.785208][ T5336] ? __pfx_io_submit_one+0x10/0x10 [ 159.787466][ T5336] ? lock_acquire+0x115/0x350 [ 159.789539][ T5336] ? __might_fault+0xaf/0x130 [ 159.791506][ T5336] __se_sys_io_submit+0x195/0x340 [ 159.793764][ T5336] ? __pfx___se_sys_io_submit+0x10/0x10 [ 159.796115][ T5336] do_syscall_64+0x166/0x520 [ 159.798172][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.800783][ T5336] ? clear_bhb_loop+0x70/0xc0 [ 159.802933][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.805527][ T5336] RIP: 0033:0x7fd02db9e159 [ 159.807450][ T5336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.815466][ T5336] RSP: 002b:00007fd02eb14fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 159.818867][ T5336] RAX: ffffffffffffffda RBX: 00007fd02de26090 RCX: 00007fd02db9e159 [ 159.822199][ T5336] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 00007fd02eaf4000 [ 159.825383][ T5336] RBP: 00007fd02dc3506b R08: 0000000000000000 R09: 0000000000000000 [ 159.828633][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.832119][ T5336] R13: 00007fd02de26128 R14: 00007fd02de26090 R15: 00007ffcdb3474a8 [ 159.835539][ T5336] [ 159.836875][ T5336] Modules linked in: [ 159.839034][ T5336] ---[ end trace 0000000000000000 ]--- [ 159.841645][ T5336] RIP: 0010:ext4_mb_use_inode_pa+0x6bf/0x720 [ 159.841670][ T5336] Code: e8 96 c1 a1 ff 48 ba 00 00 00 00 00 fc ff df e9 d7 fa ff ff e8 f2 1e 30 ff 90 0f 0b e8 ea 1e 30 ff 90 0f 0b e8 e2 1e 30 ff 90 <0f> 0b e8 da 1e 30 ff 90 0f 0b 48 8b 0c 24 48 83 c1 54 80 e1 07 80 [ 159.841679][ T5336] RSP: 0018:ffffc9000da86840 EFLAGS: 00010283 [ 159.841691][ T5336] RAX: ffffffff8297ce2e RBX: 00000000fffffffd RCX: 0000000000100000 [ 159.841700][ T5336] RDX: ffffc90020001000 RSI: 00000000000025c3 RDI: 00000000000025c4 [ 159.841707][ T5336] RBP: 1ffff1100881530c R08: ffff8880440ade13 R09: 1ffff11008815bc2 [ 159.841715][ T5336] R10: dffffc0000000000 R11: ffffed1008815bc3 R12: 0000000000000000 [ 159.841721][ T5336] R13: 0000000000000034 R14: 1ffff11008815bc5 R15: ffff8880440ade28 [ 159.841729][ T5336] FS: 00007fd02eb156c0(0000) GS:ffff88808c2bf000(0000) knlGS:0000000000000000 [ 159.841739][ T5336] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 159.841747][ T5336] CR2: 00007fd02ddf36b8 CR3: 000000001fcdd000 CR4: 0000000000352ef0 [ 159.841786][ T5336] Kernel panic - not syncing: Fatal exception [ 159.882592][ T5336] Kernel Offset: disabled [ 159.884697][ T5336] Rebooting in 86400 seconds..