program: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}, @IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xd}}]}}}]}, 0x50}}, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f0000000180), 0x2, 0x790, &(0x7f0000006a80)="$eJzs3c1rHOUfAPDvbPPSX9qfjSBoPQUEDZRuTI2tgoeKBxEsFPRsGzbbULPJhuymNCGgRQQvgooHQS89W603r75c9Q/w7kFaqqbFiAeJzL6k22Y33aTZbMt+PjDJ88zM5jvfeWbmebIz7AbQs0bSH5mIwxHxURJxqDY/iYj+Sqkv4mR1vbXVlVw6JbG+/sYfSWWdW6sruWh4TepArfJERPzwfsSRzOa4paXlmclCIb9Qq4+VZ+fHSkvLR8/PTk7np/Nzx8cnJo6deP7E8d3L9a+flw9e//jVZ74++c97j1/98MckTsbB2rLGPHbLSIzU9kl/ugvv8Eq8s9vhuirp9gawI+mpua96lsfhJC33dXuTAIAOS0eh6wBAj0n0/wDQY+rvA9xaXcnVp+6+I7G3brwcEfur+dfvb1aX9NXu2e2v3AcdupXccWckiYjhXYg/EhFffPvWlXSKDt2HBGjm3UsRcXZ4ZPP1P9n0zMJ2PdvGOiN31Tfi/9J/n9GBe/kuHf+80Gz8l9kY/0ST8c9gk3N3J1qe/xsy13YhTEvp+O+lhmfb1hryrxneV6v9vzLm60/OnS/k02vbIxExGv2DaX18ixijN/+92WpZ4/jvz0/e/jKNn/6+vUbmWt/gna+ZmixP3k/OjW5ciniyr57/pYYlyUb7Jy3Gv6fbjPHaix983mpZmn+ab33anH9nrV+OeLpp+99+oi3Z8vnEscrhMFY/KJr45tfPhlrFb2z/dFpbXVlPIq7sfqbNpe0/tHX+w0nj85ql7cf46fKh71sta5J/rv6/UFXz438gebNSHqjNuzhZLi+MRwwkr2+ef+z2a+v1+vpp/qNPNT//tzr+09HJ2Tbz77v++1c7z7+z0vynttX+2y9cXZvZ1yp+e+0/USmN1uZsff2rXrfb3cD73X8AAAAAAAAAAAAAAAAAAAAAAAAA0I5MRByMJJPdKGcy2Wz1O7wfi6FMoVgqHzlXXJybisp3ZQ9Hf6b+UZeHGj4Pdbz2efj1+rG76s9FxKMR8eng/yr1bK5YmOp28gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQc6DF9/+nfhvs9tYBAB2zv9sbAADsOf0/APQe/T8A9B79PwD0Hv0/APQe/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAddvrUqXRa/3t1JZfWpy4sLc4ULxydypdmsrOLuWyuuDCfnS4Wpwv5bK44e6+/VygW5ydibvHiWDlfKo+VlpbPzBYX58pnzs9OTufP5Pv3JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2J7S0vLMZKGQX1B4CAp9tVZ7ULZnR4VMPYm9CjrQxjrr8zdPbTuLB2Bndq7QxYsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEPkvwAAAP//vI8fOA==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80342, 0x168) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc) (async) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc) r3 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x2ac00) syz_mount_image$nilfs2(&(0x7f0000000dc0), &(0x7f0000000400)='./file0\x00', 0x94, &(0x7f0000003280)=ANY=[], 0x1, 0xd99, &(0x7f0000006900)="$eJzs3UtvXNUdAPBzx544LxqHmMZN09glpbiP2CRYpbsaKV2gSqgSnwClgYYa+ghdgIKUsOi2kRAfoIh9F31mgRSxSsWmVb8AYtVNipBoG1UCI9vnjMf/zOjOOLbH4/n9pDtn7v2fe88587hz575OAkZWY+1xcXG6SuntW29dvDcz/r/VKTOtHLNrj+N5bCml1GzNl9JkWN7SxHr62SfXLrWnn+e0ShdSlarW9PTs3da8R1JK19Nsup0m03Mfn7z50gfPLL934saJi2/M3dmZ1gMAwGi596N3f/m3x3947fj/f39mKU20ppft86U8fjRv9y9V6+M5af0PqNrSqm28OBDyjeehEfKNdcjXXk4z5BvvUv6BsNxml3wTNeWPtU3r1G4YZhv/46vG/KbxRmN+fv0/+aoPxw5U869cWX7h6oAqCmy7T2fyLj6DwTByw8qxQa+BANbF44b3uR73LDyY1tLGeyv/7tONzvPDNtjtz7/yh6v8d29Y47B99uunqbSrfI+O5vF4HGE8zNfv978sLx6PaPZYz27HEYbl+EK3eo7tcj22qlv94+div/paTsvrcCbE278/8T0dlvcY6Oye/f8Gw8gOK4NeAQF7VjxvbiUr8XheX4xP1MQP1sQP1cQP18SP1MRhlP3h1d+mm9XG//z4n77f/WFlP9tDOf1Sn/WJ+yP7LT+e99uvBy0/nk8Me9rcf09/+uvbf4/n/38ezv8/m39LJ/MKouwvjPvVW+f+hwuDG13yPRyq81CH/GvPpzbnq6Y2lpPa1jP31WN683zHuuU7vTnfZMh3OG+LHAz1jdsnh8N8ZfujrFfL6zUe2tsM7TgQ6lHemeM5PRjac7xbu8KO7AMhXzMPJ0K7pkK7HgnzfTm0q5re3K64/7zU52SYHo+TlHzhbbvvdym+F/G6jEdz+mZO38np+zn9qEO5o6h8Hrud/18+n9OpWb1wZfnyE3m8fE7vjDUnVqef3+V6Aw+u1+t/ptPm63+OtqY3G+3rhWMb06v29cJkmH6hy/Qn83j5Pfvp2KG16fOXfr78k+1uPIy4q6+9/rPnl5cv/8oTTzzxpPVk0GsmYKctvPryLxauvvb6uSsvP//i5Rcvv3L+ie9/78mnnlpcWNuqX2jftgf2l40f/UHXBAAAAAAAAAAAAOhZdajz5JzW3d+2XE9erk+P18czHMr7Vj4N5T4G5frPbvd1KddvHt+FOrL9duNyokG3Eejs3+7/azCM7LCy4i7+wN4w6P7/yn0PS3r03D+Prw4l292nN68v4/0L4UHs9f7nlL+/+v9r9X/V8/ov9Jg1ubVy/3jv0D/aik2nei0/tr/cB3aqv/L/lMsvrXks9Vb+yu9C+fFGpT36cyj/cI/l39f+01sr/y+5/PKyzZ3ttfz1GleNzfWI+43LfQDjfuPir6H95d5+fbd/ix213crlwygbln4m+zUs/X92U5Zb1oN59dw6Tlfuvx37O+i3/uW+3+V34JGw/Krm903/n8Otrv/P8vlb0P8n7DsfOv5nMIzssLKyMtCuT0a135W9YtCv/6C3IQdd/qBf/zqx/8/4fyn2/xnjsf/PGI/9f8Z47F8rxmP/n/H1jP1/xvjJsNzYP+h0TfwrNfFTNfGv1sRP18Tj/7cYn62Jn6mJz9TEH66JP1oTP1sT/0ZN/LGa+OM18bma+H739ZyOavthlMV+I33/YXSU4z/dvv9TNXFgeMV+neP3+5s1cWB4lfM8fL9hBFWd79gR97eX/bhv5vSdnL6f0492rILshm/l9Ns5/U5Ov5vTczmdz+lCTvUNOdx+869TZ25WG+f5HQvxXs8njdcDxPvEnO+xPvH4XL/ns57ssZydKn+Ll4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADI3G2uPi4nSV0tu33rr4n6kf/Hh1ykwrx+za43geW0opNVNKVR4fD8u7PrGefvbJtUud0ipdWHss4+nZu615j6zOn2bT7TSZnvv45M2XPnhm+b0TN05cfGPuzs60HgAAAEbDFwEAAP//ManlwQ==") openat$nullb(0xffffffffffffff9c, 0x0, 0x44800, 0x0) (async) openat$nullb(0xffffffffffffff9c, 0x0, 0x44800, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x40002101) (async) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x40002101) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) (async) r4 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000640)={0x0, {}, 0x0, {}, 0x7fff, 0x3, 0x17, 0x0, "22536af39b7c7cb7435b0a43852dbc3a9ada34cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "0410b15a7d62289113be3626f4e23806009c7416000000000019b0cff500", [0x3, 0xf9f]}) mount(0x0, 0x0, 0x0, 0x2390024, 0x0) syz_mount_image$minix(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x2200050, &(0x7f00000000c0)=ANY=[], 0xfe, 0x1be, &(0x7f0000000440)="$eJzs27uuEkEcx/Hfsiwg3m+NlYmFNoKijZ08gJ2VHYGVEBc1YgMxMT6Kb8Kb+AKQaGdh3JO9cA5wFvZGYDnn+0mAfzL72xnCTpgpRgAurVv+uyFDll+5rvv9oaR3bySVz1//zw3se5wAds/VfzejirImARSE+fvQIwBwGPO26a8Dpob068+37ix8WQnXD/N2KShqkpbylaT5H4b/+aAszZby1fCWb6/HrF9+BvnHWs1fSdl/fS1fj8kZp/ng+z95tJq/KumaJG/4NyTdDPdatyXdiei/t9b//YTjB/Lwnr5GKWe+kT3vdf1+4NjPohrN+LwV5p9HN9fOymnkBZUw30o43k35Fxnz1TDf6H5yehHtOX4aIJb3fOWYvrnnvyn9ddfn/+vk+fL2+Q9gi9F48qHjOPaXFIXlF9XwDini3uUp+6I4RFGLaLIyPi2FLry/rwIMI2mxmLX77AvARdX8OvzcHI0nTwfDTt/u2x9bL18ttt3+vry5cXcO4MitLs4BAAAAAAAAAAAAAMAxuivpXpZg0gN+AAAAAApjt2eGLEnRx/4AAAAAAAAAAAAAAAAAAAAA5HcSAAD///c8SNg=") open(0x0, 0x14927e, 0x6) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000e80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, {{&(0x7f0000000640)=@file={0x1, './file0/../file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4004000}}], 0x2, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x800000c, 0x12, 0x1b, 0x0, "9e959f16deab7b08aa26e66c4056a516950600000000000000eef4fb0efcc1d8a6078ed9d5f8643902dd8f6fac274de9d940ffa5e592bbd48685450d00002000", "f625c10e6e0080ffffffffffffffff7e904dc8df6aa3a893ec00347f41be6908", [0xa, 0x80000476]}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8541, 0x100) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8541, 0x100) fallocate(r6, 0x8, 0x4000, 0x8000) (async) fallocate(r6, 0x8, 0x4000, 0x8000) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)="3504000041000511d25a35400c00020003ffe72037153e370c04018006041000450000002a560000e7ff0040", 0x2c}, {&(0x7f0000000600)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb1b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c891cc4556efd6a6d0f8d57f2267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc2261c238a5159ea98db9c00aeef644ae98a8cb8da3ff3b7ba14d7971910b559623af829524d83bf19f18628464076329140e0203fc75859185ccd019302afb784e41e16cf2d31db7aba83d0f500ce25fc2d7f524a04cfaa0015ea8a297477a5517f8a4ac167083a321c78070974afc897fb738fbcfeac369844fd7fc11fff502c02b7607007ead2007a18006a6ca8dc2d0119f01d7083c2ab5760ac7b24d7bf26b9030cf455a08385f9e662cbe0c3ca6e6fd4ac0c8566c0fca986c68ef7016a11d3e44253b6f2d07d53505ed58b8ad410f89425046321b4a9b27b5e767bdfa0ebf7abf3d91b319120000853d8e5cbc4a2c5c560b007eafe03e3332f6017f3164c7f602180aad23dfe5e770fe8855f45925e342b7dfd7ddaa68b65065465cdf4d5b8d995d6e6a7042ebea3d139c6a616232eb4efd1a50d0e6db3188a8e98375fda2a7ebd4cd59b9ea626c13685b05e6cf4d484e32869fd7c7167dbfa48b1529e5dd5f5a02673ccc7dbedfd75e34f3f9eb3c7833734a59acada6dd2ff364475e03f2219deedb5d0c941f2177a23167adcc5a15f4e5441ed537f26a1620df057aeb55b2ad3a00a77e23d304ed6034dd5ec9b2cfe777ca21ec4f48abdafa0d66a78d653068ef871bdc6598fd32edcba60c675a1e8f4e81e83f73414c179bfb7f329d71fe6e291fb2eaa59b9636cb6a74d0deb46a18c77f37abf0894a7083e0e4c237ff7c24872668ac40e307569a975b2765af8d3268d11b473d5d7544edd1ed0e507c319e128daf7e75c349c9b3de603580d52a6c118acf924216130364bfab8d59969e4dbee0a9208adb7bfa855556be06a666334a0612e4ff3fc6f4ddb9a0c209301081f34824496480d688ae9bd0c3c28ea8ecfe01a2b86dcb3750686a89891d9abf0d584c854b4bc6096293fbc8707312f424996361ef9261ef3ba7cd2ddffb0e3c81e6", 0x3b0}, {&(0x7f0000000040)="9d493c13b6b02affcc19cb904ec2bd74085b0bd225277e5a44d681809b6d764ecab211ef0c90ba361a4378457b19705b18406f35071130b4e06c4a3b1a6e9a9d7cf1453aeb21e4c30a85207027af69f536ec61a4a59614b3f5", 0x59}], 0x3}, 0x10049014) (async) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)="3504000041000511d25a35400c00020003ffe72037153e370c04018006041000450000002a560000e7ff0040", 0x2c}, {&(0x7f0000000600)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb1b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c891cc4556efd6a6d0f8d57f2267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc2261c238a5159ea98db9c00aeef644ae98a8cb8da3ff3b7ba14d7971910b559623af829524d83bf19f18628464076329140e0203fc75859185ccd019302afb784e41e16cf2d31db7aba83d0f500ce25fc2d7f524a04cfaa0015ea8a297477a5517f8a4ac167083a321c78070974afc897fb738fbcfeac369844fd7fc11fff502c02b7607007ead2007a18006a6ca8dc2d0119f01d7083c2ab5760ac7b24d7bf26b9030cf455a08385f9e662cbe0c3ca6e6fd4ac0c8566c0fca986c68ef7016a11d3e44253b6f2d07d53505ed58b8ad410f89425046321b4a9b27b5e767bdfa0ebf7abf3d91b319120000853d8e5cbc4a2c5c560b007eafe03e3332f6017f3164c7f602180aad23dfe5e770fe8855f45925e342b7dfd7ddaa68b65065465cdf4d5b8d995d6e6a7042ebea3d139c6a616232eb4efd1a50d0e6db3188a8e98375fda2a7ebd4cd59b9ea626c13685b05e6cf4d484e32869fd7c7167dbfa48b1529e5dd5f5a02673ccc7dbedfd75e34f3f9eb3c7833734a59acada6dd2ff364475e03f2219deedb5d0c941f2177a23167adcc5a15f4e5441ed537f26a1620df057aeb55b2ad3a00a77e23d304ed6034dd5ec9b2cfe777ca21ec4f48abdafa0d66a78d653068ef871bdc6598fd32edcba60c675a1e8f4e81e83f73414c179bfb7f329d71fe6e291fb2eaa59b9636cb6a74d0deb46a18c77f37abf0894a7083e0e4c237ff7c24872668ac40e307569a975b2765af8d3268d11b473d5d7544edd1ed0e507c319e128daf7e75c349c9b3de603580d52a6c118acf924216130364bfab8d59969e4dbee0a9208adb7bfa855556be06a666334a0612e4ff3fc6f4ddb9a0c209301081f34824496480d688ae9bd0c3c28ea8ecfe01a2b86dcb3750686a89891d9abf0d584c854b4bc6096293fbc8707312f424996361ef9261ef3ba7cd2ddffb0e3c81e6", 0x3b0}, {&(0x7f0000000040)="9d493c13b6b02affcc19cb904ec2bd74085b0bd225277e5a44d681809b6d764ecab211ef0c90ba361a4378457b19705b18406f35071130b4e06c4a3b1a6e9a9d7cf1453aeb21e4c30a85207027af69f536ec61a4a59614b3f5", 0x59}], 0x3}, 0x10049014) [ 93.986386][ T4645] Bluetooth: hci0: command tx timeout [ 94.110666][ T5317] netlink: 'syz.0.0': attribute type 8 has an invalid length. [ 94.176006][ T5317] loop0: detected capacity change from 0 to 2048 [ 94.268309][ T5317] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.369111][ T5317] loop0: detected capacity change from 2048 to 1984 [ 94.381281][ T104] ================================================================== [ 94.381297][ T104] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382763][ T104] Read of size 18446744073709551600 at addr ffff88804d6c5eb8 by task kworker/u4:5/104 [ 94.382770][ T104] [ 94.382776][ T104] CPU: 0 UID: 0 PID: 104 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 94.382784][ T104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.382793][ T104] Workqueue: writeback wb_workfn (flush-7:0) [ 94.382839][ T104] Call Trace: [ 94.382858][ T104] [ 94.382864][ T104] dump_stack_lvl+0xe8/0x150 [ 94.382892][ T104] print_address_description+0x55/0x1e0 [ 94.382905][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382914][ T104] print_report+0x58/0x70 [ 94.382922][ T104] kasan_report+0x117/0x150 [ 94.382931][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382940][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382949][ T104] kasan_check_range+0x264/0x2c0 [ 94.382956][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382967][ T104] __asan_memmove+0x29/0x70 [ 94.382980][ T104] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.382998][ T104] ext4_xattr_ibody_set+0x262/0x710 [ 94.383013][ T104] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.383032][ T104] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.383050][ T104] ? down_write+0x16b/0x200 [ 94.383299][ T104] ext4_destroy_inline_data+0x83/0xe0 [ 94.383316][ T104] ext4_do_writepages+0x50a/0x4770 [ 94.383334][ T104] ? __lock_acquire+0x747/0x2de0 [ 94.383352][ T104] ? lock_acquire+0x115/0x350 [ 94.383362][ T104] ? lock_acquire+0x115/0x350 [ 94.383370][ T104] ? look_up_lock_class+0x57/0x110 [ 94.383378][ T104] ? register_lock_class+0x31/0x2e0 [ 94.383385][ T104] ? __pfx_ext4_do_writepages+0x10/0x10 [ 94.383392][ T104] ? __lock_acquire+0x747/0x2de0 [ 94.383399][ T104] ? filemap_get_folios_tag+0x639/0x720 [ 94.383408][ T104] ? filemap_get_folios_tag+0x118/0x720 [ 94.383417][ T104] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 94.383425][ T104] ? lock_acquire+0x115/0x350 [ 94.383434][ T104] ext4_writepages+0x241/0x3b0 [ 94.383445][ T104] ? __pfx_ext4_writepages+0x10/0x10 [ 94.383456][ T104] ? __pfx_ext4_writepages+0x10/0x10 [ 94.383465][ T104] do_writepages+0x338/0x560 [ 94.383476][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.383486][ T104] ? reacquire_held_locks+0x117/0x1a0 [ 94.383494][ T104] ? writeback_sb_inodes+0x450/0x1b00 [ 94.383502][ T104] __writeback_single_inode+0x136/0x1220 [ 94.383511][ T104] ? do_raw_spin_unlock+0x4d/0x200 [ 94.383521][ T104] writeback_sb_inodes+0x9de/0x1b00 [ 94.383534][ T104] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 94.383551][ T104] ? __pfx_down_read_trylock+0x10/0x10 [ 94.383565][ T104] ? __pfx___up_read+0x10/0x10 [ 94.383580][ T104] __writeback_inodes_wb+0x114/0x240 [ 94.383595][ T104] wb_writeback+0x42f/0xad0 [ 94.383607][ T104] ? queue_io+0x201/0x470 [ 94.383620][ T104] ? __pfx_wb_writeback+0x10/0x10 [ 94.383628][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.383639][ T104] wb_workfn+0x980/0x10f0 [ 94.383651][ T104] ? __pfx_wb_workfn+0x10/0x10 [ 94.383662][ T104] ? trace_hrtimer_start+0x82/0x200 [ 94.383673][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.383683][ T104] ? lock_acquire+0x115/0x350 [ 94.383690][ T104] ? rcu_is_watching+0x16/0xb0 [ 94.383699][ T104] ? process_scheduled_works+0x97a/0x1630 [ 94.383709][ T104] process_scheduled_works+0xc3d/0x1630 [ 94.383722][ T104] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.383731][ T104] ? assign_work+0x3cf/0x5d0 [ 94.383740][ T104] worker_thread+0xa47/0xfb0 [ 94.383788][ T104] kthread+0x38b/0x480 [ 94.383806][ T104] ? __pfx_worker_thread+0x10/0x10 [ 94.383818][ T104] ? __pfx_kthread+0x10/0x10 [ 94.383828][ T104] ret_from_fork+0x514/0xb70 [ 94.383839][ T104] ? __pfx_ret_from_fork+0x10/0x10 [ 94.383849][ T104] ? __switch_to+0xc89/0x1420 [ 94.383864][ T104] ? __pfx_kthread+0x10/0x10 [ 94.383874][ T104] ret_from_fork_asm+0x1a/0x30 [ 94.383891][ T104] [ 94.383894][ T104] [ 94.383895][ T104] The buggy address belongs to the physical page: [ 94.383900][ T104] page: refcount:3 mapcount:0 mapping:ffff88801d025940 index:0x2 pfn:0x4d6c5 [ 94.383910][ T104] memcg:ffff88801c2e8c80 [ 94.383914][ T104] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.384007][ T104] flags: 0x4fff18000004004(referenced|private|node=1|zone=1|lastcpupid=0x7ff) [ 94.384023][ T104] raw: 04fff18000004004 0000000000000000 dead000000000122 ffff88801d025940 [ 94.384031][ T104] raw: 0000000000000002 ffff888042b6c700 00000003ffffffff ffff88801c2e8c80 [ 94.384036][ T104] page dumped because: kasan: bad access detected [ 94.384042][ T104] page_owner tracks the page as allocated [ 94.384045][ T104] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 104, tgid 104 (kworker/u4:5), ts 94376453138 [ 94.384062][ T104] post_alloc_hook+0x1f9/0x250 [ 94.384076][ T104] get_page_from_freelist+0x2209/0x2280 [ 94.384091][ T104] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.384105][ T104] alloc_pages_mpol+0x21e/0x390 [ 94.384115][ T104] alloc_pages_noprof+0xb1/0x2b0 [ 94.384121][ T104] folio_alloc_noprof+0x1e/0x30 [ 94.384127][ T104] filemap_alloc_folio_noprof+0x111/0x460 [ 94.384134][ T104] __filemap_get_folio_mpol+0x402/0x1000 [ 94.384141][ T104] bdev_getblk+0x1f4/0x6e0 [ 94.384147][ T104] __ext4_get_inode_loc+0x56c/0xf40 [ 94.384155][ T104] ext4_get_inode_loc+0x81/0xf0 [ 94.384165][ T104] ext4_destroy_inline_data_nolock+0x140/0x5f0 [ 94.384179][ T104] ext4_destroy_inline_data+0x83/0xe0 [ 94.384192][ T104] ext4_do_writepages+0x50a/0x4770 [ 94.384202][ T104] ext4_writepages+0x241/0x3b0 [ 94.384215][ T104] do_writepages+0x338/0x560 [ 94.384227][ T104] page last free pid 5317 tgid 5316 ts 94372910143 stack trace: [ 94.384235][ T104] free_unref_folios+0xdc2/0x14e0 [ 94.384246][ T104] folios_put_refs+0x9e9/0xb30 [ 94.384254][ T104] shmem_undo_range+0x4e6/0x15d0 [ 94.384261][ T104] shmem_evict_inode+0x247/0xae0 [ 94.384269][ T104] evict+0x624/0xb50 [ 94.384278][ T104] dentry_kill+0x1b9/0x880 [ 94.384283][ T104] finish_dput+0x1a/0x260 [ 94.384290][ T104] __fput+0x675/0xa50 [ 94.384296][ T104] fput_close_sync+0x11f/0x240 [ 94.384304][ T104] __x64_sys_close+0x7e/0x110 [ 94.384311][ T104] do_syscall_64+0x166/0x520 [ 94.384318][ T104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.384327][ T104] [ 94.384330][ T104] Memory state around the buggy address: [ 94.384335][ T104] ffff88804d6c5d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.384341][ T104] ffff88804d6c5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.384347][ T104] >ffff88804d6c5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.384352][ T104] ^ [ 94.384357][ T104] ffff88804d6c5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.384364][ T104] ffff88804d6c5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.384369][ T104] ================================================================== [ 94.384426][ T104] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.685002][ T104] CPU: 0 UID: 0 PID: 104 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 94.689041][ T104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.693660][ T104] Workqueue: writeback wb_workfn (flush-7:0) [ 94.696732][ T104] Call Trace: [ 94.698277][ T104] [ 94.699643][ T104] vpanic+0x56d/0xa60 [ 94.701492][ T104] ? __pfx_vpanic+0x10/0x10 [ 94.703537][ T104] panic+0xc5/0xd0 [ 94.705221][ T104] ? __pfx_panic+0x10/0x10 [ 94.707130][ T104] ? preempt_schedule_thunk+0x16/0x40 [ 94.709466][ T104] ? preempt_schedule_thunk+0x16/0x40 [ 94.711776][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.714073][ T104] check_panic_on_warn+0x89/0xb0 [ 94.716175][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.718491][ T104] end_report+0x73/0x170 [ 94.720312][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.722614][ T104] kasan_report+0x128/0x150 [ 94.724485][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.726803][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.729169][ T104] kasan_check_range+0x264/0x2c0 [ 94.731786][ T104] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.734659][ T104] __asan_memmove+0x29/0x70 [ 94.736822][ T104] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.739050][ T104] ext4_xattr_ibody_set+0x262/0x710 [ 94.741283][ T104] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.743700][ T104] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.746488][ T104] ? down_write+0x16b/0x200 [ 94.748456][ T104] ext4_destroy_inline_data+0x83/0xe0 [ 94.750792][ T104] ext4_do_writepages+0x50a/0x4770 [ 94.753067][ T104] ? __lock_acquire+0x747/0x2de0 [ 94.755407][ T104] ? lock_acquire+0x115/0x350 [ 94.757567][ T104] ? lock_acquire+0x115/0x350 [ 94.759714][ T104] ? look_up_lock_class+0x57/0x110 [ 94.762161][ T104] ? register_lock_class+0x31/0x2e0 [ 94.764394][ T104] ? __pfx_ext4_do_writepages+0x10/0x10 [ 94.766770][ T104] ? __lock_acquire+0x747/0x2de0 [ 94.768961][ T104] ? filemap_get_folios_tag+0x639/0x720 [ 94.771364][ T104] ? filemap_get_folios_tag+0x118/0x720 [ 94.773873][ T104] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 94.776841][ T104] ? lock_acquire+0x115/0x350 [ 94.778830][ T104] ext4_writepages+0x241/0x3b0 [ 94.780808][ T104] ? __pfx_ext4_writepages+0x10/0x10 [ 94.782998][ T104] ? __pfx_ext4_writepages+0x10/0x10 [ 94.785423][ T104] do_writepages+0x338/0x560 [ 94.787493][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.789934][ T104] ? reacquire_held_locks+0x117/0x1a0 [ 94.792440][ T104] ? writeback_sb_inodes+0x450/0x1b00 [ 94.794838][ T104] __writeback_single_inode+0x136/0x1220 [ 94.797339][ T104] ? do_raw_spin_unlock+0x4d/0x200 [ 94.799626][ T104] writeback_sb_inodes+0x9de/0x1b00 [ 94.801997][ T104] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 94.804516][ T104] ? __pfx_down_read_trylock+0x10/0x10 [ 94.806914][ T104] ? __pfx___up_read+0x10/0x10 [ 94.808998][ T104] __writeback_inodes_wb+0x114/0x240 [ 94.811376][ T104] wb_writeback+0x42f/0xad0 [ 94.813448][ T104] ? queue_io+0x201/0x470 [ 94.815352][ T104] ? __pfx_wb_writeback+0x10/0x10 [ 94.817626][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.819912][ T104] wb_workfn+0x980/0x10f0 [ 94.821851][ T104] ? __pfx_wb_workfn+0x10/0x10 [ 94.823903][ T104] ? trace_hrtimer_start+0x82/0x200 [ 94.826147][ T104] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.828416][ T104] ? lock_acquire+0x115/0x350 [ 94.830534][ T104] ? rcu_is_watching+0x16/0xb0 [ 94.832642][ T104] ? process_scheduled_works+0x97a/0x1630 [ 94.835192][ T104] process_scheduled_works+0xc3d/0x1630 [ 94.837899][ T104] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.841087][ T104] ? assign_work+0x3cf/0x5d0 [ 94.843605][ T104] worker_thread+0xa47/0xfb0 [ 94.846330][ T104] kthread+0x38b/0x480 [ 94.848544][ T104] ? __pfx_worker_thread+0x10/0x10 [ 94.851303][ T104] ? __pfx_kthread+0x10/0x10 [ 94.853784][ T104] ret_from_fork+0x514/0xb70 [ 94.855833][ T104] ? __pfx_ret_from_fork+0x10/0x10 [ 94.858035][ T104] ? __switch_to+0xc89/0x1420 [ 94.860268][ T104] ? __pfx_kthread+0x10/0x10 [ 94.862713][ T104] ret_from_fork_asm+0x1a/0x30 [ 94.865373][ T104] [ 94.867458][ T104] Kernel Offset: disabled [ 94.869535][ T104] Rebooting in 86400 seconds..