program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r3, @ANYBLOB="79bc6a063d8759a9e51979dae6e35744dcb092634f07c70013c94c4507dc8466022febf2272beec3e72ffeb43ed7dda489"], 0x1c}}, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f00000002c0)='./file1\x00', 0x0, &(0x7f0000000280)={[{@acl}]}, 0x1, 0x787, &(0x7f0000001000)="$eJzs3ctrXNUfAPDvnSRNk/b3SwRB6yogaKB0YmpsFVxUXIhgoaBr22EyDTWTTMlMShMCtojgRlBxIeimax9159bHVv8LF9JSNS1WXEjkzqOdNjPppM3MBPL5wMmcc++dnPOdcx/nzr3MDWDPmkj/ZCIORcRHScRYfXoSEUPV3GDEidpyt9fX8mlKYmPjzT+S6jK31tfy0fSe1IF64cmI+PH9iMOZzfWWV1bnc8ViYalenqosnJ8qr6weObeQmyvMFRaPTc/MHD3+wvFjOxfrX7+sHrz+8WvPfnPin/eeuPrhT0mciIP1ec1x7JSJmKh/JkPpR3iPV3e6sj5L+t0AHkq6aQ7UtvI4FGMxUM21MdLLlgEA3fJuRGwAAHtM4vgPAHtM43uAW+tr+Ubq7zcSvXXjlYjYX4u/cX2zNmewfs1uf/U66Oit5J4rI0lEjO9A/RMR8cV3b3+Vpqj3g2tpQC9cuhwRZ8YnNu//k033LGzXc1vN3BiuvkzcN3mvHX+gn75Pxz8vthr/Ze6Mf6LF+Ge4xbb7MB68/Weu7UA1baXjv5eb7m273RR/3fhAvfS/6phvKDl7rlhI923/j4jJGBpOy9PVRVuP3CZv/nuzXf3N478/P3nny7T+9PXuEplrg8P3vmc2V8k9atwNNy5HPDXYKv7kTv8nbca/pzqs4/WXPvi83bw0/jTeRtocf3dtXIl4pmX/3+3LZMv7E6eqq8NUY6Vo4dtfPxttV39z/6cprb9xLtALaf+Pbh3/eNJ8v2Z5+3X8fGXsh3bzHhx/6/V/X/JWNb+vPu1irlJZmo7Yl7yxefrRu+9tlBvLp/FPPt16+69V23r9T88Jz3QY/+D1379++Pi7K41/dlv9v/3M1dvzA+3q76z/Z6q5yfqUTvZ/nTbwUT47AAAAAAAAAAAAAAAAAAAAAAAAAOhUJiIORpLJ3slnMtls7Rnej8doplgqVw6fLS0vzkb1WdnjMZRp/NTlWNPvoU7Xfw+/UT56X/n5iHgsIj4dHqmWs/lScbbfwQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA3YE2z/9P/Tbc79YBAF2zv98NAAB6zvEfAPae7R3/R7rWDgCgd5z/A8De0/Hx/0x32wEA9I7zfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs1MmTadr4e30tn5ZnL6wsz5cuHJktlOezC8v5bL60dD47VyrNFQvZfGmh7T+6VHsplkrnZ2Jx+eJUpVCuTJVXVk8vlJYXK6fPLeTmCqcLQz2LDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6V15Znc8Vi4UlmS0zI7ujGbsmMxi7ohkyXcs07yVG+reDAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjl/gsAAP//IIYqoQ==") r4 = open(&(0x7f0000000080)='./file1\x00', 0x80242, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x60, r2, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x59}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0xad}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x7}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x706}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x400}, @NL80211_ATTR_NOACK_MAP={0x6}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x9}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x3}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0xfff7}]}, 0x60}, 0x1, 0x0, 0x0, 0xc00}, 0x4004001) pwrite64(r5, &(0x7f0000000140)='2', 0x1, 0x8080c61) lseek(r4, 0x3c, 0x4) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f00000004c0)=@mgmt_frame=@probe_response={{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @val={0x2d, 0x1a, {0x1000, 0x2, 0x2, 0x0, {0x8, 0x9, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1}, 0x1, 0x5, 0x4}}, @void, @void}, 0x4b) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f00000000c0), 0xa, 0x46c42) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200"}}) r8 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r8, 0x4c02, &(0x7f0000000640)={0x0, {}, 0x0, {}, 0x7fff, 0x0, 0xfffffffd, 0x0, "22536af39b7c7cb7435b0a43852dbc3a9ada34cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "0410b15a7d62289113be3626f4e23806009c7416000000000019b0cff500", [0x3, 0xf9f]}) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000017c0)={0x524, r9, 0x1, 0x70bd25, 0x0, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x64cc, 0x25}}}}, [@NL80211_ATTR_FRAME={0x4f9, 0x33, @auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x7}, @device_b, @broadcast, @random="49277430aa77", {0x0, 0x8}}, 0x0, 0x4, 0x31, @void, [{0xdd, 0x7e, "a400ef1135624b3e5b89cf1412c04b050da2e2ef5e2d82fba24122f1695df8c62c30ae445cd4c6a520066e3bdf1ce0e99a73ad5c186d5c66a31b6c8546a164f1afa1c65b6ac07fb1385151e50bd6336f1877c22291b65961eed1d228776453a33a2312996cf5dd7d52bef23142203eaf68c86999b30eb081943a05514686"}, {0xdd, 0xd9, "9af2e0aeb98596966bce17cdfd98db9299cdb88cb4b72f2b64d8feeafd75ce6e24633d1e00000000000000008c7ea6414bb2fce70045b413fc710d18a9d4c720357062fd6b5216732869d20d415d2e3973e6904c7f6dd6a919af4f926f7aaff8fb49f8e5d1e50934c61cf7a5298d1d1d455be8d3d1ed973dd07c1b11a7a0f2bf140023cde7726b89dd4d4ac1ffa18943760dfb236beabf042d55969e2750909391528b4d2b5fe75f8dfd23ce8d9938a0c66f5f7e79896877c3a3e3cc232ef4da45fb96d538746ea8a521a835bc9197a7c9341fec5f6c37924f"}, {0xdd, 0x5d, "c70d848be7cecc186d72e584d5b0f7b44f57e39e3a6639824b38a84ed8cadc27c53ae5f10fbf0b7fc4af7dc982ddc2db09112a867eb2e99eae5cec071b266423b0b0537ed78a31e9a38d458be9f131ab3c141e019664a98f0000000000"}, {0xdd, 0xd, "201e8a4051bdb6efa7e0783f99"}, {0xdd, 0xae, "127b657035a085e016820d9c0e478a9120f488092cede9ac2ba9bc8814862c1a9ebffbec3ceddf7ce59436abcc883f0466df85c48185082933290d125fe05f7c76b8137178a0b3138f16827e716c4764793356310f01e9f6e4b06affcf896b0d67c0310074cb3047273cea258dc04d6cf602c9e317b827b83598a92e437ded2a7e3c6311e2c964f2ea92f9bd8a87d55590765efc421a3cf50256cc8e4e439f66daf9042f64abce6e54e9c3b7ff54"}, {0xdd, 0x36, "2ac5670447dbe971ca5339208b6715a0531ce04669cf83383c83dbcfb294a27a629b4b1e42ad2d960bc4544d905dfdb26386e6e4d5e8"}, {0xdd, 0x70, "e3616559bb0407ae7ba88b0d2ae6f02a0dc9fd336527e5b98a7f1dce0f74e1d823997e482a7429ab2e7420b634c0e568c993e2d578248401a3418fc383547a4377b920f019c6e8564cafa46b194354e37e34209af66368a3fe7476540b229e18919a910621ab2e729f14b72cb4b0849d"}, {0xdd, 0xc0, "388d7cd5db31c28326751160b6bdab5cfdc3def4f80db16d4a7449f777ce199f3db849b6eee89bc920eceed52c3dd2bb619b3386670f34fe7906346f06a4a15d7c47ea55b343456faea319434c18cc30d8861674d61c6f1923b0fbc33b4950b52223f21fb9cb8bd664c55572d94216dc03578b44942d61dcdd3f08f8a6e528fd78e75034120a647f3d2f0c9acd9d144fb37b45cb7f7bf359c959bdb39b1832b849f8f66b4130c6e1345b03d0cd52d304e22474e7f1394e2f9a981118a0c7ec92"}, {0xdd, 0xf0, "f6076d0a7d32e0ba3f985167423ec18040aa66c7f14017012c0474615cae35a4b0d988f8ecb9891ad9b98d0e5e246d1781f2e450312d43b20317572a5c3cc6342794e3d5b43d0dca32923a3c73ddcaae715de55eaf6dd2a0bb1c3ed2328917619defe5499e4dc75add2d239ba2de411f293cb26920d14a1f17e33f9db31bde11eb9ad988d5b28c964bf184150ea4e0c01eace4534659a587c9ae4ce8569be6eed6a6d6913b496bd838ad60d610038f19f4e89de243fd1cfaed1c078594ca2dd6c7a8a5102b40cf299bf1636fafd2cd77c7920e4d7ebc333163675cec57ee1a563ecfafe09f2837ada7765317871ccf79"}]}}]}, 0x524}, 0x1, 0x0, 0x0, 0x88}, 0x0) [ 92.974274][ T4640] Bluetooth: hci0: command tx timeout [ 92.980508][ T932] cfg80211: failed to load regulatory.db [ 93.106885][ T5312] loop0: detected capacity change from 0 to 2048 [ 93.178236][ T5312] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.201920][ T5312] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 93.222471][ T5312] loop0: detected capacity change from 2048 to 1984 [ 93.292623][ T5311] ================================================================== [ 93.292634][ T5311] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292711][ T5311] Read of size 18446744073709551600 at addr ffff8880526d6eb8 by task syz.0.0/5311 [ 93.292720][ T5311] [ 93.292728][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.292740][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.292747][ T5311] Call Trace: [ 93.292762][ T5311] [ 93.292768][ T5311] dump_stack_lvl+0xe8/0x150 [ 93.292789][ T5311] print_address_description+0x55/0x1e0 [ 93.292808][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292816][ T5311] print_report+0x58/0x70 [ 93.292824][ T5311] kasan_report+0x117/0x150 [ 93.292832][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292842][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292850][ T5311] kasan_check_range+0x264/0x2c0 [ 93.292858][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292866][ T5311] __asan_memmove+0x29/0x70 [ 93.292876][ T5311] ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.292888][ T5311] ext4_xattr_ibody_set+0x262/0x710 [ 93.292897][ T5311] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 93.292909][ T5311] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 93.292921][ T5311] ? down_write+0x16b/0x200 [ 93.292969][ T5311] ext4_destroy_inline_data+0x83/0xe0 [ 93.292984][ T5311] ext4_do_writepages+0x50a/0x4770 [ 93.292995][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293008][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293021][ T5311] ? lock_acquire+0x115/0x350 [ 93.293032][ T5311] ? lock_acquire+0x115/0x350 [ 93.293042][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293053][ T5311] ? look_up_lock_class+0x57/0x110 [ 93.293062][ T5311] ? register_lock_class+0x31/0x2e0 [ 93.293069][ T5311] ? __pfx_ext4_do_writepages+0x10/0x10 [ 93.293076][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293083][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293091][ T5311] ? lock_acquire+0x115/0x350 [ 93.293100][ T5311] ext4_writepages+0x241/0x3b0 [ 93.293109][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.293115][ T5311] ? __pfx_ext4_writepages+0x10/0x10 [ 93.293124][ T5311] ? is_bpf_text_address+0x26/0x2b0 [ 93.293134][ T5311] ? __mutex_trylock_common+0x15f/0x270 [ 93.293144][ T5311] ? __pfx_ext4_writepages+0x10/0x10 [ 93.293153][ T5311] do_writepages+0x338/0x560 [ 93.293164][ T5311] ? do_raw_spin_unlock+0x4d/0x200 [ 93.293176][ T5311] filemap_flush+0x1e1/0x2e0 [ 93.293192][ T5311] ? __pfx_filemap_flush+0x10/0x10 [ 93.293205][ T5311] ? locks_remove_file+0x11a/0xf40 [ 93.293231][ T5311] ? rcu_is_watching+0x16/0xb0 [ 93.293245][ T5311] ext4_release_file+0x82/0x310 [ 93.293256][ T5311] ? __pfx_ext4_release_file+0x10/0x10 [ 93.293300][ T5311] __fput+0x418/0xa50 [ 93.293314][ T5311] task_work_run+0x1d9/0x270 [ 93.293326][ T5311] ? __pfx_task_work_run+0x10/0x10 [ 93.293340][ T5311] exit_to_user_mode_loop+0x204/0x770 [ 93.293352][ T5311] ? rcu_is_watching+0x16/0xb0 [ 93.293364][ T5311] do_syscall_64+0x328/0x520 [ 93.293378][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.293389][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 93.293401][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.293411][ T5311] RIP: 0033:0x7f731f19e159 [ 93.293422][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.293430][ T5311] RSP: 002b:00007ffe3d92c918 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.293443][ T5311] RAX: 0000000000000000 RBX: 00007ffe3d92ca00 RCX: 00007f731f19e159 [ 93.293451][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.293458][ T5311] RBP: 0000000000016ad9 R08: 0000000000000001 R09: 0000000000000000 [ 93.293464][ T5311] R10: 00007f731efff030 R11: 0000000000000246 R12: 00007ffe3d92ca40 [ 93.293471][ T5311] R13: 00007f731f425fac R14: 0000000000016bef R15: 00007f731f425fa0 [ 93.293482][ T5311] [ 93.293486][ T5311] [ 93.293488][ T5311] The buggy address belongs to the physical page: [ 93.293493][ T5311] page: refcount:3 mapcount:0 mapping:ffff88801d025940 index:0x2 pfn:0x526d6 [ 93.293515][ T5311] memcg:ffff888042e46500 [ 93.293521][ T5311] aops:def_blk_aops ino:700000 dentry name(?):"" [ 93.293612][ T5311] flags: 0x4fff18000004004(referenced|private|node=1|zone=1|lastcpupid=0x7ff) [ 93.293627][ T5311] raw: 04fff18000004004 0000000000000000 dead000000000122 ffff88801d025940 [ 93.293636][ T5311] raw: 0000000000000002 ffff888043cff540 00000003ffffffff ffff888042e46500 [ 93.293642][ T5311] page dumped because: kasan: bad access detected [ 93.293648][ T5311] page_owner tracks the page as allocated [ 93.293652][ T5311] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5311, tgid 5311 (syz.0.0), ts 93290380354 [ 93.293668][ T5311] post_alloc_hook+0x1f9/0x250 [ 93.293683][ T5311] get_page_from_freelist+0x2209/0x2280 [ 93.293697][ T5311] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 93.293711][ T5311] alloc_pages_mpol+0x21e/0x390 [ 93.293722][ T5311] alloc_pages_noprof+0xb1/0x2b0 [ 93.293732][ T5311] folio_alloc_noprof+0x1e/0x30 [ 93.293741][ T5311] filemap_alloc_folio_noprof+0x111/0x460 [ 93.293751][ T5311] __filemap_get_folio_mpol+0x402/0x1000 [ 93.293761][ T5311] bdev_getblk+0x1f4/0x6e0 [ 93.293771][ T5311] __ext4_get_inode_loc+0x56c/0xf40 [ 93.293788][ T5311] ext4_get_inode_loc+0x81/0xf0 [ 93.293799][ T5311] ext4_destroy_inline_data_nolock+0x140/0x5f0 [ 93.293813][ T5311] ext4_destroy_inline_data+0x83/0xe0 [ 93.293823][ T5311] ext4_do_writepages+0x50a/0x4770 [ 93.293832][ T5311] ext4_writepages+0x241/0x3b0 [ 93.293844][ T5311] do_writepages+0x338/0x560 [ 93.293858][ T5311] page last free pid 5275 tgid 5275 ts 93247572012 stack trace: [ 93.293866][ T5311] free_unref_folios+0xdc2/0x14e0 [ 93.293877][ T5311] folio_batch_move_lru+0x877/0xa60 [ 93.293889][ T5311] lru_add_drain_cpu+0xbb/0x950 [ 93.293900][ T5311] lru_add_drain+0x121/0x3e0 [ 93.293916][ T5311] __folio_batch_release+0x48/0x90 [ 93.293927][ T5311] shmem_undo_range+0x4e6/0x15d0 [ 93.293936][ T5311] shmem_evict_inode+0x247/0xae0 [ 93.293949][ T5311] evict+0x624/0xb50 [ 93.293962][ T5311] dentry_kill+0x1b9/0x880 [ 93.293970][ T5311] finish_dput+0x1a/0x260 [ 93.293981][ T5311] filename_renameat2+0x61b/0x9a0 [ 93.293992][ T5311] __se_sys_rename+0x55/0x2c0 [ 93.294002][ T5311] do_syscall_64+0x166/0x520 [ 93.294013][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.294023][ T5311] [ 93.294025][ T5311] Memory state around the buggy address: [ 93.294030][ T5311] ffff8880526d6d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.294037][ T5311] ffff8880526d6e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.294044][ T5311] >ffff8880526d6e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.294049][ T5311] ^ [ 93.294054][ T5311] ffff8880526d6f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.294060][ T5311] ffff8880526d6f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.294065][ T5311] ================================================================== [ 93.294135][ T5311] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.587322][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.591302][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.595536][ T5311] Call Trace: [ 93.596971][ T5311] [ 93.598262][ T5311] vpanic+0x56d/0xa60 [ 93.600050][ T5311] ? __pfx_vpanic+0x10/0x10 [ 93.601988][ T5311] panic+0xc5/0xd0 [ 93.603761][ T5311] ? __pfx_panic+0x10/0x10 [ 93.605572][ T5311] ? preempt_schedule_thunk+0x16/0x40 [ 93.607797][ T5311] ? preempt_schedule_thunk+0x16/0x40 [ 93.610074][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.612294][ T5311] check_panic_on_warn+0x89/0xb0 [ 93.614450][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.616804][ T5311] end_report+0x73/0x170 [ 93.618738][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.621161][ T5311] kasan_report+0x128/0x150 [ 93.623063][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.625342][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.627682][ T5311] kasan_check_range+0x264/0x2c0 [ 93.629663][ T5311] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.631719][ T5311] __asan_memmove+0x29/0x70 [ 93.633495][ T5311] ext4_xattr_set_entry+0x92b/0x1ed0 [ 93.635536][ T5311] ext4_xattr_ibody_set+0x262/0x710 [ 93.637656][ T5311] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 93.640169][ T5311] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 93.643039][ T5311] ? down_write+0x16b/0x200 [ 93.645027][ T5311] ext4_destroy_inline_data+0x83/0xe0 [ 93.647224][ T5311] ext4_do_writepages+0x50a/0x4770 [ 93.649036][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.651401][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.653704][ T5311] ? lock_acquire+0x115/0x350 [ 93.655568][ T5311] ? lock_acquire+0x115/0x350 [ 93.657354][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.659407][ T5311] ? look_up_lock_class+0x57/0x110 [ 93.661475][ T5311] ? register_lock_class+0x31/0x2e0 [ 93.663614][ T5311] ? __pfx_ext4_do_writepages+0x10/0x10 [ 93.665975][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.668259][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.670300][ T5311] ? lock_acquire+0x115/0x350 [ 93.672126][ T5311] ext4_writepages+0x241/0x3b0 [ 93.674027][ T5311] ? __lock_acquire+0x747/0x2de0 [ 93.676166][ T5311] ? __pfx_ext4_writepages+0x10/0x10 [ 93.678334][ T5311] ? is_bpf_text_address+0x26/0x2b0 [ 93.680399][ T5311] ? __mutex_trylock_common+0x15f/0x270 [ 93.682634][ T5311] ? __pfx_ext4_writepages+0x10/0x10 [ 93.684790][ T5311] do_writepages+0x338/0x560 [ 93.686672][ T5311] ? do_raw_spin_unlock+0x4d/0x200 [ 93.688778][ T5311] filemap_flush+0x1e1/0x2e0 [ 93.690676][ T5311] ? __pfx_filemap_flush+0x10/0x10 [ 93.692859][ T5311] ? locks_remove_file+0x11a/0xf40 [ 93.695076][ T5311] ? rcu_is_watching+0x16/0xb0 [ 93.697126][ T5311] ext4_release_file+0x82/0x310 [ 93.699318][ T5311] ? __pfx_ext4_release_file+0x10/0x10 [ 93.701689][ T5311] __fput+0x418/0xa50 [ 93.703419][ T5311] task_work_run+0x1d9/0x270 [ 93.705170][ T5311] ? __pfx_task_work_run+0x10/0x10 [ 93.707271][ T5311] exit_to_user_mode_loop+0x204/0x770 [ 93.709501][ T5311] ? rcu_is_watching+0x16/0xb0 [ 93.711484][ T5311] do_syscall_64+0x328/0x520 [ 93.713480][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.716130][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 93.718247][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.720830][ T5311] RIP: 0033:0x7f731f19e159 [ 93.722755][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.730825][ T5311] RSP: 002b:00007ffe3d92c918 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.734530][ T5311] RAX: 0000000000000000 RBX: 00007ffe3d92ca00 RCX: 00007f731f19e159 [ 93.738006][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.741384][ T5311] RBP: 0000000000016ad9 R08: 0000000000000001 R09: 0000000000000000 [ 93.744634][ T5311] R10: 00007f731efff030 R11: 0000000000000246 R12: 00007ffe3d92ca40 [ 93.747961][ T5311] R13: 00007f731f425fac R14: 0000000000016bef R15: 00007f731f425fa0 [ 93.751240][ T5311] [ 93.752985][ T5311] Kernel Offset: disabled [ 93.754637][ T5311] Rebooting in 86400 seconds..