program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="24000000aa686a4b6a3e0e93e0a04bd2285543f39b9828f826d52c87b86c399451741162bc7d98ceb5abb4240f21815dfd0aa12cd53070396a8e307d4629bcb4b75968af269a2669eb7a56c2a10819dfae9d35e481dc61059d81fc491023ac2dbdd220b5fdf4584ae20b2bb8993acb5779c1c32ae805201e419a5b", @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r2, @ANYBLOB="0a00340002020202020200000800e38004000000"], 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0xe, &(0x7f0000000140)={[{@sysvgroups}, {@acl}, {@noauto_da_alloc}, {@minixdf}, {@dax_never}, {@quota}]}, 0x3, 0x469, &(0x7f0000000300)="$eJzs3MtvG8UfAPDvbh59/hr/Snn0AQQKIuKRNGmBHriAQOIAEhIcyjEkaVWaNqgJEq0qCAgViQuqxB0hTkj8BZzggoATEle4o0oV6qWFU9Dau4nj2q7txDHUn4+07czurGe+3h17difrAPrWaPZPErE7In6LiJFKdn2B0cp/N69fmvnr+qXtEbHy+p9JudyN65dmiqLFfrvyzFgakX6cxME69S5euHhmen5+7nyen1g6+87E4oWLT50+O31q7tTcuanjx48dnXz2mamnb9n38kj7cWa73Djw/sKh/S+/eeXVmRNX3vrpm6SIvyaO+krtVjnabOOjKyvtvt6/2v+q0slgDxtCWwYiIjtcQ+X+PxIDsXbwRuKlj3raOKCrVnINNi+vAHewJHrdAqA3ii/67Pq3WLZu9NF7156vXABlcd/Ml8qWwUjzMkM117ebaTQiTiz//UW2REv3IQAANua7bPzzZL3xXxr3VJXbk8+hlCLi/xGxNyLuioh9EXF3RLnsvRFxX5v1106S3PgqrVmTXu0krlZl47/n8rmt9eO/NJYridJAOVcZA5ZiKDl5en7uSP6ejMXQtiw/2aSO71/89bNG26rHf9mS1V+MBfN2XB3ctn6f2eml6Y1FvebahxEHBuvFn6zOBCQRsT8iDnRYx+nHvz7UaNtoLN8m/kY2Z5Jp5cuIxyrHfzlq4i8kzecnJ7bH/NyRieKsuNXPv1x+rVH9tz/+3ZUd/511z//V+EtJ9XztYvt1XP79k4bXNJ2e/8PJG+X0cL7uvemlpfOTEcPJK5VGV6+fWtu3yBfls/jHDtfv/3tj7Z04GBHZSXx/RDwQEQ/mbX8oIh6OiMNN4v/xhUfe7jz+7srin23r+K8lhqN2Tf3EwJkfvl1Xaamd+LPjf6ycGsvXtPL510q7OjubAQAA4L8njYjdkaTjq+k0HR+v/A3/vtiZzi8sLj1xcuHdc7OVZwRKMZQWd7pGqu6HTq5e1lfyU3m+2H40v2/8+cCOcn58ZmF+ttfBQ5/b1aD/Z/4YqLvLtq1tIdBVnteC/qX/Q//S/6F/ddD/h7rRDmDr1en/O3rRDmDr1fv+/6AH7QC2Xk3/rz/tB9yR3P+D/qX/Q//S/6EvLe6Ipg/Jx/KecrnWnvRvmvg0/0WBjb6ORKuJiM14neKHIGo2Rdr7ACW6l+jdZxIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBm+icAAP//hnHfnA==") mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount(0x0, &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x20, 0x0) syz_mount_image$udf(&(0x7f0000000080), &(0x7f0000000500)='./bus\x00', 0x18418, &(0x7f0000000200)=ANY=[@ANYRES8=0x0, @ANYRES8], 0xfe, 0x4b1, &(0x7f0000001d00)="$eJzs201sVNUbx/HfM3c6TIf+/5YXCxgCTTSxgkBfsEBqYnix0YQXLVQj8SWVTrHSdkinKCUgLNWdC5Yu3bpwZdwaEpfGhcEYFibIxs2sxB3m3LlvM5TOjG1nKP1+CJx7zzx3OOc8c+ecM5kRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQjrx6uLfPWt0KAADQTCdPj/QOMP8DALCmnGH/DwAAsJaYPP0u054LJTvhn5dlj0/OXLo8emx44cvaTaaUPD/e/c329Q/sf2nwwMGwXPz65bZNp06fOdx9tDB9cTZfLObHu0dnJs8VxvN1P8NSr6+2yx+A7ukLl8YnJord/XsHKh6+3Hlv3fquzqHB945mwtjRY8PDpxMx6bb//L8/5FEr/Iw8vSDTx99/ayclpbT0sajx2llp7X4ndvmdGD027HdkanJsZs49aKkgKlU5JplwjJqQiyVJSa5dllmePVubPP0g05F9JTslyQvHYbf/wXBd7WmFtNu6SurRKsjZY2ydPH0g0619nXojGFc//xnpaqsbhxWXDu7/gpXsTf/9wN1P7m3z+Fvdr89MFBKxlgruqNU+PzTTY/7elJWnU/4dX7IR7Wx1c9Bk7fI0LVPmq0/8dYX8delTQwd27DyUXGFsqfE8LnZvcHPVMye3BUsHS7k/y98v1Cdrnv6U6f5vWf+8J5wDpBsPFrvwj6Y0DyvNPE3J9M+1klnVvtRL7O8jq33uX9n2t2ePFi7Oz06e/2huwcdz2cMfFudmx84t/HB57+ola2rtY6ulGtuS5ay84/v801J0XbAH+F/5LG7NN1fj10JPVRlKvn7qOa57F9vAOsq1yczTXZkm3t9anmeUa3hs1gKX/2GZiqWfLcx0kP90+SyR/5fj8ctaZRnxc/v/8uda4Vpi29nNj6pfify7Nrn8vyPTkb+3Bp9plPPvVcW6uC6Z3r25PYhLZVxcOuxO+RknJqfyvS72gUwbfwpj5cfmgthNcWyfiy3K9MWtytj1QezmOLbfxd6W6c6vC8c+HccOuNh5l6873WFszsXuCGK74ti95wpT47WG1eW/X6a3r79mYZ8fmf/E/X+jqow8lPPFj5cr/52JuhtBXs8G+U/XyP+XMs3/tT3stz/24ctqg/9vnH+3Vv7uZmVsuKHcGMf21dutVnP53yDTvVduR30O+hacxhlK5v+ZdGUZjWuL8r8hUdcZtCvT4FisRcX5KxfGpqbysxxwwAEH0UGr35nQDG7+H3Gz+qBn4TommP87ymfxiun+Z/H8P1RVRlo0/29M1A0Fq5a2tJSdm77YtkXKFuev7JmcHjufP5+fGdg/2Nt/aH/vwMG2TLi4i4/qHrsngcv/bpmu/fhLtI+pXP8tvP7PVZWRFuV/U7JPFeuauodiTXL575Bp8O7taL+52Po/3P/3PFtZRvdfi/K/OVHXGbSro8GxAAAAAAAAAAAAAAAAAIDVJGeenpPp8siLFv6GqJ7v/41XlZHl//5X+YfJNb7/1ZWoG2/S7xoaGmgAAAAAAAAAAIAmScnT1zI9r5JddxUd0olkiSfavwEAAP//G6xIAA==") setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3ccf9c7f0f0b5049040000000000be7237537517208100"/35, @ANYRES32=r7, @ANYBLOB="00000000000000001c0012800b00010062726964676500000c0002800500070007000000"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x509, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="380000005500e501000000000000000007000000", @ANYRES32=r10, @ANYBLOB="20000100", @ANYRES32=r12, @ANYBLOB="000070dbf9fc3265a872d7e5b85fd300000009fffbffff000000000000b60869dfc53d1c1f7090e5000100000000000000"], 0x38}}, 0x0) truncate(&(0x7f0000000100)='./file1\x00', 0x20fdfffffe) r13 = syz_open_dev$loop(&(0x7f0000000180), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r13, 0x4c02, &(0x7f0000000780)={0x0, {}, 0x0, {}, 0x4, 0x4, 0xffffffff, 0x0, "22b7435b0a43852dbc3a9ada34cc97af10fd4faea15748328c53096c2f359e9ba743d30b59c491a7b3e74d9389515d1002374a1d61471af78d462ea537e61800", "0410b1617b6268917d94b72c2e9e13be3626fce20000f5da74161ccef2c5cf5e", [0x3, 0xffffffffffffbfff]}) r14 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1, 0x100) pwrite64(r14, &(0x7f00000008c0)="468c1e913ed1d8686c91ee9c81078d63322b23cf3827bed99f0f03c03815e074bc841df48435959bbcde8281660233129c3467f56ac85cef57fcd9b985f514ca3e7d8b3bbb5c368c2ce0835f5477d30993d38c0cad05600d72c75317a1e5a3c507fa78e0f33a748acd72b20101d367f9d9b0609dc85262f2186fe6c2f39e4c1e9a5fe58ea19f4bde94391efd6d05f975ac95712860504c18820743edf357d910e02cfe816c40e213d8e84afe9b99cba7c7d37afade2da452ba712abd1593ea4d3ea0ce8df0f018636b6431fe8b62e3ee9b939970b9f53010ea", 0xd9, 0xf7c) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=@gettaction={0x78, 0x32, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x84ca58915b3e5d6e}}, @action_gd=@TCA_ACT_TAB={0x50, 0x1, [{0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffff7}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x1) [ 87.938138][ T5274] cgroup: Unknown subsys name 'net' [ 88.008619][ T5274] cgroup: Unknown subsys name 'cpuset' [ 88.011990][ T5274] cgroup: Unknown subsys name 'rlimit' [ 89.659967][ T5274] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 89.837091][ T46] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.838749][ T46] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.839646][ T46] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.841058][ T46] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.841439][ T46] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.382407][ T5282] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.383200][ T5282] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.383579][ T5282] bridge_slave_0: entered allmulticast mode [ 90.384933][ T5282] bridge_slave_0: entered promiscuous mode [ 90.404184][ T5282] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.404232][ T5282] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.404474][ T5282] bridge_slave_1: entered allmulticast mode [ 90.406281][ T5282] bridge_slave_1: entered promiscuous mode [ 90.448605][ T5282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.450916][ T5282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.492396][ T5282] team0: Port device team_slave_0 added [ 90.494714][ T5282] team0: Port device team_slave_1 added [ 90.522806][ T5282] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.522820][ T5282] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.522834][ T5282] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.524861][ T5282] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.524869][ T5282] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.524878][ T5282] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.639760][ T5282] hsr_slave_0: entered promiscuous mode [ 90.641222][ T5282] hsr_slave_1: entered promiscuous mode [ 90.897979][ T5282] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.910793][ T5282] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.916431][ T5282] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.920090][ T5282] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.921405][ T5282] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.939166][ T5282] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.940980][ T5282] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.957910][ T5282] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.987157][ T5282] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.987230][ T5282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.987868][ T5282] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.987949][ T5282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.066503][ T5282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.094903][ T958] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.096693][ T958] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.124907][ T5282] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.149738][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.150154][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.169070][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.169216][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.818704][ T5282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.885019][ T4647] Bluetooth: hci0: command tx timeout [ 91.901697][ T807] cfg80211: failed to load regulatory.db [ 91.941468][ T5282] veth0_vlan: entered promiscuous mode [ 91.953908][ T5282] veth1_vlan: entered promiscuous mode [ 91.996355][ T5282] veth0_macvtap: entered promiscuous mode [ 92.001400][ T5282] veth1_macvtap: entered promiscuous mode [ 92.029676][ T5282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.031916][ T5282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.095767][ T44] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.096062][ T44] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.172939][ T44] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.223301][ T958] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.223318][ T958] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.315016][ T958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.315035][ T958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.336353][ T54] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.423920][ T5282] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 94.534593][ T4647] Bluetooth: hci0: command tx timeout [ 94.711308][ T5321] loop0: detected capacity change from 0 to 512 [ 94.717948][ T5321] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 94.718011][ T5321] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 94.753329][ T5321] EXT4-fs (loop0): 1 truncate cleaned up [ 94.844880][ T5321] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 94.881677][ T5321] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 94.914374][ T5321] loop0: detected capacity change from 512 to 511 [ 94.919113][ T5321] ================================================================== [ 94.919140][ T5321] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919276][ T5321] Read of size 18446744073709551600 at addr ffff88804d73c2b8 by task syz.0.0/5321 [ 94.919287][ T5321] [ 94.919294][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.919308][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.919316][ T5321] Call Trace: [ 94.919321][ T5321] [ 94.919327][ T5321] dump_stack_lvl+0xe8/0x150 [ 94.919346][ T5321] print_address_description+0x55/0x1e0 [ 94.919360][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919374][ T5321] print_report+0x58/0x70 [ 94.919387][ T5321] kasan_report+0x117/0x150 [ 94.919399][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919412][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919425][ T5321] kasan_check_range+0x264/0x2c0 [ 94.919436][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919450][ T5321] __asan_memmove+0x29/0x70 [ 94.919464][ T5321] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.919482][ T5321] ext4_xattr_ibody_set+0x262/0x710 [ 94.919498][ T5321] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.919518][ T5321] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.919533][ T5321] ? ext4_read_inline_folio+0x6fe/0x860 [ 94.919550][ T5321] ? __pfx_ext4_read_inline_folio+0x10/0x10 [ 94.919564][ T5321] ? down_write+0x16b/0x200 [ 94.920537][ T5321] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.920551][ T5321] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.920567][ T5321] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.920581][ T5321] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.920598][ T5321] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.920611][ T5321] ? ext4_file_write_iter+0xae4/0x1cd0 [ 94.920620][ T5321] ? __x64_sys_pwrite64+0x196/0x220 [ 94.920634][ T5321] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.920645][ T5321] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.920659][ T5321] ? ext4_try_to_write_inline_data+0x49/0x90 [ 94.920673][ T5321] ext4_write_begin+0x3bd/0x1900 [ 94.920691][ T5321] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.920705][ T5321] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 94.920724][ T5321] generic_perform_write+0x2d5/0x8f0 [ 94.920738][ T5321] ? do_raw_spin_unlock+0x4d/0x200 [ 94.920755][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 94.920768][ T5321] ? file_update_time_flags+0x3ab/0x440 [ 94.920786][ T5321] ext4_buffered_write_iter+0xd4/0x380 [ 94.920797][ T5321] ? __pfx_futex_wake_mark+0x10/0x10 [ 94.920814][ T5321] ext4_file_write_iter+0xae4/0x1cd0 [ 94.920837][ T5321] ? lock_acquire+0x115/0x350 [ 94.920848][ T5321] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.920863][ T5321] vfs_write+0x612/0xba0 [ 94.920880][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 94.920897][ T5321] ? __fget_files+0x2a/0x420 [ 94.920910][ T5321] __x64_sys_pwrite64+0x196/0x220 [ 94.920923][ T5321] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 94.920938][ T5321] do_syscall_64+0x166/0x520 [ 94.920949][ T5321] ? trace_irq_disable+0x3b/0x140 [ 94.920961][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.920970][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 94.920981][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.920990][ T5321] RIP: 0033:0x7ff21279e159 [ 94.921000][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.921009][ T5321] RSP: 002b:00007ff213628fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 94.921022][ T5321] RAX: ffffffffffffffda RBX: 00007ff212a25fa0 RCX: 00007ff21279e159 [ 94.921030][ T5321] RDX: 00000000000000d9 RSI: 00002000000008c0 RDI: 000000000000000e [ 94.921037][ T5321] RBP: 00007ff21283506b R08: 0000000000000000 R09: 0000000000000000 [ 94.921044][ T5321] R10: 0000000000000f7c R11: 0000000000000246 R12: 0000000000000000 [ 94.921050][ T5321] R13: 00007ff212a26038 R14: 00007ff212a25fa0 R15: 00007ffc2b58c968 [ 94.921062][ T5321] [ 94.921066][ T5321] [ 94.921069][ T5321] The buggy address belongs to the physical page: [ 94.921075][ T5321] page: refcount:3 mapcount:0 mapping:ffff88801d025940 index:0x2 pfn:0x4d73c [ 94.921085][ T5321] memcg:ffff88800bf7c380 [ 94.921092][ T5321] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.921222][ T5321] flags: 0x4fff18000004214(referenced|dirty|workingset|private|node=1|zone=1|lastcpupid=0x7ff) [ 94.921239][ T5321] raw: 04fff18000004214 0000000000000000 dead000000000122 ffff88801d025940 [ 94.921249][ T5321] raw: 0000000000000002 ffff888044200e00 00000003ffffffff ffff88800bf7c380 [ 94.921254][ T5321] page dumped because: kasan: bad access detected [ 94.921260][ T5321] page_owner tracks the page as allocated [ 94.921264][ T5321] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5321, tgid 5320 (syz.0.0), ts 94915858939 [ 94.921281][ T5321] post_alloc_hook+0x1f9/0x250 [ 94.921295][ T5321] get_page_from_freelist+0x2209/0x2280 [ 94.921311][ T5321] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.921325][ T5321] alloc_pages_mpol+0x21e/0x390 [ 94.921334][ T5321] alloc_pages_noprof+0xb1/0x2b0 [ 94.921342][ T5321] folio_alloc_noprof+0x1e/0x30 [ 94.921351][ T5321] filemap_alloc_folio_noprof+0x111/0x460 [ 94.921361][ T5321] __filemap_get_folio_mpol+0x402/0x1000 [ 94.921371][ T5321] bdev_getblk+0x1f4/0x6e0 [ 94.921380][ T5321] __ext4_get_inode_loc+0x56c/0xf40 [ 94.921392][ T5321] ext4_get_inode_loc+0x81/0xf0 [ 94.921403][ T5321] ext4_xattr_ibody_get+0x113/0x4b0 [ 94.921416][ T5321] ext4_xattr_get+0x121/0x690 [ 94.921427][ T5321] __vfs_getxattr+0x412/0x440 [ 94.921443][ T5321] cap_inode_need_killpriv+0x45/0x60 [ 94.921459][ T5321] security_inode_need_killpriv+0x85/0x240 [ 94.921475][ T5321] page last free pid 5321 tgid 5320 ts 94889059399 stack trace: [ 94.921484][ T5321] free_unref_folios+0xdc2/0x14e0 [ 94.921498][ T5321] folios_put_refs+0x9e9/0xb30 [ 94.921511][ T5321] shmem_undo_range+0x4e6/0x15d0 [ 94.921520][ T5321] shmem_evict_inode+0x247/0xae0 [ 94.921530][ T5321] evict+0x624/0xb50 [ 94.921539][ T5321] dentry_kill+0x1b9/0x880 [ 94.921545][ T5321] finish_dput+0x1a/0x260 [ 94.921552][ T5321] __fput+0x675/0xa50 [ 94.921559][ T5321] fput_close_sync+0x11f/0x240 [ 94.921565][ T5321] __x64_sys_close+0x7e/0x110 [ 94.921572][ T5321] do_syscall_64+0x166/0x520 [ 94.921580][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.921586][ T5321] [ 94.921588][ T5321] Memory state around the buggy address: [ 94.921592][ T5321] ffff88804d73c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.921596][ T5321] ffff88804d73c200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.921601][ T5321] >ffff88804d73c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.921604][ T5321] ^ [ 94.921608][ T5321] ffff88804d73c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.921615][ T5321] ffff88804d73c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.921621][ T5321] ================================================================== [ 95.145924][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.251355][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.255155][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.260386][ T5321] Call Trace: [ 95.261914][ T5321] [ 95.263240][ T5321] vpanic+0x56d/0xa60 [ 95.265096][ T5321] ? __pfx_vpanic+0x10/0x10 [ 95.267163][ T5321] panic+0xc5/0xd0 [ 95.268916][ T5321] ? __pfx_panic+0x10/0x10 [ 95.270912][ T5321] ? preempt_schedule_thunk+0x16/0x40 [ 95.273201][ T5321] ? preempt_schedule_thunk+0x16/0x40 [ 95.275599][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.277934][ T5321] check_panic_on_warn+0x89/0xb0 [ 95.280059][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.282343][ T5321] end_report+0x73/0x170 [ 95.284183][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.286261][ T5321] kasan_report+0x128/0x150 [ 95.288010][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.290637][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.293020][ T5321] kasan_check_range+0x264/0x2c0 [ 95.295254][ T5321] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.297599][ T5321] __asan_memmove+0x29/0x70 [ 95.299623][ T5321] ext4_xattr_set_entry+0x92b/0x1ed0 [ 95.301954][ T5321] ext4_xattr_ibody_set+0x262/0x710 [ 95.304258][ T5321] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 95.306990][ T5321] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 95.309916][ T5321] ? ext4_read_inline_folio+0x6fe/0x860 [ 95.312313][ T5321] ? __pfx_ext4_read_inline_folio+0x10/0x10 [ 95.314907][ T5321] ? down_write+0x16b/0x200 [ 95.317459][ T5321] ? ext4_inode_journal_mode+0x18d/0x470 [ 95.320096][ T5321] ? ext4_fc_track_inode+0x4d/0x3f0 [ 95.322360][ T5321] ? ext4_fc_track_inode+0xf3/0x3f0 [ 95.324747][ T5321] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 95.327674][ T5321] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 95.330756][ T5321] ? ext4_file_write_iter+0xae4/0x1cd0 [ 95.333230][ T5321] ? __x64_sys_pwrite64+0x196/0x220 [ 95.335571][ T5321] ? ext4_inode_journal_mode+0x18d/0x470 [ 95.338006][ T5321] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 95.340440][ T5321] ? ext4_try_to_write_inline_data+0x49/0x90 [ 95.342626][ T5321] ext4_write_begin+0x3bd/0x1900 [ 95.344711][ T5321] ? __pfx_ext4_write_begin+0x10/0x10 [ 95.346885][ T5321] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 95.349745][ T5321] generic_perform_write+0x2d5/0x8f0 [ 95.351933][ T5321] ? do_raw_spin_unlock+0x4d/0x200 [ 95.354331][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 95.357645][ T5321] ? file_update_time_flags+0x3ab/0x440 [ 95.360544][ T5321] ext4_buffered_write_iter+0xd4/0x380 [ 95.363614][ T5321] ? __pfx_futex_wake_mark+0x10/0x10 [ 95.365978][ T5321] ext4_file_write_iter+0xae4/0x1cd0 [ 95.368623][ T5321] ? lock_acquire+0x115/0x350 [ 95.371112][ T5321] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.374186][ T5321] vfs_write+0x612/0xba0 [ 95.376043][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 95.378293][ T5321] ? __fget_files+0x2a/0x420 [ 95.380404][ T5321] __x64_sys_pwrite64+0x196/0x220 [ 95.382684][ T5321] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 95.385296][ T5321] do_syscall_64+0x166/0x520 [ 95.387426][ T5321] ? trace_irq_disable+0x3b/0x140 [ 95.389743][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.392472][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 95.394843][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.397515][ T5321] RIP: 0033:0x7ff21279e159 [ 95.399297][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.406471][ T5321] RSP: 002b:00007ff213628fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 95.410089][ T5321] RAX: ffffffffffffffda RBX: 00007ff212a25fa0 RCX: 00007ff21279e159 [ 95.413034][ T5321] RDX: 00000000000000d9 RSI: 00002000000008c0 RDI: 000000000000000e [ 95.416197][ T5321] RBP: 00007ff21283506b R08: 0000000000000000 R09: 0000000000000000 [ 95.419864][ T5321] R10: 0000000000000f7c R11: 0000000000000246 R12: 0000000000000000 [ 95.423443][ T5321] R13: 00007ff212a26038 R14: 00007ff212a25fa0 R15: 00007ffc2b58c968 [ 95.426828][ T5321] [ 95.428548][ T5321] Kernel Offset: disabled [ 95.430324][ T5321] Rebooting in 86400 seconds..