Extracting prog: 5m56.299248838s Minimizing prog: 25m11.967484157s Simplifying prog options: 0s Extracting C: 1m11.154506202s Simplifying C: 16m32.678590898s extracting reproducer from 66 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-openat$nullb-openat-mmap-sendfile-openat$dir-read$FUSE detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000500)={[{@init_itable}]}, 0x1, 0x79f, &(0x7f0000000f80)="$eJzs3c1rHOUfAPDvbJKmSfv7JYKg9RQQNFC6MTVtFTxUPIhgoaBn27DZhppNtmQ3pQkBW0TwIqh4EPTSsy/15tWXq/4XHqSlalqseJDI7Eu7aXabbM3uhubzgck+z8xsnue7z8wzz+wMOwHsWWPpn0zEoYj4MIkYqc1PImKgkuqPOFld787aai6dklhff+P3pLLO7bXVXDS8J3WglnkyIn54L+JwZnO5peWVuelCIb9Yy0+U5y9MlJZXjpyfn57Nz+YXjk9OTR09cezE8Z2L9c+fVw7e+OjVZ78++fe7T1z74MckTsbB2rLGOHbKWIzVPpOB9CPc4JWdLqzHko3Zfb2qB+1Jd82+6l4eh2Ik+iqpFoa6WTMAoFPWAYC9651eVwAA6Jb69wC311Zz9am330h0182XI2J/Nf769c3qkv7aNbv9leugw7eTDVdGkogY3YHyxyLi82/f+jKdotYOyQ78X4CtXL4SEWdHxzb3/8mmexba9dyDFq4PVl7G7pu9144/0EvfpeOfF5qN/zJ3xz/RZPwz2GTffRhb7/+Z67VE3w4Ut0k6/nup4d62Ow3x14z21XL/q4z5BpJz5wv5tG/7f0SMx8Bgmp+srNp85DZ+659brcpvHP/98fHbX6Tlp6/31shc7x/c+J6Z6fL0f4277uaViKf6m8Wf3G3/pMX49/Q2y3jtxfc/a7UsjT+Ntz5tjr+z1q9GPNO0/e+1ZdLy/sT+YyeOT1Q2h4n6RtHEN798Otyq/Mb2T6e0/Pq5QDek7T/84PhHk8b7NUvtl/HT1ZHvWy3bOv7m2/++5M1Kun6j4aXpcnlxMmJf8vrm+Ufvvbeer6+fxj/+dPP9v1ps8+0/PSc8u834+2/89tXDx99ZafwzbbV/+4lrd+Za9t3ba/+pSmq8Nmc7/d8W9bocD701AwAAAAAAAAAAAAAAAAAAAAAAAED7MhFxMJJM9m46k8lmq8/wfjyGM4ViqXz4XHFpYSYqz8oejYFM/acuRxp+D3Wy9nv49fzR+/LPR8RjEfHJ4FAln80VCzO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAag60eP5/6tfBXtcOAOiY/b2uAADQdY7/ALD3tHf8H+pYPQCA7nH+DwB7z7aP/2c7Ww8AoHvaPf/v61A9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeGSdPnUqndb/WlvNpfmZi8tLc8WLR2bypbns/FIumysuXsjOFouzhXw2V5xv+Y8uV18KxeKFqVhYujRRzpfKE6XllTPzxaWF8pnz89Oz+TP5ga5FBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbV1pemZsuFPKLEg9MDO2OauyaRH/simo8Com+2BXVuD/R2EsM9a6DAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjl/g0AAP//3BEuHw==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) sendfile(r0, r1, 0x0, 0x20fffe82) openat$dir(0xffffffffffffff9c, &(0x7f00000008c0)='./file1\x00', 0x2000, 0x40) read$FUSE(r0, &(0x7f0000001740)={0x2020}, 0x2020) program did not crash single: failed to extract reproducer bisect: bisecting 66 programs with base timeout 30s testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 7, 6, 6, 6, 6, 6, 7, 6, 7, 7, 6, 6, 6, 6, 6, 6, 6, 6, 6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 8, 8, 8, 8, 8, 8, 8, 8, 8, 7, 8, 8, 8, 7, 8, 6, 8, 8, 8, 8, 8, 8, 7, 8] detailed listing: executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x104020, 0x0, 0xfc, 0x0, 0x0) mount(0x0, &(0x7f0000000b80)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x11, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) lseek(r1, 0x100, 0x1) getdents64(r1, 0xfffffffffffffffe, 0x29) executing program 2: r0 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b80)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-\x8b\xee\x13qQ\xd5f39\x87Sr\xafbB\xe2\xe8\xcd\x1bf\x18\x7f\x02\x00E#\"\xab\x99\xec\x88\x8d \xcc\xc5\xbb\x88\xb6\xd2\xf2J\x8e\xcbwq\xf8oG\xb5 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 RSP: 0018:ffffc9000f94ed00 EFLAGS: 00010293 RAX: ffffffff8281cf6d RBX: 0000004210000000 RCX: ffff888034469f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f94f110 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1008ae55f7 R12: ffffc9000f94f4c0 R13: 1ffff92001f29e98 R14: 0000004000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888125c46000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9c04cdc000 CR3: 0000000034f18000 CR4: 00000000003526f0 Call Trace: ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3043 do_writepages+0x338/0x560 mm/page-writeback.c:2571 __writeback_single_inode+0x12e/0xf90 fs/fs-writeback.c:1787 writeback_sb_inodes+0x9db/0x1ab0 fs/fs-writeback.c:2079 wb_writeback+0x41c/0xad0 fs/fs-writeback.c:2264 wb_do_writeback fs/fs-writeback.c:2432 [inline] wb_workfn+0x437/0x10f0 fs/fs-writeback.c:2477 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ext4_do_writepages+0x479e/0x47a0 fs/ext4/inode.c:2826 Code: c6 20 2a 84 8b e8 b2 ef a5 fe 90 0f 0b e8 da f8 43 ff 4c 89 f7 48 c7 c6 00 2f 84 8b e8 9b ef a5 fe 90 0f 0b e8 c3 f8 43 ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 RSP: 0018:ffffc9000f94ed00 EFLAGS: 00010293 RAX: ffffffff8281cf6d RBX: 0000004210000000 RCX: ffff888034469f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f94f110 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1008ae55f7 R12: ffffc9000f94f4c0 R13: 1ffff92001f29e98 R14: 0000004000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888125c46000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9c04cd6000 CR3: 00000000371a4000 CR4: 00000000003526f0 final repro crashed as (corrupted=false): ------------[ cut here ]------------ kernel BUG at fs/ext4/inode.c:2827! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 4179 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: writeback wb_workfn (flush-7:3) RIP: 0010:ext4_do_writepages+0x479e/0x47a0 fs/ext4/inode.c:2826 Code: c6 20 2a 84 8b e8 b2 ef a5 fe 90 0f 0b e8 da f8 43 ff 4c 89 f7 48 c7 c6 00 2f 84 8b e8 9b ef a5 fe 90 0f 0b e8 c3 f8 43 ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 RSP: 0018:ffffc9000f94ed00 EFLAGS: 00010293 RAX: ffffffff8281cf6d RBX: 0000004210000000 RCX: ffff888034469f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f94f110 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1008ae55f7 R12: ffffc9000f94f4c0 R13: 1ffff92001f29e98 R14: 0000004000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888125c46000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9c04cdc000 CR3: 0000000034f18000 CR4: 00000000003526f0 Call Trace: ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3043 do_writepages+0x338/0x560 mm/page-writeback.c:2571 __writeback_single_inode+0x12e/0xf90 fs/fs-writeback.c:1787 writeback_sb_inodes+0x9db/0x1ab0 fs/fs-writeback.c:2079 wb_writeback+0x41c/0xad0 fs/fs-writeback.c:2264 wb_do_writeback fs/fs-writeback.c:2432 [inline] wb_workfn+0x437/0x10f0 fs/fs-writeback.c:2477 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ext4_do_writepages+0x479e/0x47a0 fs/ext4/inode.c:2826 Code: c6 20 2a 84 8b e8 b2 ef a5 fe 90 0f 0b e8 da f8 43 ff 4c 89 f7 48 c7 c6 00 2f 84 8b e8 9b ef a5 fe 90 0f 0b e8 c3 f8 43 ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 RSP: 0018:ffffc9000f94ed00 EFLAGS: 00010293 RAX: ffffffff8281cf6d RBX: 0000004210000000 RCX: ffff888034469f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f94f110 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1008ae55f7 R12: ffffc9000f94f4c0 R13: 1ffff92001f29e98 R14: 0000004000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888125c46000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9c04cd6000 CR3: 00000000371a4000 CR4: 00000000003526f0