program: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800700, &(0x7f0000000880)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}, {@nogrpid}, {@dioread_lock}, {@minixdf}, {@resgid}, {@sysvgroups}, {@usrjquota}]}, 0x3, 0x467, &(0x7f0000000e00)="$eJzs3M9rHFUcAPDvzCb93SbWKrRWjRYx+CNp0qo9eFEUPFQU9FCPcZOW0m0jTQRbio0i9SJIQc/iUfAv8OZF1JPgVe9SKBqEVk+R2Z1JN9vdZNNsdmv384Fp39t5M/O+O+/tvJm3mwD61kj2TxKxKyJ+i4ihWnZlgZHafzcXL5X/WbxUTmJp6a0/k2q5G4uXykXRYrudeWY0jUg/SfKDxNb63c5duHhmqlKZOZ/nx+fPvjc+d+His6fPTp2aOTVzbvLYsaNHJl54fvK5tuJI1lifxXXjwIezB/e/9s7V18snrr7707fZNrvy9fVxdMpIFvhfS1WN657o9MF6bHddOhnoYUVYl1JEZKdrsNr/h6IUt07eULz6cU8rB2yq7Nq0tfXqhSXgHpbE2mX+7kZFgC4rLvTZ/W+xdGnocVe4/lLtBiiL+2a+1NYMRJqXGWy4v+2kkYg4sfDvV9kSm/QcAgCg3mflL4/HM83Gf2k8WFduTz6HMhwR90XE3oi4PyL2RcQDEVnZxiFlW0Ya8rePf9JrdxhaW7Lx34v53NbK8V8x+ovhUp7bXY1/MDl5ujJzOH9PRmNwa5afWOUY37/y6+et1tWP/7IlO34xFszrcW2g4QHd9NT8VHVQ2gHXP4o4MNAs/mR5JiCJiP0RcWB9u95TJE4/9c3B7QebF1o7/lV0YJ5p6euIJ2vnfyEa4i8kq89Pjm+Lyszh8aJV3O7nX6682er4LeLfsvHI2pOd/x0r239jkeGkfr52bv3HuPL7py3vae60/W9J3q6el+KN+mBqfv78RMSW5Hg1v+L1yVvbFvmifBb/6KHm/X9vvk12nIciImvCD0fEIxHxaF73xyLi8Yg4tEr8P76cJ5q01w21/w7I4p9u+vm33P4bzv/6E6UzP3xX7GzbuuPPzv/Ramo0f6X6+beGdiu40fcPAAAA/g/S6nfgk3RsOZ2mY2O17/Dvix1pZXZu/umTs++fm659V344BtPiSddQ3fPQiWQh32MtP5k/Ky7WH8mfG39R2l7Nj5VnK9M9jh363c4W/T/zR6nXtQM2XbN5tMmuTUEBvdTY/9OV2ctvdLMyQFf5vTb0rzX6f9qtegDd5/oP/atZ/7/ckDcXAPcm13/oX/o/9C/9H/qX/g99aSO/65fo50Sklcr0tojVCxd/EOjuqLNE+4lefzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0xn8BAAD///xQ9VA=") chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) mkdir(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x5) creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000040)={{0x7, 0xf9, 0x8be, 0xffff}, 'syz0\x00', 0x2}) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$UI_DEV_SETUP(r1, 0x405c5503, 0x0) symlink(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r2, &(0x7f0000000040)=0x1f00, 0x12) ioctl$SYNC_IOC_MERGE(r0, 0xc0303e03, &(0x7f0000000100)={"8f1f24327431840e99f8b171a9efc472033b9fb88d2b1a89f2afd2f34f84f3ab", r2}) [ 68.985607][ T5310] Bluetooth: hci0: command tx timeout [ 69.019179][ T5326] loop0: detected capacity change from 0 to 512 [ 69.070527][ T5326] EXT4-fs error (device loop0): ext4_iget_extra_inode:4692: inode #15: comm syz.0.0: corrupted in-inode xattr: invalid ea_ino [ 69.093362][ T5326] EXT4-fs error (device loop0): ext4_orphan_get:1395: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 69.111368][ T5326] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 69.138268][ T5326] input: syz0 as /devices/virtual/input/input5 [ 69.151006][ T5326] ================================================================== [ 69.153957][ T5326] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x3cd/0x780 [ 69.157394][ T5326] Write of size 251 at addr ffff8880525e1f14 by task syz.0.0/5326 [ 69.160452][ T5326] [ 69.161361][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00173-g0c7cae12f67c #0 PREEMPT(full) [ 69.161374][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.161378][ T5326] Call Trace: [ 69.161383][ T5326] [ 69.161387][ T5326] dump_stack_lvl+0x241/0x360 [ 69.161401][ T5326] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.161411][ T5326] ? rcu_is_watching+0x15/0xb0 [ 69.161421][ T5326] ? __virt_addr_valid+0x183/0x530 [ 69.161431][ T5326] ? lock_release+0x4e/0x3e0 [ 69.161439][ T5326] ? __virt_addr_valid+0x183/0x530 [ 69.161449][ T5326] ? __virt_addr_valid+0x183/0x530 [ 69.161459][ T5326] print_report+0x16e/0x5b0 [ 69.161469][ T5326] ? __virt_addr_valid+0x183/0x530 [ 69.161479][ T5326] ? __virt_addr_valid+0x183/0x530 [ 69.161488][ T5326] ? __virt_addr_valid+0x45f/0x530 [ 69.161496][ T5326] ? __phys_addr+0xba/0x170 [ 69.161505][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.161514][ T5326] kasan_report+0x143/0x180 [ 69.161526][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.161537][ T5326] kasan_check_range+0x28f/0x2a0 [ 69.161550][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.161559][ T5326] __asan_memcpy+0x40/0x70 [ 69.161571][ T5326] ext4_insert_dentry+0x3cd/0x780 [ 69.161581][ T5326] add_dirent_to_buf+0x311/0x660 [ 69.161595][ T5326] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 69.161608][ T5326] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 69.161623][ T5326] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 69.161639][ T5326] make_indexed_dir+0xcdb/0x1300 [ 69.161654][ T5326] ? __pfx_make_indexed_dir+0x10/0x10 [ 69.161665][ T5326] ? add_dirent_to_buf+0x2c1/0x660 [ 69.161673][ T5326] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 69.161681][ T5326] ? __ext4_read_dirblock+0x486/0x790 [ 69.161689][ T5326] ext4_add_entry+0xb3a/0xd30 [ 69.161701][ T5326] ? __pfx_ext4_add_entry+0x10/0x10 [ 69.161714][ T5326] ext4_add_nondir+0x8d/0x290 [ 69.161725][ T5326] ? ext4_symlink+0x78f/0xe30 [ 69.161736][ T5326] ext4_symlink+0xab0/0xe30 [ 69.161749][ T5326] ? __pfx_ext4_symlink+0x10/0x10 [ 69.161762][ T5326] ? inode_permission+0xff/0x460 [ 69.161773][ T5326] ? bpf_lsm_inode_symlink+0x9/0x10 [ 69.161784][ T5326] ? security_inode_symlink+0xbe/0x330 [ 69.161792][ T5326] vfs_symlink+0x137/0x2e0 [ 69.161801][ T5326] do_symlinkat+0x228/0x3d0 [ 69.161810][ T5326] ? __pfx_do_symlinkat+0x10/0x10 [ 69.161818][ T5326] ? strncpy_from_user+0x143/0x280 [ 69.161825][ T5326] ? getname_flags+0x1e2/0x530 [ 69.161835][ T5326] __x64_sys_symlink+0x7a/0x90 [ 69.161849][ T5326] do_syscall_64+0xf3/0x230 [ 69.161910][ T5326] ? clear_bhb_loop+0x45/0xa0 [ 69.161924][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.161937][ T5326] RIP: 0033:0x7f592b58d169 [ 69.161949][ T5326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.161957][ T5326] RSP: 002b:00007f592c3b0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 69.161971][ T5326] RAX: ffffffffffffffda RBX: 00007f592b7a5fa0 RCX: 00007f592b58d169 [ 69.161980][ T5326] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0 [ 69.161988][ T5326] RBP: 00007f592b60e990 R08: 0000000000000000 R09: 0000000000000000 [ 69.161996][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.162003][ T5326] R13: 0000000000000000 R14: 00007f592b7a5fa0 R15: 00007ffe71a591b8 [ 69.162015][ T5326] [ 69.162020][ T5326] [ 69.300356][ T5326] The buggy address belongs to the physical page: [ 69.303428][ T5326] page: refcount:3 mapcount:0 mapping:ffff888031cfcd78 index:0x3f pfn:0x525e1 [ 69.307719][ T5326] memcg:ffff8880409d8000 [ 69.309391][ T5326] aops:def_blk_aops ino:700000 dentry name(?):"" [ 69.311966][ T5326] flags: 0x4fff10000004014(referenced|dirty|private|node=1|zone=1|lastcpupid=0x7ff) [ 69.315712][ T5326] raw: 04fff10000004014 0000000000000000 dead000000000122 ffff888031cfcd78 [ 69.319142][ T5326] raw: 000000000000003f ffff888044c0c1d0 00000003ffffffff ffff8880409d8000 [ 69.322564][ T5326] page dumped because: kasan: bad access detected [ 69.325033][ T5326] page_owner tracks the page as allocated [ 69.327168][ T5326] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5326, tgid 5325 (syz.0.0), ts 69150819904, free_ts 69145107482 [ 69.334031][ T5326] post_alloc_hook+0x1f4/0x240 [ 69.335824][ T5326] get_page_from_freelist+0x352b/0x36c0 [ 69.337877][ T5326] __alloc_frozen_pages_noprof+0x211/0x5b0 [ 69.340085][ T5326] alloc_pages_mpol+0x339/0x690 [ 69.342122][ T5326] alloc_pages_noprof+0x121/0x190 [ 69.344185][ T5326] folio_alloc_noprof+0x1e/0x30 [ 69.346141][ T5326] filemap_alloc_folio_noprof+0xe4/0x550 [ 69.348448][ T5326] __filemap_get_folio+0x423/0xb40 [ 69.350370][ T5326] bdev_getblk+0x1d4/0x670 [ 69.352068][ T5326] ext4_getblk+0x31d/0x890 [ 69.353729][ T5326] ext4_bread+0x2e/0x180 [ 69.355341][ T5326] ext4_append+0x32c/0x5d0 [ 69.357041][ T5326] make_indexed_dir+0x426/0x1300 [ 69.358836][ T5326] ext4_add_entry+0xb3a/0xd30 [ 69.360435][ T5326] ext4_add_nondir+0x8d/0x290 [ 69.361953][ T5326] ext4_symlink+0xab0/0xe30 [ 69.363316][ T5326] page last free pid 4717 tgid 4717 stack trace: [ 69.365464][ T5326] __free_frozen_pages+0xde8/0x10a0 [ 69.367670][ T5326] __put_partials+0x160/0x1c0 [ 69.369386][ T5326] put_cpu_partial+0x17e/0x250 [ 69.370907][ T5326] __slab_free+0x294/0x390 [ 69.372578][ T5326] qlist_free_all+0x9a/0x140 [ 69.374117][ T5326] kasan_quarantine_reduce+0x14f/0x170 [ 69.376141][ T5326] __kasan_slab_alloc+0x23/0x80 [ 69.377829][ T5326] kmem_cache_alloc_noprof+0x1e1/0x390 [ 69.379944][ T5326] getname_flags+0xb6/0x530 [ 69.381718][ T5326] do_sys_openat2+0xbf/0x1d0 [ 69.383553][ T5326] __x64_sys_openat+0x249/0x2a0 [ 69.385532][ T5326] do_syscall_64+0xf3/0x230 [ 69.387479][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.389951][ T5326] [ 69.390957][ T5326] Memory state around the buggy address: [ 69.393050][ T5326] ffff8880525e1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.396044][ T5326] ffff8880525e1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.399245][ T5326] >ffff8880525e2000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb [ 69.402395][ T5326] ^ [ 69.403988][ T5326] ffff8880525e2080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb [ 69.407161][ T5326] ffff8880525e2100: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb [ 69.410311][ T5326] ================================================================== [ 69.438374][ T5326] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 69.441440][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00173-g0c7cae12f67c #0 PREEMPT(full) [ 69.446230][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.450411][ T5326] Call Trace: [ 69.451697][ T5326] [ 69.452576][ T5326] dump_stack_lvl+0x241/0x360 [ 69.453979][ T5326] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.455614][ T5326] ? __pfx__printk+0x10/0x10 [ 69.457087][ T5326] ? vscnprintf+0x5d/0x90 [ 69.458479][ T5326] panic+0x349/0x880 [ 69.459859][ T5326] ? check_panic_on_warn+0x21/0xb0 [ 69.461473][ T5326] ? __pfx_panic+0x10/0x10 [ 69.463058][ T5326] ? _raw_spin_unlock_irqrestore+0x134/0x140 [ 69.465494][ T5326] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 69.467867][ T5326] ? print_report+0x519/0x5b0 [ 69.469804][ T5326] check_panic_on_warn+0x86/0xb0 [ 69.471974][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.473995][ T5326] end_report+0x77/0x160 [ 69.475616][ T5326] kasan_report+0x154/0x180 [ 69.477462][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.479257][ T5326] kasan_check_range+0x28f/0x2a0 [ 69.481092][ T5326] ? ext4_insert_dentry+0x3cd/0x780 [ 69.483212][ T5326] __asan_memcpy+0x40/0x70 [ 69.485232][ T5326] ext4_insert_dentry+0x3cd/0x780 [ 69.487348][ T5326] add_dirent_to_buf+0x311/0x660 [ 69.489477][ T5326] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 69.491664][ T5326] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 69.494221][ T5326] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 69.496639][ T5326] make_indexed_dir+0xcdb/0x1300 [ 69.498725][ T5326] ? __pfx_make_indexed_dir+0x10/0x10 [ 69.500837][ T5326] ? add_dirent_to_buf+0x2c1/0x660 [ 69.502864][ T5326] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 69.505025][ T5326] ? __ext4_read_dirblock+0x486/0x790 [ 69.507107][ T5326] ext4_add_entry+0xb3a/0xd30 [ 69.508966][ T5326] ? __pfx_ext4_add_entry+0x10/0x10 [ 69.510983][ T5326] ext4_add_nondir+0x8d/0x290 [ 69.512844][ T5326] ? ext4_symlink+0x78f/0xe30 [ 69.514619][ T5326] ext4_symlink+0xab0/0xe30 [ 69.516326][ T5326] ? __pfx_ext4_symlink+0x10/0x10 [ 69.518148][ T5326] ? inode_permission+0xff/0x460 [ 69.520025][ T5326] ? bpf_lsm_inode_symlink+0x9/0x10 [ 69.521909][ T5326] ? security_inode_symlink+0xbe/0x330 [ 69.524045][ T5326] vfs_symlink+0x137/0x2e0 [ 69.525715][ T5326] do_symlinkat+0x228/0x3d0 [ 69.527450][ T5326] ? __pfx_do_symlinkat+0x10/0x10 [ 69.529411][ T5326] ? strncpy_from_user+0x143/0x280 [ 69.531361][ T5326] ? getname_flags+0x1e2/0x530 [ 69.533256][ T5326] __x64_sys_symlink+0x7a/0x90 [ 69.535063][ T5326] do_syscall_64+0xf3/0x230 [ 69.536642][ T5326] ? clear_bhb_loop+0x45/0xa0 [ 69.538383][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.540576][ T5326] RIP: 0033:0x7f592b58d169 [ 69.541919][ T5326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.548697][ T5326] RSP: 002b:00007f592c3b0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 69.551420][ T5326] RAX: ffffffffffffffda RBX: 00007f592b7a5fa0 RCX: 00007f592b58d169 [ 69.553915][ T5326] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0 [ 69.556923][ T5326] RBP: 00007f592b60e990 R08: 0000000000000000 R09: 0000000000000000 [ 69.560143][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.563280][ T5326] R13: 0000000000000000 R14: 00007f592b7a5fa0 R15: 00007ffe71a591b8 [ 69.566569][ T5326] [ 69.568171][ T5326] Kernel Offset: disabled [ 69.569910][ T5326] Rebooting in 86400 seconds..