program:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800700, &(0x7f0000000880)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}, {@nogrpid}, {@mblk_io_submit}, {@minixdf}, {@resgid}, {@sysvgroups}, {@usrjquota}]}, 0x3, 0x467, &(0x7f0000002280)="$eJzs3M9rHFUcAPDvzCb93SbWKrRWjRYx+CNp0qo9eFEUPFQU9FCPcZOW0m0jTQRbio0i9SJIQc/iUfAv8OZF1JPgVe9SKBqEVk+R2Z1JN9vdZNNsdmv384Fp39t5M/O+O+/tvJm3mwD61kj2TxKxKyJ+i4ihWnZlgZHafzcXL5X/WbxUTmJp6a0/k2q5G4uXykXRYrudeWY0jUg/SfKDxNb63c5duHhmqlKZOZ/nx+fPvjc+d+His6fPTp2aOTVzbvLYsaNHJl54fvK5tuJI1lifxXXjwIezB/e/9s7V18snrr7707fZNrvy9fVxdMpIFvhfS1WN657o9MF6bHddOhnoYUVYl1JEZKdrsNr/h6IUt07eULz6cU8rB2yq7Nq0tfXqhSXgHpbE2mX+7kZFgC4rLvTZ/W+xdGnocVe4/lLtBiiL+2a+1NYMRJqXGWy4v+2kkYg4sfDvV9kSm/QcAgCg3mflL4/HM83Gf2k8WFduTz6HMhwR90XE3oi4PyL2RcQDEVnZxiFlW0Ya8rePf9JrdxhaW7Lx34v53NbK8V8x+ovhUp7bXY1/MDl5ujJzOH9PRmNwa5afWOUY37/y6+et1tWP/7IlO34xFszrcW2g4QHd9NT8VHVQ2gHXP4o4MNAs/mR5JiCJiP0RcWB9u95TJE4/9c3B7QebF1o7/lV0YJ5p6euIJ2vnfyEa4i8kq89Pjm+Lyszh8aJV3O7nX6682er4LeLfsvHI2pOd/x0r239jkeGkfr52bv3HuPL7py3vae60/W9J3q6el+KN+mBqfv78RMSW5Hg1v+L1yVvbFvmifBb/6KHm/X9vvk12nIciImvCD0fEIxHxaF73xyLi8Yg4tEr8P76cJ5q01w21/w7I4p9u+vm33P4bzv/6E6UzP3xX7GzbuuPPzv/Ramo0f6X6+beGdiu40fcPAAAA/g/S6nfgk3RsOZ2mY2O17/Dvix1pZXZu/umTs++fm659V344BtPiSddQ3fPQiWQh32MtP5k/Ky7WH8mfG39R2l7Nj5VnK9M9jh363c4W/T/zR6nXtQM2XbN5tMmuTUEBvdTY/9OV2ctvdLMyQFf5vTb0rzX6f9qtegDd5/oP/atZ/7/ckDcXAPcm13/oX/o/9C/9H/qX/g99aSO/65fo50Sklcr0tojVCxd/EOjuqLNE+4lefzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0xn8BAAD///xQ9VA=")
chdir(&(0x7f0000000140)='./file0\x00')
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0)
mkdir(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x5)
creat(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x9f)
mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1)
symlink(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0)
write$cgroup_int(r0, &(0x7f0000000040)=0x1f00, 0x12)

[   58.797189][ T4670] Bluetooth: hci0: command tx timeout
[   58.825480][ T5321] loop0: detected capacity change from 0 to 512
[   58.854576][ T5321] EXT4-fs: Ignoring removed mblk_io_submit option
[   58.876117][ T5321] EXT4-fs error (device loop0): ext4_iget_extra_inode:4704: inode #15: comm syz.0.0: corrupted in-inode xattr: invalid ea_ino
[   58.888767][ T5321] EXT4-fs error (device loop0): ext4_orphan_get:1395: comm syz.0.0: couldn't read orphan inode 15 (err -117)
[   58.893820][ T5321] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   58.904219][ T5321] ==================================================================
[   58.907156][ T5321] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x3cd/0x780
[   58.910191][ T5321] Write of size 251 at addr ffff88804163ff14 by task syz.0.0/5321
[   58.913187][ T5321] 
[   58.913963][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-09584-g7d06015d936c #0 PREEMPT(full) 
[   58.913974][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   58.913978][ T5321] Call Trace:
[   58.913982][ T5321]  <TASK>
[   58.913988][ T5321]  dump_stack_lvl+0x241/0x360
[   58.914002][ T5321]  ? __pfx_dump_stack_lvl+0x10/0x10
[   58.914012][ T5321]  ? rcu_is_watching+0x15/0xb0
[   58.914022][ T5321]  ? __virt_addr_valid+0x183/0x530
[   58.914032][ T5321]  ? lock_release+0x4e/0x3e0
[   58.914040][ T5321]  ? __virt_addr_valid+0x183/0x530
[   58.914049][ T5321]  ? __virt_addr_valid+0x183/0x530
[   58.914058][ T5321]  print_report+0x16e/0x5b0
[   58.914068][ T5321]  ? __virt_addr_valid+0x183/0x530
[   58.914081][ T5321]  ? __virt_addr_valid+0x183/0x530
[   58.914089][ T5321]  ? __virt_addr_valid+0x45f/0x530
[   58.914096][ T5321]  ? __phys_addr+0xba/0x170
[   58.914104][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   58.914114][ T5321]  kasan_report+0x143/0x180
[   58.914123][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   58.914133][ T5321]  kasan_check_range+0x28f/0x2a0
[   58.914142][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   58.914152][ T5321]  __asan_memcpy+0x40/0x70
[   58.914161][ T5321]  ext4_insert_dentry+0x3cd/0x780
[   58.914172][ T5321]  add_dirent_to_buf+0x311/0x660
[   58.914183][ T5321]  ? __pfx_add_dirent_to_buf+0x10/0x10
[   58.914193][ T5321]  ? __ext4_handle_dirty_metadata+0x30d/0x820
[   58.914206][ T5321]  ? ext4_handle_dirty_dirblock+0xc0/0x350
[   58.914219][ T5321]  make_indexed_dir+0xcdb/0x1300
[   58.914227][ T5321]  ? __pfx_make_indexed_dir+0x10/0x10
[   58.914234][ T5321]  ? add_dirent_to_buf+0x2c1/0x660
[   58.914241][ T5321]  ? __pfx_add_dirent_to_buf+0x10/0x10
[   58.914247][ T5321]  ? __ext4_read_dirblock+0x486/0x790
[   58.914254][ T5321]  ext4_add_entry+0xb3a/0xd30
[   58.914261][ T5321]  ? __pfx_ext4_add_entry+0x10/0x10
[   58.914269][ T5321]  ext4_add_nondir+0x8d/0x290
[   58.914275][ T5321]  ? ext4_symlink+0x78f/0xe30
[   58.914281][ T5321]  ext4_symlink+0xab0/0xe30
[   58.914288][ T5321]  ? __pfx_ext4_symlink+0x10/0x10
[   58.914295][ T5321]  ? inode_permission+0xff/0x460
[   58.914301][ T5321]  ? bpf_lsm_inode_symlink+0x9/0x10
[   58.914309][ T5321]  ? security_inode_symlink+0xbe/0x330
[   58.914318][ T5321]  vfs_symlink+0x137/0x2e0
[   58.914328][ T5321]  do_symlinkat+0x228/0x3d0
[   58.914337][ T5321]  ? __pfx_do_symlinkat+0x10/0x10
[   58.914345][ T5321]  ? strncpy_from_user+0x143/0x280
[   58.914354][ T5321]  ? getname_flags+0x1e2/0x530
[   58.914360][ T5321]  __x64_sys_symlink+0x7a/0x90
[   58.914369][ T5321]  do_syscall_64+0xf3/0x230
[   58.914416][ T5321]  ? clear_bhb_loop+0x45/0xa0
[   58.914427][ T5321]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   58.914439][ T5321] RIP: 0033:0x7ff253f8d169
[   58.914450][ T5321] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   58.914459][ T5321] RSP: 002b:00007ff254e18038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[   58.914467][ T5321] RAX: ffffffffffffffda RBX: 00007ff2541a5fa0 RCX: 00007ff253f8d169
[   58.914473][ T5321] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0
[   58.914478][ T5321] RBP: 00007ff25400e2a0 R08: 0000000000000000 R09: 0000000000000000
[   58.914483][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   58.914487][ T5321] R13: 0000000000000000 R14: 00007ff2541a5fa0 R15: 00007ffd312fd838
[   58.914494][ T5321]  </TASK>
[   58.914497][ T5321] 
[   59.045320][ T5321] The buggy address belongs to the physical page:
[   59.047863][ T5321] page: refcount:3 mapcount:0 mapping:ffff88803210cd78 index:0x3f pfn:0x4163f
[   59.051224][ T5321] memcg:ffff88801e4be000
[   59.052972][ T5321] aops:def_blk_aops ino:700000 dentry name(?):""
[   59.055623][ T5321] flags: 0x4fff10000004014(referenced|dirty|private|node=1|zone=1|lastcpupid=0x7ff)
[   59.059420][ T5321] raw: 04fff10000004014 0000000000000000 dead000000000122 ffff88803210cd78
[   59.063028][ T5321] raw: 000000000000003f ffff8880320bde80 00000003ffffffff ffff88801e4be000
[   59.066371][ T5321] page dumped because: kasan: bad access detected
[   59.068710][ T5321] page_owner tracks the page as allocated
[   59.070820][ T5321] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5321, tgid 5320 (syz.0.0), ts 58904019258, free_ts 58885159262
[   59.077395][ T5321]  post_alloc_hook+0x1f4/0x240
[   59.079048][ T5321]  get_page_from_freelist+0x3695/0x37e0
[   59.081104][ T5321]  __alloc_frozen_pages_noprof+0x2c5/0x7b0
[   59.083317][ T5321]  alloc_pages_mpol+0x339/0x690
[   59.085206][ T5321]  alloc_pages_noprof+0x121/0x190
[   59.087149][ T5321]  folio_alloc_noprof+0x1e/0x30
[   59.089123][ T5321]  filemap_alloc_folio_noprof+0xe4/0x550
[   59.091384][ T5321]  __filemap_get_folio+0x423/0xb40
[   59.093417][ T5321]  bdev_getblk+0x1d4/0x670
[   59.095225][ T5321]  ext4_getblk+0x31d/0x890
[   59.096995][ T5321]  ext4_bread+0x2e/0x180
[   59.098713][ T5321]  ext4_append+0x32c/0x5d0
[   59.100384][ T5321]  make_indexed_dir+0x426/0x1300
[   59.102088][ T5321]  ext4_add_entry+0xb3a/0xd30
[   59.103720][ T5321]  ext4_add_nondir+0x8d/0x290
[   59.105539][ T5321]  ext4_symlink+0xab0/0xe30
[   59.107433][ T5321] page last free pid 5300 tgid 5300 stack trace:
[   59.109982][ T5321]  free_frozen_pages+0xe16/0x10f0
[   59.112102][ T5321]  __slab_free+0x2c6/0x390
[   59.114123][ T5321]  qlist_free_all+0x9a/0x140
[   59.115952][ T5321]  kasan_quarantine_reduce+0x14f/0x170
[   59.117960][ T5321]  __kasan_slab_alloc+0x23/0x80
[   59.119842][ T5321]  kmem_cache_alloc_noprof+0x1e1/0x390
[   59.121932][ T5321]  getname_flags+0xb6/0x530
[   59.123842][ T5321]  do_sys_openat2+0xbf/0x1d0
[   59.125766][ T5321]  __x64_sys_openat+0x249/0x2a0
[   59.127704][ T5321]  do_syscall_64+0xf3/0x230
[   59.129594][ T5321]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.131974][ T5321] 
[   59.132998][ T5321] Memory state around the buggy address:
[   59.135199][ T5321]  ffff88804163ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   59.138097][ T5321]  ffff88804163ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   59.141050][ T5321] >ffff888041640000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.144085][ T5321]                    ^
[   59.145707][ T5321]  ffff888041640080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.148907][ T5321]  ffff888041640100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.152156][ T5321] ==================================================================
[   59.170042][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   59.173109][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-09584-g7d06015d936c #0 PREEMPT(full) 
[   59.178404][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   59.183308][ T5321] Call Trace:
[   59.184735][ T5321]  <TASK>
[   59.185732][ T5321]  dump_stack_lvl+0x241/0x360
[   59.187459][ T5321]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.189602][ T5321]  ? __pfx__printk+0x10/0x10
[   59.191312][ T5321]  ? vscnprintf+0x5d/0x90
[   59.192988][ T5321]  panic+0x349/0x880
[   59.194568][ T5321]  ? check_panic_on_warn+0x21/0xb0
[   59.196684][ T5321]  ? __pfx_panic+0x10/0x10
[   59.198307][ T5321]  ? _raw_spin_unlock_irqrestore+0x134/0x140
[   59.200768][ T5321]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   59.203321][ T5321]  ? print_report+0x519/0x5b0
[   59.205259][ T5321]  check_panic_on_warn+0x86/0xb0
[   59.207344][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   59.209521][ T5321]  end_report+0x77/0x160
[   59.211273][ T5321]  kasan_report+0x154/0x180
[   59.213173][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   59.215391][ T5321]  kasan_check_range+0x28f/0x2a0
[   59.217422][ T5321]  ? ext4_insert_dentry+0x3cd/0x780
[   59.219566][ T5321]  __asan_memcpy+0x40/0x70
[   59.221240][ T5321]  ext4_insert_dentry+0x3cd/0x780
[   59.222906][ T5321]  add_dirent_to_buf+0x311/0x660
[   59.224589][ T5321]  ? __pfx_add_dirent_to_buf+0x10/0x10
[   59.226493][ T5321]  ? __ext4_handle_dirty_metadata+0x30d/0x820
[   59.228714][ T5321]  ? ext4_handle_dirty_dirblock+0xc0/0x350
[   59.230955][ T5321]  make_indexed_dir+0xcdb/0x1300
[   59.232864][ T5321]  ? __pfx_make_indexed_dir+0x10/0x10
[   59.234865][ T5321]  ? add_dirent_to_buf+0x2c1/0x660
[   59.236618][ T5321]  ? __pfx_add_dirent_to_buf+0x10/0x10
[   59.238542][ T5321]  ? __ext4_read_dirblock+0x486/0x790
[   59.240696][ T5321]  ext4_add_entry+0xb3a/0xd30
[   59.242549][ T5321]  ? __pfx_ext4_add_entry+0x10/0x10
[   59.244510][ T5321]  ext4_add_nondir+0x8d/0x290
[   59.246470][ T5321]  ? ext4_symlink+0x78f/0xe30
[   59.248442][ T5321]  ext4_symlink+0xab0/0xe30
[   59.250380][ T5321]  ? __pfx_ext4_symlink+0x10/0x10
[   59.252239][ T5321]  ? inode_permission+0xff/0x460
[   59.254118][ T5321]  ? bpf_lsm_inode_symlink+0x9/0x10
[   59.256115][ T5321]  ? security_inode_symlink+0xbe/0x330
[   59.258249][ T5321]  vfs_symlink+0x137/0x2e0
[   59.260018][ T5321]  do_symlinkat+0x228/0x3d0
[   59.261791][ T5321]  ? __pfx_do_symlinkat+0x10/0x10
[   59.263532][ T5321]  ? strncpy_from_user+0x143/0x280
[   59.265318][ T5321]  ? getname_flags+0x1e2/0x530
[   59.266980][ T5321]  __x64_sys_symlink+0x7a/0x90
[   59.268976][ T5321]  do_syscall_64+0xf3/0x230
[   59.270856][ T5321]  ? clear_bhb_loop+0x45/0xa0
[   59.272779][ T5321]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.275160][ T5321] RIP: 0033:0x7ff253f8d169
[   59.277052][ T5321] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   59.284566][ T5321] RSP: 002b:00007ff254e18038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[   59.287946][ T5321] RAX: ffffffffffffffda RBX: 00007ff2541a5fa0 RCX: 00007ff253f8d169
[   59.291147][ T5321] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0
[   59.294449][ T5321] RBP: 00007ff25400e2a0 R08: 0000000000000000 R09: 0000000000000000
[   59.297475][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   59.300392][ T5321] R13: 0000000000000000 R14: 00007ff2541a5fa0 R15: 00007ffd312fd838
[   59.303627][ T5321]  </TASK>
[   59.305223][ T5321] Kernel Offset: disabled
[   59.307005][ T5321] Rebooting in 86400 seconds..