./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1171607281

<...>

syzkaller
syzkaller login: [    6.811050][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[    9.850964][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[   10.690915][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[   10.803236][   T23] kauditd_printk_skb: 60 callbacks suppressed
[   10.803242][   T23] audit: type=1400 audit(1680328060.239:71): avc:  denied  { transition } for  pid=289 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   10.808787][   T23] audit: type=1400 audit(1680328060.239:72): avc:  denied  { write } for  pid=289 comm="sh" path="pipe:[5028]" dev="pipefs" ino=5028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[   12.521418][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!!
Warning: Permanently added '10.128.0.228' (ECDSA) to the list of known hosts.
execve("./syz-executor1171607281", ["./syz-executor1171607281"], 0x7fff659e0a50 /* 10 vars */) = 0
brk(NULL)                               = 0x5555556ac000
brk(0x5555556acc40)                     = 0x5555556acc40
arch_prctl(ARCH_SET_FS, 0x5555556ac300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1171607281", 4096) = 28
brk(0x5555556cdc40)                     = 0x5555556cdc40
brk(0x5555556ce000)                     = 0x5555556ce000
mprotect(0x7f8220724000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
chmod("/dev/raw-gadget", 0666)          = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556ac5d0) = 372
./strace-static-x86_64: Process 372 attached
[pid   372] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   372] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   372] setsid()                    = 1
[pid   372] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   372] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   372] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   372] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   372] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   372] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   372] unshare(CLONE_NEWNS)        = 0
[pid   372] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   372] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   372] unshare(CLONE_NEWCGROUP)    = 0
[pid   372] unshare(CLONE_NEWUTS)       = 0
[pid   372] unshare(CLONE_SYSVSEM)      = 0
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   372] getpid()                    = 1
[pid   372] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   372] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   372] unshare(CLONE_NEWNET)       = 0
[pid   372] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   372] write(3, "0 65535", 7)      = 7
[pid   372] close(3)                    = 0
[pid   372] mkdir("/dev/binderfs", 0777) = 0
[pid   372] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   372] symlink("/dev/binderfs", "./binderfs") = 0
[pid   372] memfd_create("syzkaller", 0) = 3
[pid   372] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8218269000
[pid   372] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   372] munmap(0x7f8218269000, 1048576) = 0
[pid   372] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   372] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   372] close(3)                    = 0
[pid   372] mkdir("./bus", 0777)        = 0
[   18.761392][   T23] audit: type=1400 audit(1680328068.199:73): avc:  denied  { execmem } for  pid=371 comm="syz-executor117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   18.764493][   T23] audit: type=1400 audit(1680328068.199:74): avc:  denied  { setattr } for  pid=371 comm="syz-executor117" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[   18.768261][   T23] audit: type=1400 audit(1680328068.199:75): avc:  denied  { mounton } for  pid=372 comm="syz-executor117" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[   18.772150][   T23] audit: type=1400 audit(1680328068.199:76): avc:  denied  { mount } for  pid=372 comm="syz-executor117" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   18.775562][   T23] audit: type=1400 audit(1680328068.199:77): avc:  denied  { mounton } for  pid=372 comm="syz-executor117" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[   18.785643][   T23] audit: type=1400 audit(1680328068.219:78): avc:  denied  { mounton } for  pid=372 comm="syz-executor117" path="/dev/binderfs" dev="devtmpfs" ino=363 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[   18.808957][   T23] audit: type=1400 audit(1680328068.219:79): avc:  denied  { mount } for  pid=372 comm="syz-executor117" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[   18.831735][   T23] audit: type=1400 audit(1680328068.229:80): avc:  denied  { read write } for  pid=372 comm="syz-executor117" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid   372] mount("/dev/loop0", "./bus", "ext4", MS_NOATIME|MS_NODIRATIME|MS_REC|MS_I_VERSION|MS_LAZYTIME, ",errors=continue") = 0
[pid   372] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid   372] chdir("./bus")              = 0
[pid   372] ioctl(4, LOOP_CLR_FD)       = 0
[pid   372] close(4)                    = 0
[pid   372] chdir("./file0")            = 0
[pid   372] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_NONBLOCK|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME, 000) = 4
[pid   372] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   372] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5
[pid   372] openat(AT_FDCWD, "memory.current", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6
[pid   372] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 196608
[pid   372] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED, 6, 0) = 0x20000000
[pid   372] preadv(6, 0x200015c0, 5, 0) = 196480
[pid   372] write(5, 0x200000c0, 34136651) = 192512
[   18.832740][  T372] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   18.856130][   T23] audit: type=1400 audit(1680328068.229:81): avc:  denied  { open } for  pid=372 comm="syz-executor117" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   18.865122][  T372] ext4 filesystem being mounted at /root/bus supports timestamps until 2038 (0x7fffffff)
[pid   372] write(5, 0x200000c0, 34136651) = 192512
[pid   372] write(5, 0x200000c0, 34136651) = 192512
[pid   372] write(5, 0x200000c0, 34136651) = 192512
[pid   372] write(5, 0x200000c0, 34136651) = 192512
[pid   372] write(5, 0x200000c0, 34136651) = 86016
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] write(5, 0x200000c0, 34136651) = -1 ENOSPC (No space left on device)
[pid   372] openat(AT_FDCWD, NULL, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = -1 EFAULT (Bad address)
[pid   372] exit_group(1)               = ?
[   18.889018][   T23] audit: type=1400 audit(1680328068.229:82): avc:  denied  { ioctl } for  pid=372 comm="syz-executor117" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   18.941240][    T9] ==================================================================
[   18.949309][    T9] BUG: KASAN: use-after-free in ext4_find_extent+0xba3/0xd80
[   18.956652][    T9] Read of size 4 at addr ffff88811dc4302c by task kworker/u4:1/9
[   18.965025][    T9] 
[   18.967331][    T9] CPU: 1 PID: 9 Comm: kworker/u4:1 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
[   18.977113][    T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[   18.987143][    T9] Workqueue: writeback wb_workfn (flush-7:0)
[   18.993091][    T9] Call Trace:
[   18.996348][    T9]  dump_stack_lvl+0x1e2/0x24b
[   19.000992][    T9]  ? printk+0xcf/0x10f
[   19.005047][    T9]  ? bfq_pos_tree_add_move+0x43e/0x43e
[   19.010489][    T9]  ? wake_up_klogd+0xb8/0xf0
[   19.015047][    T9]  ? panic+0x7d7/0x7d7
[   19.019172][    T9]  print_address_description+0x81/0x3c0
[   19.024685][    T9]  ? __getblk_gfp+0x3c/0x2a0
[   19.029243][    T9]  kasan_report+0x1a4/0x1f0
[   19.033724][    T9]  ? ext4_find_extent+0xba3/0xd80
[   19.038716][    T9]  ? ext4_find_extent+0xba3/0xd80
[   19.043728][    T9]  __asan_report_load4_noabort+0x14/0x20
[   19.049329][    T9]  ext4_find_extent+0xba3/0xd80
[   19.054147][    T9]  ext4_ext_map_blocks+0x219/0x3a30
[   19.059316][    T9]  ? ext4_ext_release+0x10/0x10
[   19.064136][    T9]  ? stack_depot_save+0x433/0x4a0
[   19.069127][    T9]  ? __kasan_slab_alloc+0xc9/0xe0
[   19.074117][    T9]  ? __kasan_check_write+0x14/0x20
[   19.079199][    T9]  ? __down_write+0x119/0x320
[   19.083863][    T9]  ? ext4_es_lookup_extent+0x3c5/0x9d0
[   19.089291][    T9]  ext4_map_blocks+0xa93/0x1ee0
[   19.094156][    T9]  ? ext4_issue_zeroout+0x1c0/0x1c0
[   19.099332][    T9]  ? ext4_inode_journal_mode+0x1a3/0x470
[   19.104945][    T9]  mpage_map_one_extent+0x1bd/0x680
[   19.110122][    T9]  ext4_writepages+0x15e9/0x3710
[   19.115033][    T9]  ? __find_get_block+0x9fa/0xbb0
[   19.120047][    T9]  ? ext4_readpage+0x220/0x220
[   19.124782][    T9]  ? __getblk_gfp+0x3c/0x2a0
[   19.129372][    T9]  ? __ext4_get_inode_loc+0x44c/0xd20
[   19.134740][    T9]  ? __kasan_check_write+0x14/0x20
[   19.139848][    T9]  ? __brelse+0x5a/0xa0
[   19.143983][    T9]  ? ext4_readpage+0x220/0x220
[   19.148732][    T9]  do_writepages+0x13a/0x280
[   19.153310][    T9]  ? ext4_iget_extra_inode+0x230/0x230
[   19.158750][    T9]  ? __writepage+0x130/0x130
[   19.163330][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.168079][    T9]  ? _raw_spin_trylock_bh+0x1d0/0x1d0
[   19.173442][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.179404][    T9]  ? __kasan_check_write+0x14/0x20
[   19.184491][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.189232][    T9]  ? __kasan_check_write+0x14/0x20
[   19.194323][    T9]  __writeback_single_inode+0xb8/0x6e0
[   19.199762][    T9]  writeback_sb_inodes+0x999/0x1700
[   19.204948][    T9]  ? queue_io+0x500/0x500
[   19.209251][    T9]  ? writeback_sb_inodes+0x1700/0x1700
[   19.214681][    T9]  ? arch_stack_walk+0x112/0x140
[   19.219592][    T9]  ? queue_io+0x3c7/0x500
[   19.223904][    T9]  ? stack_trace_save+0x12d/0x1f0
[   19.228902][    T9]  wb_writeback+0x42f/0xc20
[   19.233381][    T9]  ? wb_io_lists_depopulated+0x180/0x180
[   19.238986][    T9]  ? widen_string+0x41/0x3a0
[   19.243550][    T9]  ? __kasan_check_write+0x14/0x20
[   19.248646][    T9]  wb_do_writeback+0x222/0xbd0
[   19.253401][    T9]  ? wb_workfn+0x3f0/0x3f0
[   19.257810][    T9]  ? set_worker_desc+0x158/0x1c0
[   19.262813][    T9]  ? work_busy+0x250/0x250
[   19.267207][    T9]  ? slab_free_freelist_hook+0xcc/0x1a0
[   19.272727][    T9]  ? __kasan_check_write+0x14/0x20
[   19.277900][    T9]  ? kthread_data+0x52/0xc0
[   19.282375][    T9]  wb_workfn+0xf8/0x3f0
[   19.286525][    T9]  process_one_work+0x726/0xc10
[   19.291364][    T9]  worker_thread+0xb27/0x1550
[   19.296016][    T9]  kthread+0x349/0x3d0
[   19.300056][    T9]  ? worker_clr_flags+0x180/0x180
[   19.305069][    T9]  ? kthread_blkcg+0xd0/0xd0
[   19.309630][    T9]  ret_from_fork+0x1f/0x30
[   19.314013][    T9] 
[   19.316314][    T9] The buggy address belongs to the page:
[   19.321930][    T9] page:ffffea00047710c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11dc43
[   19.332131][    T9] flags: 0x8000000000000000()
[   19.336784][    T9] raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000
[   19.345356][    T9] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   19.354006][    T9] page dumped because: kasan: bad access detected
[   19.360390][    T9] page_owner tracks the page as freed
[   19.365741][    T9] page last allocated via order 0, migratetype Movable, gfp_mask 0x3100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x2000000), pid 297, ts 12920941513, free_ts 12928566451
[   19.382147][    T9]  get_page_from_freelist+0x755/0x810
[   19.387492][    T9]  __alloc_pages_nodemask+0x3b6/0x890
[   19.392840][    T9]  do_anonymous_page+0x307/0x1050
[   19.397841][    T9]  handle_pte_fault+0x4cd/0x9d0
[   19.402677][    T9]  handle_mm_fault+0xf22/0x19f0
[   19.407511][    T9]  do_user_addr_fault+0x67e/0xce0
[   19.412515][    T9]  exc_page_fault+0x71/0x1b0
[   19.417076][    T9]  asm_exc_page_fault+0x1e/0x30
[   19.421901][    T9] page last free stack trace:
[   19.426568][    T9]  free_pcp_prepare+0x18c/0x1c0
[   19.431833][    T9]  free_unref_page_list+0x11d/0x660
[   19.437012][    T9]  release_pages+0xc24/0xc60
[   19.441598][    T9]  free_pages_and_swap_cache+0x97/0xb0
[   19.447032][    T9]  tlb_flush_mmu+0x8a0/0xa80
[   19.451597][    T9]  tlb_finish_mmu+0xd2/0x1f0
[   19.457578][    T9]  unmap_region+0x346/0x390
[   19.462069][    T9]  __do_munmap+0x696/0x8c0
[   19.466458][    T9]  __se_sys_munmap+0x121/0x1b0
[   19.471191][    T9]  __x64_sys_munmap+0x5b/0x70
[   19.475842][    T9]  do_syscall_64+0x34/0x70
[   19.480253][    T9]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[   19.486127][    T9] 
[   19.488431][    T9] Memory state around the buggy address:
[   19.494036][    T9]  ffff88811dc42f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.502068][    T9]  ffff88811dc42f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.510102][    T9] >ffff88811dc43000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.518135][    T9]                                   ^
[   19.523493][    T9]  ffff88811dc43080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.531526][    T9]  ffff88811dc43100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.539561][    T9] ==================================================================
[   19.547593][    T9] Disabling lock debugging due to kernel taint
[   19.554004][    T9] ------------[ cut here ]------------
[   19.560303][    T9] kernel BUG at fs/ext4/inode.c:2453!
[   19.565723][    T9] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   19.571909][    T9] CPU: 1 PID: 9 Comm: kworker/u4:1 Tainted: G    B             5.10.161-syzkaller-00019-g416c4356f372 #0
[   19.583067][    T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[   19.593113][    T9] Workqueue: writeback wb_workfn (flush-7:0)
[   19.599072][    T9] RIP: 0010:mpage_map_one_extent+0x5df/0x680
[   19.605028][    T9] Code: f6 48 0f a3 05 62 7b c1 04 0f 92 c3 40 0f 92 c6 31 ff e8 b4 a3 8f ff 84 db 75 11 e8 9b a0 8f ff e9 74 fa ff ff e8 91 a0 8f ff <0f> 0b 65 ff 05 64 ec 24 7e 48 c7 c0 68 cf 9c 86 48 c1 e8 03 42 80
[   19.624607][    T9] RSP: 0018:ffffc90000097068 EFLAGS: 00010293
[   19.630646][    T9] RAX: ffffffff81dd811f RBX: 0000000000000000 RCX: ffff88810023bb40
[   19.638590][    T9] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   19.646532][    T9] RBP: ffffc900000970b0 R08: ffffffff81dd7fa8 R09: ffffed1021d64843
[   19.654482][    T9] R10: ffffed1021d64843 R11: 1ffff11021d64842 R12: 0000000000000000
[   19.662426][    T9] R13: ffffc900000973b4 R14: 0000000000000000 R15: 1ffff92000012e77
[   19.670369][    T9] FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   19.679478][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.686039][    T9] CR2: 000055f35449cbb8 CR3: 000000010ca6e000 CR4: 00000000003506a0
[   19.694014][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   19.701963][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   19.709923][    T9] Call Trace:
[   19.713189][    T9]  ext4_writepages+0x15e9/0x3710
[   19.718097][    T9]  ? __find_get_block+0x9fa/0xbb0
[   19.723092][    T9]  ? ext4_readpage+0x220/0x220
[   19.727841][    T9]  ? __getblk_gfp+0x3c/0x2a0
[   19.732420][    T9]  ? __ext4_get_inode_loc+0x44c/0xd20
[   19.737772][    T9]  ? __kasan_check_write+0x14/0x20
[   19.742991][    T9]  ? __brelse+0x5a/0xa0
[   19.747125][    T9]  ? ext4_readpage+0x220/0x220
[   19.751881][    T9]  do_writepages+0x13a/0x280
[   19.756452][    T9]  ? ext4_iget_extra_inode+0x230/0x230
[   19.761886][    T9]  ? __writepage+0x130/0x130
[   19.766447][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.771182][    T9]  ? _raw_spin_trylock_bh+0x1d0/0x1d0
[   19.776523][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.781271][    T9]  ? __kasan_check_write+0x14/0x20
[   19.786351][    T9]  ? _raw_spin_lock+0xa3/0x1b0
[   19.791085][    T9]  ? __kasan_check_write+0x14/0x20
[   19.796168][    T9]  __writeback_single_inode+0xb8/0x6e0
[   19.801596][    T9]  writeback_sb_inodes+0x999/0x1700
[   19.806768][    T9]  ? queue_io+0x500/0x500
[   19.811067][    T9]  ? writeback_sb_inodes+0x1700/0x1700
[   19.816498][    T9]  ? arch_stack_walk+0x112/0x140
[   19.821403][    T9]  ? queue_io+0x3c7/0x500
[   19.825719][    T9]  ? stack_trace_save+0x12d/0x1f0
[   19.830733][    T9]  wb_writeback+0x42f/0xc20
[   19.835205][    T9]  ? wb_io_lists_depopulated+0x180/0x180
[   19.840810][    T9]  ? widen_string+0x41/0x3a0
[   19.845386][    T9]  ? __kasan_check_write+0x14/0x20
[   19.850472][    T9]  wb_do_writeback+0x222/0xbd0
[   19.855205][    T9]  ? wb_workfn+0x3f0/0x3f0
[   19.859606][    T9]  ? set_worker_desc+0x158/0x1c0
[   19.864518][    T9]  ? work_busy+0x250/0x250
[   19.868918][    T9]  ? slab_free_freelist_hook+0xcc/0x1a0
[   19.874523][    T9]  ? __kasan_check_write+0x14/0x20
[   19.879605][    T9]  ? kthread_data+0x52/0xc0
[   19.884077][    T9]  wb_workfn+0xf8/0x3f0
[   19.888205][    T9]  process_one_work+0x726/0xc10
[   19.893028][    T9]  worker_thread+0xb27/0x1550
[   19.897761][    T9]  kthread+0x349/0x3d0
[   19.902148][    T9]  ? worker_clr_flags+0x180/0x180
[   19.907152][    T9]  ? kthread_blkcg+0xd0/0xd0
[   19.911727][    T9]  ret_from_fork+0x1f/0x30
[   19.916132][    T9] Modules linked in:
[   19.920131][    T9] ---[ end trace 483450afbef76f28 ]---
[   19.925662][    T9] RIP: 0010:mpage_map_one_extent+0x5df/0x680
[   19.931648][    T9] Code: f6 48 0f a3 05 62 7b c1 04 0f 92 c3 40 0f 92 c6 31 ff e8 b4 a3 8f ff 84 db 75 11 e8 9b a0 8f ff e9 74 fa ff ff e8 91 a0 8f ff <0f> 0b 65 ff 05 64 ec 24 7e 48 c7 c0 68 cf 9c 86 48 c1 e8 03 42 80
[   19.951845][    T9] RSP: 0018:ffffc90000097068 EFLAGS: 00010293
[   19.957898][    T9] RAX: ffffffff81dd811f RBX: 0000000000000000 RCX: ffff88810023bb40
[   19.965915][    T9] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   19.973926][    T9] RBP: ffffc900000970b0 R08: ffffffff81dd7fa8 R09: ffffed1021d64843
[   19.981927][    T9] R10: ffffed1021d64843 R11: 1ffff11021d64842 R12: 0000000000000000
[   19.989889][    T9] R13: ffffc900000973b4 R14: 0000000000000000 R15: 1ffff92000012e77
[   19.998038][    T9] FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   20.007170][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   20.013825][    T9] CR2: 000055e49407e058 CR3: 000000010c555000 CR4: 00000000003506b0
[   20.021866][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   20.029816][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   20.037822][    T9] Kernel panic - not syncing: Fatal exception
[   20.044024][    T9] Kernel Offset: disabled
[   20.048330][    T9] Rebooting in 86400 seconds..