program:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800700, &(0x7f00000004c0)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}, {@nogrpid}, {@mb_optimize_scan}, {@minixdf}, {@resgid}, {@sysvgroups}, {@mblk_io_submit}]}, 0x3, 0x467, &(0x7f0000002280)="$eJzs3M9rHFUcAPDvzCb93SbWKrRWjRYx+CNp0qo9eFEUPFQU9FCPcZOW0m0jTQRbio0i9SJIQc/iUfAv8OZF1JPgVe9SKBqEVk+R2Z1JN9vdZNNsdmv384Fp39t5M/O+O+/tvJm3mwD61kj2TxKxKyJ+i4ihWnZlgZHafzcXL5X/WbxUTmJp6a0/k2q5G4uXykXRYrudeWY0jUg/SfKDxNb63c5duHhmqlKZOZ/nx+fPvjc+d+His6fPTp2aOTVzbvLYsaNHJl54fvK5tuJI1lifxXXjwIezB/e/9s7V18snrr7707fZNrvy9fVxdMpIFvhfS1WN657o9MF6bHddOhnoYUVYl1JEZKdrsNr/h6IUt07eULz6cU8rB2yq7Nq0tfXqhSXgHpbE2mX+7kZFgC4rLvTZ/W+xdGnocVe4/lLtBiiL+2a+1NYMRJqXGWy4v+2kkYg4sfDvV9kSm/QcAgCg3mflL4/HM83Gf2k8WFduTz6HMhwR90XE3oi4PyL2RcQDEVnZxiFlW0Ya8rePf9JrdxhaW7Lx34v53NbK8V8x+ovhUp7bXY1/MDl5ujJzOH9PRmNwa5afWOUY37/y6+et1tWP/7IlO34xFszrcW2g4QHd9NT8VHVQ2gHXP4o4MNAs/mR5JiCJiP0RcWB9u95TJE4/9c3B7QebF1o7/lV0YJ5p6euIJ2vnfyEa4i8kq89Pjm+Lyszh8aJV3O7nX6682er4LeLfsvHI2pOd/x0r239jkeGkfr52bv3HuPL7py3vae60/W9J3q6el+KN+mBqfv78RMSW5Hg1v+L1yVvbFvmifBb/6KHm/X9vvk12nIciImvCD0fEIxHxaF73xyLi8Yg4tEr8P76cJ5q01w21/w7I4p9u+vm33P4bzv/6E6UzP3xX7GzbuuPPzv/Ramo0f6X6+beGdiu40fcPAAAA/g/S6nfgk3RsOZ2mY2O17/Dvix1pZXZu/umTs++fm659V344BtPiSddQ3fPQiWQh32MtP5k/Ky7WH8mfG39R2l7Nj5VnK9M9jh363c4W/T/zR6nXtQM2XbN5tMmuTUEBvdTY/9OV2ctvdLMyQFf5vTb0rzX6f9qtegDd5/oP/atZ/7/ckDcXAPcm13/oX/o/9C/9H/qX/g99aSO/65fo50Sklcr0tojVCxd/EOjuqLNE+4lefzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0xn8BAAD///xQ9VA=")
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0)
mkdir(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x5)
creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1)
symlink(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0)
write$cgroup_int(r1, &(0x7f0000000040)=0x1f00, 0x12)
sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@ipv6_newnexthop={0x1c, 0x68, 0x200, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x3, 0x0, 0x4}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x40001)
ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r1, 0x8008f511, &(0x7f0000000480))
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f00000003c0)=@nbd={'/dev/nbd', 0x0}, 0xffffffffffffffff, &(0x7f0000000440)='\xe9\x1fq\x89Y\x1e\x923aK\x00')
[ 71.180598][ T4661] Bluetooth: hci0: command tx timeout
[ 71.258982][ T5315] loop0: detected capacity change from 0 to 512
[ 71.274179][ T5315] EXT4-fs: Ignoring removed mblk_io_submit option
[ 71.303148][ T5315] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz.0.0: corrupted in-inode xattr: invalid ea_ino
[ 71.315506][ T5315] EXT4-fs error (device loop0): ext4_orphan_get:1394: comm syz.0.0: couldn't read orphan inode 15 (err -117)
[ 71.322553][ T5315] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 71.336949][ T5315] ==================================================================
[ 71.339956][ T5315] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x36a/0x6d0
[ 71.342851][ T5315] Write of size 251 at addr ffff888042d9af14 by task syz.0.0/5315
[ 71.345617][ T5315]
[ 71.346479][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.13.0-rc7-syzkaller-00102-gce69b4019001 #0
[ 71.350346][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 71.354266][ T5315] Call Trace:
[ 71.355533][ T5315]
[ 71.356634][ T5315] dump_stack_lvl+0x241/0x360
[ 71.358347][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.360331][ T5315] ? __pfx__printk+0x10/0x10
[ 71.362101][ T5315] ? _printk+0xd5/0x120
[ 71.363640][ T5315] ? __virt_addr_valid+0x183/0x530
[ 71.365734][ T5315] ? __virt_addr_valid+0x183/0x530
[ 71.367618][ T5315] print_report+0x169/0x550
[ 71.369411][ T5315] ? __virt_addr_valid+0x183/0x530
[ 71.371399][ T5315] ? __virt_addr_valid+0x183/0x530
[ 71.373127][ T5315] ? __virt_addr_valid+0x45f/0x530
[ 71.374806][ T5315] ? __phys_addr+0xba/0x170
[ 71.376286][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.377862][ T5315] kasan_report+0x143/0x180
[ 71.379386][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.380852][ T5315] kasan_check_range+0x282/0x290
[ 71.382428][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.383938][ T5315] __asan_memcpy+0x40/0x70
[ 71.385251][ T5315] ext4_insert_dentry+0x36a/0x6d0
[ 71.386750][ T5315] add_dirent_to_buf+0x3d9/0x750
[ 71.388383][ T5315] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 71.390100][ T5315] ? __ext4_handle_dirty_metadata+0x30d/0x820
[ 71.392298][ T5315] make_indexed_dir+0xf98/0x1600
[ 71.394178][ T5315] ? __pfx_make_indexed_dir+0x10/0x10
[ 71.396244][ T5315] ? add_dirent_to_buf+0x398/0x750
[ 71.398191][ T5315] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 71.400278][ T5315] ? __ext4_read_dirblock+0x527/0x890
[ 71.402321][ T5315] ext4_add_entry+0xcf7/0xfa0
[ 71.404135][ T5315] ? __pfx_ext4_add_entry+0x10/0x10
[ 71.406202][ T5315] ext4_add_nondir+0x8d/0x290
[ 71.408066][ T5315] ? ext4_symlink+0x6ce/0xb50
[ 71.409891][ T5315] ext4_symlink+0x920/0xb50
[ 71.411674][ T5315] ? __pfx_ext4_symlink+0x10/0x10
[ 71.413575][ T5315] ? inode_permission+0xff/0x460
[ 71.415501][ T5315] ? bpf_lsm_inode_symlink+0x9/0x10
[ 71.417092][ T5315] ? security_inode_symlink+0xbe/0x330
[ 71.418846][ T5315] vfs_symlink+0x137/0x2e0
[ 71.420949][ T5315] do_symlinkat+0x222/0x3a0
[ 71.423109][ T5315] ? __pfx_do_symlinkat+0x10/0x10
[ 71.425470][ T5315] ? strncpy_from_user+0x152/0x270
[ 71.427492][ T5315] ? getname_flags+0x1e3/0x540
[ 71.429298][ T5315] __x64_sys_symlink+0x7a/0x90
[ 71.431200][ T5315] do_syscall_64+0xf3/0x230
[ 71.432852][ T5315] ? clear_bhb_loop+0x35/0x90
[ 71.434540][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.436404][ T5315] RIP: 0033:0x7f2ff0385d29
[ 71.437898][ T5315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 71.443643][ T5315] RSP: 002b:00007f2ff11fd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[ 71.446335][ T5315] RAX: ffffffffffffffda RBX: 00007f2ff0575fa0 RCX: 00007f2ff0385d29
[ 71.449112][ T5315] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0
[ 71.452123][ T5315] RBP: 00007f2ff0401b08 R08: 0000000000000000 R09: 0000000000000000
[ 71.455265][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 71.458291][ T5315] R13: 0000000000000000 R14: 00007f2ff0575fa0 R15: 00007ffcf0fe96b8
[ 71.461393][ T5315]
[ 71.462575][ T5315]
[ 71.463525][ T5315] The buggy address belongs to the physical page:
[ 71.465856][ T5315] page: refcount:3 mapcount:0 mapping:ffff888000584d78 index:0x3f pfn:0x42d9a
[ 71.468940][ T5315] memcg:ffff888052c4a000
[ 71.470445][ T5315] aops:def_blk_aops ino:700000 dentry name(?):""
[ 71.472703][ T5315] flags: 0x4fff08000004214(referenced|dirty|workingset|private|node=1|zone=1|lastcpupid=0x7ff)
[ 71.476265][ T5315] raw: 04fff08000004214 0000000000000000 dead000000000122 ffff888000584d78
[ 71.479292][ T5315] raw: 000000000000003f ffff888043e30570 00000003ffffffff ffff888052c4a000
[ 71.482159][ T5315] page dumped because: kasan: bad access detected
[ 71.484521][ T5315] page_owner tracks the page as allocated
[ 71.486548][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5315, tgid 5314 (syz.0.0), ts 71336761010, free_ts 71320103211
[ 71.493229][ T5315] post_alloc_hook+0x1f3/0x230
[ 71.495300][ T5315] get_page_from_freelist+0x365c/0x37a0
[ 71.497183][ T5315] __alloc_pages_noprof+0x292/0x710
[ 71.499213][ T5315] alloc_pages_mpol_noprof+0x3e1/0x780
[ 71.501397][ T5315] folio_alloc_noprof+0x128/0x180
[ 71.503323][ T5315] filemap_alloc_folio_noprof+0xdf/0x500
[ 71.505566][ T5315] __filemap_get_folio+0x41f/0x940
[ 71.507429][ T5315] bdev_getblk+0x1d4/0x670
[ 71.508939][ T5315] ext4_getblk+0x31b/0x880
[ 71.510702][ T5315] ext4_bread+0x2e/0x180
[ 71.512207][ T5315] ext4_append+0x327/0x5c0
[ 71.513814][ T5315] make_indexed_dir+0x523/0x1600
[ 71.515500][ T5315] ext4_add_entry+0xcf7/0xfa0
[ 71.517120][ T5315] ext4_add_nondir+0x8d/0x290
[ 71.518740][ T5315] ext4_symlink+0x920/0xb50
[ 71.520385][ T5315] vfs_symlink+0x137/0x2e0
[ 71.521925][ T5315] page last free pid 4722 tgid 4722 stack trace:
[ 71.524154][ T5315] free_unref_page+0xd3f/0x1010
[ 71.525945][ T5315] rcu_core+0xaaa/0x17a0
[ 71.527522][ T5315] handle_softirqs+0x2d4/0x9b0
[ 71.529160][ T5315] __irq_exit_rcu+0xf7/0x220
[ 71.530744][ T5315] irq_exit_rcu+0x9/0x30
[ 71.532186][ T5315] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 71.534395][ T5315] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 71.536530][ T5315]
[ 71.537278][ T5315] Memory state around the buggy address:
[ 71.539056][ T5315] ffff888042d9af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.541339][ T5315] ffff888042d9af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.544016][ T5315] >ffff888042d9b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.547057][ T5315] ^
[ 71.548428][ T5315] ffff888042d9b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.551154][ T5315] ffff888042d9b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 71.554006][ T5315] ==================================================================
[ 71.568835][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.571706][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.13.0-rc7-syzkaller-00102-gce69b4019001 #0
[ 71.575633][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 71.579757][ T5315] Call Trace:
[ 71.581117][ T5315]
[ 71.582303][ T5315] dump_stack_lvl+0x241/0x360
[ 71.584205][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.586321][ T5315] ? __pfx__printk+0x10/0x10
[ 71.588199][ T5315] ? preempt_schedule+0xe1/0xf0
[ 71.589828][ T5315] ? vscnprintf+0x5d/0x90
[ 71.591375][ T5315] panic+0x349/0x880
[ 71.592860][ T5315] ? check_panic_on_warn+0x21/0xb0
[ 71.594628][ T5315] ? __pfx_panic+0x10/0x10
[ 71.596055][ T5315] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 71.597957][ T5315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 71.600179][ T5315] ? print_report+0x502/0x550
[ 71.601641][ T5315] check_panic_on_warn+0x86/0xb0
[ 71.603098][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.604955][ T5315] end_report+0x77/0x160
[ 71.606501][ T5315] kasan_report+0x154/0x180
[ 71.608267][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.610131][ T5315] kasan_check_range+0x282/0x290
[ 71.611718][ T5315] ? ext4_insert_dentry+0x36a/0x6d0
[ 71.613176][ T5315] __asan_memcpy+0x40/0x70
[ 71.614411][ T5315] ext4_insert_dentry+0x36a/0x6d0
[ 71.615989][ T5315] add_dirent_to_buf+0x3d9/0x750
[ 71.617666][ T5315] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 71.619655][ T5315] ? __ext4_handle_dirty_metadata+0x30d/0x820
[ 71.622017][ T5315] make_indexed_dir+0xf98/0x1600
[ 71.623893][ T5315] ? __pfx_make_indexed_dir+0x10/0x10
[ 71.625917][ T5315] ? add_dirent_to_buf+0x398/0x750
[ 71.627835][ T5315] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 71.629812][ T5315] ? __ext4_read_dirblock+0x527/0x890
[ 71.631801][ T5315] ext4_add_entry+0xcf7/0xfa0
[ 71.633501][ T5315] ? __pfx_ext4_add_entry+0x10/0x10
[ 71.635486][ T5315] ext4_add_nondir+0x8d/0x290
[ 71.637189][ T5315] ? ext4_symlink+0x6ce/0xb50
[ 71.638968][ T5315] ext4_symlink+0x920/0xb50
[ 71.640490][ T5315] ? __pfx_ext4_symlink+0x10/0x10
[ 71.642302][ T5315] ? inode_permission+0xff/0x460
[ 71.644210][ T5315] ? bpf_lsm_inode_symlink+0x9/0x10
[ 71.646152][ T5315] ? security_inode_symlink+0xbe/0x330
[ 71.648316][ T5315] vfs_symlink+0x137/0x2e0
[ 71.649988][ T5315] do_symlinkat+0x222/0x3a0
[ 71.651760][ T5315] ? __pfx_do_symlinkat+0x10/0x10
[ 71.653751][ T5315] ? strncpy_from_user+0x152/0x270
[ 71.655769][ T5315] ? getname_flags+0x1e3/0x540
[ 71.657575][ T5315] __x64_sys_symlink+0x7a/0x90
[ 71.659389][ T5315] do_syscall_64+0xf3/0x230
[ 71.660967][ T5315] ? clear_bhb_loop+0x35/0x90
[ 71.662522][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.664582][ T5315] RIP: 0033:0x7f2ff0385d29
[ 71.666234][ T5315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 71.673009][ T5315] RSP: 002b:00007f2ff11fd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[ 71.676189][ T5315] RAX: ffffffffffffffda RBX: 00007f2ff0575fa0 RCX: 00007f2ff0385d29
[ 71.679015][ T5315] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0
[ 71.681596][ T5315] RBP: 00007f2ff0401b08 R08: 0000000000000000 R09: 0000000000000000
[ 71.684544][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 71.687766][ T5315] R13: 0000000000000000 R14: 00007f2ff0575fa0 R15: 00007ffcf0fe96b8
[ 71.690808][ T5315]
[ 71.692558][ T5315] Kernel Offset: disabled
[ 71.694219][ T5315] Rebooting in 86400 seconds..