program: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) (async, rerun: 32) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) (rerun: 32) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc) (async, rerun: 64) setxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000500), &(0x7f0000000200)=ANY=[@ANYRESHEX=0x0, @ANYRESDEC=r0], 0x841, 0x0) (async, rerun: 64) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r3, &(0x7f00000000c0)={0x18}, 0xfffffdef) [ 85.114879][ T4687] Bluetooth: hci0: command tx timeout [ 85.222498][ T5345] loop0: detected capacity change from 0 to 1024 [ 85.252531][ T5345] ======================================================= [ 85.252531][ T5345] WARNING: The mand mount option has been deprecated and [ 85.252531][ T5345] and is ignored by this kernel. Remove the mand [ 85.252531][ T5345] option from the mount to silence this warning. [ 85.252531][ T5345] ======================================================= [ 85.326984][ T5345] EXT4-fs: Ignoring removed oldalloc option [ 85.329629][ T5345] EXT4-fs: Ignoring removed orlov option [ 85.342545][ T5345] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 85.378063][ T5345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 85.411314][ T5346] ================================================================== [ 85.414772][ T5346] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 85.418037][ T5346] Read of size 4 at addr ffff88801fd3d52c by task syz.0.0/5346 [ 85.421254][ T5346] [ 85.422293][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.422308][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.422315][ T5346] Call Trace: [ 85.422322][ T5346] [ 85.422328][ T5346] dump_stack_lvl+0xe8/0x150 [ 85.422347][ T5346] print_report+0xca/0x240 [ 85.422359][ T5346] ? ext4_find_extent+0xae6/0xcc0 [ 85.422374][ T5346] kasan_report+0x118/0x150 [ 85.422384][ T5346] ? ext4_find_extent+0xae6/0xcc0 [ 85.422399][ T5346] ext4_find_extent+0xae6/0xcc0 [ 85.422415][ T5346] ext4_ext_map_blocks+0x278/0x69c0 [ 85.422438][ T5346] ? ext4_map_blocks+0x73f/0x16f0 [ 85.422448][ T5346] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 85.422465][ T5346] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 85.422478][ T5346] ext4_map_blocks+0x82c/0x16f0 [ 85.422492][ T5346] ? __pfx_ext4_map_blocks+0x10/0x10 [ 85.422503][ T5346] ? rcu_is_watching+0x15/0xb0 [ 85.422517][ T5346] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 85.422530][ T5346] ? kmem_cache_alloc_noprof+0x3ce/0x710 [ 85.422546][ T5346] ? ext4_inode_journal_mode+0x193/0x470 [ 85.422560][ T5346] ext4_do_writepages+0x222f/0x4500 [ 85.422584][ T5346] ? __pfx___schedule+0x10/0x10 [ 85.422649][ T5346] ? __pfx_ext4_do_writepages+0x10/0x10 [ 85.422660][ T5346] ? lockdep_unlock+0x6c/0xf0 [ 85.422669][ T5346] ? __lock_acquire+0x146f/0x2cf0 [ 85.422681][ T5346] ? irqentry_exit+0x5e8/0x670 [ 85.422697][ T5346] ? lockdep_hardirqs_on+0x7b/0x110 [ 85.422707][ T5346] ? irqentry_exit+0x5e8/0x670 [ 85.422718][ T5346] ? ext4_writepages+0x1ca/0x350 [ 85.422738][ T5346] ext4_writepages+0x203/0x350 [ 85.422751][ T5346] ? __lock_acquire+0x6b6/0x2cf0 [ 85.422761][ T5346] ? __pfx_ext4_writepages+0x10/0x10 [ 85.422779][ T5346] ? do_raw_spin_unlock+0x4d/0x240 [ 85.422793][ T5346] ? __pfx_ext4_writepages+0x10/0x10 [ 85.422807][ T5346] do_writepages+0x32e/0x550 [ 85.422822][ T5346] ? do_raw_spin_unlock+0x4d/0x240 [ 85.422836][ T5346] file_write_and_wait_range+0x23e/0x340 [ 85.422851][ T5346] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 85.422863][ T5346] ? __schedule+0x14b1/0x4fd0 [ 85.422886][ T5346] ? wake_up_q+0x99/0xd0 [ 85.422897][ T5346] ? preempt_schedule_thunk+0x16/0x30 [ 85.422909][ T5346] generic_buffers_fsync_noflush+0x70/0x1d0 [ 85.422926][ T5346] ext4_sync_file+0x322/0xae0 [ 85.422967][ T5346] ext4_buffered_write_iter+0x2ca/0x3a0 [ 85.422982][ T5346] ext4_file_write_iter+0x292/0x1bc0 [ 85.422995][ T5346] ? try_to_wake_up+0x82b/0x12b0 [ 85.423010][ T5346] ? vfs_write+0x211/0xb30 [ 85.423024][ T5346] ? vfs_write+0x211/0xb30 [ 85.423038][ T5346] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 85.423052][ T5346] vfs_write+0x5c9/0xb30 [ 85.423067][ T5346] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 85.423079][ T5346] ? __pfx_vfs_write+0x10/0x10 [ 85.423095][ T5346] ? __fget_files+0x2a/0x420 [ 85.423108][ T5346] __x64_sys_pwrite64+0x193/0x220 [ 85.423124][ T5346] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 85.423142][ T5346] do_syscall_64+0xec/0xf80 [ 85.423153][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.423164][ T5346] ? trace_irq_disable+0x37/0x100 [ 85.423178][ T5346] ? clear_bhb_loop+0x60/0xb0 [ 85.423190][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.423201][ T5346] RIP: 0033:0x7fe61258f7c9 [ 85.423212][ T5346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.423221][ T5346] RSP: 002b:00007fe6134a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 85.423235][ T5346] RAX: ffffffffffffffda RBX: 00007fe6127e6090 RCX: 00007fe61258f7c9 [ 85.423242][ T5346] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000026 [ 85.423249][ T5346] RBP: 00007fe612613f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.423256][ T5346] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 [ 85.423263][ T5346] R13: 00007fe6127e6128 R14: 00007fe6127e6090 R15: 00007ffe60227bc8 [ 85.423275][ T5346] [ 85.423280][ T5346] [ 85.588141][ T5346] The buggy address belongs to the physical page: [ 85.590975][ T5346] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x12 pfn:0x1fd3d [ 85.594711][ T5346] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 85.597773][ T5346] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 [ 85.601568][ T5346] raw: 0000000000000012 0000000000000000 00000000ffffffff 0000000000000000 [ 85.605685][ T5346] page dumped because: kasan: bad access detected [ 85.608756][ T5346] page_owner tracks the page as freed [ 85.611090][ T5346] page last allocated via order 0, migratetype Movable, gfp_mask 0x152c4a(GFP_NOFS|__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 4735, tgid 4735 (udevd), ts 28853476644, free_ts 82187503597 [ 85.621138][ T5346] post_alloc_hook+0x234/0x290 [ 85.623154][ T5346] get_page_from_freelist+0x24e0/0x2580 [ 85.625351][ T5346] __alloc_frozen_pages_noprof+0x181/0x370 [ 85.627967][ T5346] alloc_pages_mpol+0x232/0x4a0 [ 85.630071][ T5346] alloc_pages_noprof+0xa9/0x190 [ 85.632299][ T5346] folio_alloc_noprof+0x1e/0x30 [ 85.634346][ T5346] filemap_alloc_folio_noprof+0x107/0x470 [ 85.636910][ T5346] page_cache_ra_unbounded+0x34f/0x990 [ 85.639264][ T5346] filemap_get_pages+0x7ff/0x1dc0 [ 85.641499][ T5346] filemap_read+0x3f6/0x11a0 [ 85.643559][ T5346] __kernel_read+0x4cf/0x960 [ 85.645818][ T5346] integrity_kernel_read+0x89/0xd0 [ 85.647965][ T5346] ima_calc_file_hash+0x85e/0x16f0 [ 85.650111][ T5346] ima_collect_measurement+0x428/0x8f0 [ 85.652491][ T5346] process_measurement+0x111e/0x1a70 [ 85.654657][ T5346] ima_file_check+0xd9/0x130 [ 85.656678][ T5346] page last free pid 76 tgid 76 stack trace: [ 85.659190][ T5346] free_unref_folios+0xdb3/0x14f0 [ 85.661320][ T5346] shrink_folio_list+0x4785/0x4f90 [ 85.663224][ T5346] evict_folios+0x473e/0x57f0 [ 85.665001][ T5346] try_to_shrink_lruvec+0x8a3/0xb50 [ 85.667017][ T5346] shrink_one+0x25c/0x720 [ 85.668839][ T5346] shrink_node+0x2f7d/0x35b0 [ 85.670635][ T5346] kswapd+0x145a/0x2820 [ 85.672251][ T5346] kthread+0x711/0x8a0 [ 85.673685][ T5346] ret_from_fork+0x510/0xa50 [ 85.675411][ T5346] ret_from_fork_asm+0x1a/0x30 [ 85.677591][ T5346] [ 85.678648][ T5346] Memory state around the buggy address: [ 85.680843][ T5346] ffff88801fd3d400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 85.683922][ T5346] ffff88801fd3d480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 85.686780][ T5346] >ffff88801fd3d500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 85.689605][ T5346] ^ [ 85.691632][ T5346] ffff88801fd3d580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 85.694544][ T5346] ffff88801fd3d600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 85.697849][ T5346] ================================================================== [ 85.710668][ T5346] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 85.713483][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.716851][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.720838][ T5346] Call Trace: [ 85.722112][ T5346] [ 85.723262][ T5346] vpanic+0x1e0/0x670 [ 85.724795][ T5346] panic+0xb9/0xc0 [ 85.726104][ T5346] ? __pfx_panic+0x10/0x10 [ 85.727806][ T5346] ? preempt_schedule_common+0x83/0xd0 [ 85.729810][ T5346] ? ext4_find_extent+0xae6/0xcc0 [ 85.731660][ T5346] check_panic_on_warn+0x89/0xb0 [ 85.733574][ T5346] ? ext4_find_extent+0xae6/0xcc0 [ 85.735562][ T5346] end_report+0x6f/0x140 [ 85.737249][ T5346] kasan_report+0x129/0x150 [ 85.739192][ T5346] ? ext4_find_extent+0xae6/0xcc0 [ 85.741190][ T5346] ext4_find_extent+0xae6/0xcc0 [ 85.743186][ T5346] ext4_ext_map_blocks+0x278/0x69c0 [ 85.745248][ T5346] ? ext4_map_blocks+0x73f/0x16f0 [ 85.747285][ T5346] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 85.749403][ T5346] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 85.751524][ T5346] ext4_map_blocks+0x82c/0x16f0 [ 85.753472][ T5346] ? __pfx_ext4_map_blocks+0x10/0x10 [ 85.755558][ T5346] ? rcu_is_watching+0x15/0xb0 [ 85.757391][ T5346] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 85.759477][ T5346] ? kmem_cache_alloc_noprof+0x3ce/0x710 [ 85.761791][ T5346] ? ext4_inode_journal_mode+0x193/0x470 [ 85.764272][ T5346] ext4_do_writepages+0x222f/0x4500 [ 85.766460][ T5346] ? __pfx___schedule+0x10/0x10 [ 85.768789][ T5346] ? __pfx_ext4_do_writepages+0x10/0x10 [ 85.771244][ T5346] ? lockdep_unlock+0x6c/0xf0 [ 85.773272][ T5346] ? __lock_acquire+0x146f/0x2cf0 [ 85.775459][ T5346] ? irqentry_exit+0x5e8/0x670 [ 85.777524][ T5346] ? lockdep_hardirqs_on+0x7b/0x110 [ 85.779887][ T5346] ? irqentry_exit+0x5e8/0x670 [ 85.781987][ T5346] ? ext4_writepages+0x1ca/0x350 [ 85.784208][ T5346] ext4_writepages+0x203/0x350 [ 85.786307][ T5346] ? __lock_acquire+0x6b6/0x2cf0 [ 85.788465][ T5346] ? __pfx_ext4_writepages+0x10/0x10 [ 85.790756][ T5346] ? do_raw_spin_unlock+0x4d/0x240 [ 85.793022][ T5346] ? __pfx_ext4_writepages+0x10/0x10 [ 85.795418][ T5346] do_writepages+0x32e/0x550 [ 85.797873][ T5346] ? do_raw_spin_unlock+0x4d/0x240 [ 85.800580][ T5346] file_write_and_wait_range+0x23e/0x340 [ 85.803508][ T5346] ? __pfx_file_write_and_wait_range+0x10/0x10 [ 85.806198][ T5346] ? __schedule+0x14b1/0x4fd0 [ 85.808446][ T5346] ? wake_up_q+0x99/0xd0 [ 85.810771][ T5346] ? preempt_schedule_thunk+0x16/0x30 [ 85.813488][ T5346] generic_buffers_fsync_noflush+0x70/0x1d0 [ 85.816110][ T5346] ext4_sync_file+0x322/0xae0 [ 85.818074][ T5346] ext4_buffered_write_iter+0x2ca/0x3a0 [ 85.821524][ T5346] ext4_file_write_iter+0x292/0x1bc0 [ 85.823931][ T5346] ? try_to_wake_up+0x82b/0x12b0 [ 85.826032][ T5346] ? vfs_write+0x211/0xb30 [ 85.827949][ T5346] ? vfs_write+0x211/0xb30 [ 85.829825][ T5346] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 85.832268][ T5346] vfs_write+0x5c9/0xb30 [ 85.834178][ T5346] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 85.836664][ T5346] ? __pfx_vfs_write+0x10/0x10 [ 85.838962][ T5346] ? __fget_files+0x2a/0x420 [ 85.841084][ T5346] __x64_sys_pwrite64+0x193/0x220 [ 85.843406][ T5346] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 85.845790][ T5346] do_syscall_64+0xec/0xf80 [ 85.847703][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.850081][ T5346] ? trace_irq_disable+0x37/0x100 [ 85.852201][ T5346] ? clear_bhb_loop+0x60/0xb0 [ 85.854128][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.856517][ T5346] RIP: 0033:0x7fe61258f7c9 [ 85.858334][ T5346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.866233][ T5346] RSP: 002b:00007fe6134a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 85.869772][ T5346] RAX: ffffffffffffffda RBX: 00007fe6127e6090 RCX: 00007fe61258f7c9 [ 85.873185][ T5346] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000026 [ 85.876566][ T5346] RBP: 00007fe612613f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.880066][ T5346] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 [ 85.883542][ T5346] R13: 00007fe6127e6128 R14: 00007fe6127e6090 R15: 00007ffe60227bc8 [ 85.886881][ T5346] [ 85.888527][ T5346] Kernel Offset: disabled [ 85.890480][ T5346] Rebooting in 86400 seconds..