Warning: Permanently added '10.128.0.45' (ED25519) to the list of known hosts. executing program [ 44.663740][ T4018] loop0: detected capacity change from 0 to 512 [ 44.755734][ T4018] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 44.759494][ T4018] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 44.769707][ T4018] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2816: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 44.774445][ T4018] EXT4-fs (loop0): 1 truncate cleaned up [ 44.776221][ T4018] EXT4-fs (loop0): mounted filesystem without journal. Opts: nogrpid,min_batch_time=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,nobarrier,nodiscard,quota,,errors=continue. Quota mode: writeback. [ 44.792369][ T4018] ================================================================== [ 44.794705][ T4018] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0xe28/0x3078 [ 44.796973][ T4018] Read of size 18446744073709551540 at addr ffff0000c9061070 by task syz-executor583/4018 [ 44.799702][ T4018] [ 44.800390][ T4018] CPU: 0 PID: 4018 Comm: syz-executor583 Not tainted 5.15.179-syzkaller #0 [ 44.802807][ T4018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 44.805571][ T4018] Call trace: [ 44.806521][ T4018] dump_backtrace+0x0/0x530 [ 44.807815][ T4018] show_stack+0x2c/0x3c [ 44.808972][ T4018] dump_stack_lvl+0x108/0x170 [ 44.810312][ T4018] print_address_description+0x7c/0x3f0 [ 44.811803][ T4018] kasan_report+0x174/0x1e4 [ 44.813176][ T4018] kasan_check_range+0x274/0x2b4 [ 44.814784][ T4018] memmove+0x90/0xe8 [ 44.815921][ T4018] ext4_xattr_set_entry+0xe28/0x3078 [ 44.817394][ T4018] ext4_xattr_block_set+0x8ec/0x2dcc [ 44.818918][ T4018] ext4_xattr_set_handle+0xe44/0x12d8 [ 44.820477][ T4018] ext4_xattr_set+0x220/0x340 [ 44.821818][ T4018] ext4_xattr_trusted_set+0x4c/0x64 [ 44.823193][ T4018] __vfs_setxattr+0x388/0x3a4 [ 44.824480][ T4018] __vfs_setxattr_noperm+0x110/0x528 [ 44.825949][ T4018] __vfs_setxattr_locked+0x1ec/0x218 [ 44.827357][ T4018] vfs_setxattr+0x1a8/0x344 [ 44.828665][ T4018] setxattr+0x250/0x2b4 [ 44.829841][ T4018] path_setxattr+0x17c/0x258 [ 44.831184][ T4018] __arm64_sys_lsetxattr+0xbc/0xd8 [ 44.832615][ T4018] invoke_syscall+0x98/0x2b8 [ 44.833850][ T4018] el0_svc_common+0x138/0x258 [ 44.835169][ T4018] do_el0_svc+0x58/0x14c [ 44.836330][ T4018] el0_svc+0x7c/0x1f0 [ 44.837437][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.838866][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 44.840135][ T4018] [ 44.840879][ T4018] Allocated by task 4018: [ 44.842077][ T4018] ____kasan_kmalloc+0xbc/0xfc [ 44.843359][ T4018] __kasan_kmalloc+0x10/0x1c [ 44.844602][ T4018] __kmalloc_track_caller+0x218/0x3d8 [ 44.846105][ T4018] kmemdup+0xcc/0x144 [ 44.847213][ T4018] ext4_xattr_block_set+0x7c0/0x2dcc [ 44.848657][ T4018] ext4_xattr_set_handle+0xe44/0x12d8 [ 44.850137][ T4018] ext4_xattr_set+0x220/0x340 [ 44.851456][ T4018] ext4_xattr_trusted_set+0x4c/0x64 [ 44.852954][ T4018] __vfs_setxattr+0x388/0x3a4 [ 44.854276][ T4018] __vfs_setxattr_noperm+0x110/0x528 [ 44.855843][ T4018] __vfs_setxattr_locked+0x1ec/0x218 [ 44.857324][ T4018] vfs_setxattr+0x1a8/0x344 [ 44.858547][ T4018] setxattr+0x250/0x2b4 [ 44.859735][ T4018] path_setxattr+0x17c/0x258 [ 44.861092][ T4018] __arm64_sys_lsetxattr+0xbc/0xd8 [ 44.862536][ T4018] invoke_syscall+0x98/0x2b8 [ 44.863748][ T4018] el0_svc_common+0x138/0x258 [ 44.865060][ T4018] do_el0_svc+0x58/0x14c [ 44.866297][ T4018] el0_svc+0x7c/0x1f0 [ 44.867437][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.868945][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 44.870212][ T4018] [ 44.870925][ T4018] The buggy address belongs to the object at ffff0000c9061000 [ 44.870925][ T4018] which belongs to the cache kmalloc-1k of size 1024 [ 44.874961][ T4018] The buggy address is located 112 bytes inside of [ 44.874961][ T4018] 1024-byte region [ffff0000c9061000, ffff0000c9061400) [ 44.878783][ T4018] The buggy address belongs to the page: [ 44.880364][ T4018] page:00000000b4c33ad1 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109060 [ 44.883353][ T4018] head:00000000b4c33ad1 order:3 compound_mapcount:0 compound_pincount:0 [ 44.885837][ T4018] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 44.888427][ T4018] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 44.890876][ T4018] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 44.893302][ T4018] page dumped because: kasan: bad access detected [ 44.895145][ T4018] [ 44.895763][ T4018] Memory state around the buggy address: [ 44.897453][ T4018] ffff0000c9060f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.899808][ T4018] ffff0000c9060f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.902145][ T4018] >ffff0000c9061000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.904453][ T4018] ^ [ 44.906893][ T4018] ffff0000c9061080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.909247][ T4018] ffff0000c9061100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 44.911546][ T4018] ================================================================== [ 44.913814][ T4018] Disabling lock debugging due to kernel taint