program:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800700, &(0x7f0000000880), 0x3, 0x467, &(0x7f0000002280)="$eJzs3M9rHFUcAPDvzCb93SbWKrRWjRYx+CNp0qo9eFEUPFQU9FCPcZOW0m0jTQRbio0i9SJIQc/iUfAv8OZF1JPgVe9SKBqEVk+R2Z1JN9vdZNNsdmv384Fp39t5M/O+O+/tvJm3mwD61kj2TxKxKyJ+i4ihWnZlgZHafzcXL5X/WbxUTmJp6a0/k2q5G4uXykXRYrudeWY0jUg/SfKDxNb63c5duHhmqlKZOZ/nx+fPvjc+d+His6fPTp2aOTVzbvLYsaNHJl54fvK5tuJI1lifxXXjwIezB/e/9s7V18snrr7707fZNrvy9fVxdMpIFvhfS1WN657o9MF6bHddOhnoYUVYl1JEZKdrsNr/h6IUt07eULz6cU8rB2yq7Nq0tfXqhSXgHpbE2mX+7kZFgC4rLvTZ/W+xdGnocVe4/lLtBiiL+2a+1NYMRJqXGWy4v+2kkYg4sfDvV9kSm/QcAgCg3mflL4/HM83Gf2k8WFduTz6HMhwR90XE3oi4PyL2RcQDEVnZxiFlW0Ya8rePf9JrdxhaW7Lx34v53NbK8V8x+ovhUp7bXY1/MDl5ujJzOH9PRmNwa5afWOUY37/y6+et1tWP/7IlO34xFszrcW2g4QHd9NT8VHVQ2gHXP4o4MNAs/mR5JiCJiP0RcWB9u95TJE4/9c3B7QebF1o7/lV0YJ5p6euIJ2vnfyEa4i8kq89Pjm+Lyszh8aJV3O7nX6682er4LeLfsvHI2pOd/x0r239jkeGkfr52bv3HuPL7py3vae60/W9J3q6el+KN+mBqfv78RMSW5Hg1v+L1yVvbFvmifBb/6KHm/X9vvk12nIciImvCD0fEIxHxaF73xyLi8Yg4tEr8P76cJ5q01w21/w7I4p9u+vm33P4bzv/6E6UzP3xX7GzbuuPPzv/Ramo0f6X6+beGdiu40fcPAAAA/g/S6nfgk3RsOZ2mY2O17/Dvix1pZXZu/umTs++fm659V344BtPiSddQ3fPQiWQh32MtP5k/Ky7WH8mfG39R2l7Nj5VnK9M9jh363c4W/T/zR6nXtQM2XbN5tMmuTUEBvdTY/9OV2ctvdLMyQFf5vTb0rzX6f9qtegDd5/oP/atZ/7/ckDcXAPcm13/oX/o/9C/9H/qX/g99aSO/65fo50Sklcr0tojVCxd/EOjuqLNE+4lefzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0xn8BAAD///xQ9VA=")
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0)
mkdir(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x5)
creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000001c0)={0x65, 0x8, 0x0, "83076781786706f82bb0f2f0c89a8dc1e020acd89797a653badc699307c49dc9e05d90cd98379b52d4098a6414cce1cc375a3e78d7d76628a88505a5d3113fe95f5f485306dc7af4f835777ddccb8791a3af633d5fb59fac59114a1bfa9893b0e075863ced"})
mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1)
symlink(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
[ 68.909066][ T4672] Bluetooth: hci0: command tx timeout
[ 68.980582][ T5325] loop0: detected capacity change from 0 to 512
[ 69.004136][ T5325] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz.0.0: corrupted in-inode xattr: invalid ea_ino
[ 69.015982][ T5325] EXT4-fs error (device loop0): ext4_orphan_get:1393: comm syz.0.0: couldn't read orphan inode 15 (err -117)
[ 69.021866][ T5325] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 69.037382][ T5325] ==================================================================
[ 69.040547][ T5325] BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0
[ 69.043503][ T5325] Write of size 251 at addr ffff88804c7c9f14 by task syz.0.0/5325
[ 69.046506][ T5325]
[ 69.047401][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.12.0-rc6-syzkaller #0
[ 69.050902][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.054966][ T5325] Call Trace:
[ 69.056382][ T5325]
[ 69.057513][ T5325] dump_stack_lvl+0x241/0x360
[ 69.059578][ T5325] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.061909][ T5325] ? __pfx__printk+0x10/0x10
[ 69.063754][ T5325] ? _printk+0xd5/0x120
[ 69.065464][ T5325] ? __virt_addr_valid+0x183/0x530
[ 69.067448][ T5325] ? __virt_addr_valid+0x183/0x530
[ 69.069680][ T5325] print_report+0x169/0x550
[ 69.071494][ T5325] ? __virt_addr_valid+0x183/0x530
[ 69.073469][ T5325] ? __virt_addr_valid+0x183/0x530
[ 69.075484][ T5325] ? __virt_addr_valid+0x45f/0x530
[ 69.077530][ T5325] ? __phys_addr+0xba/0x170
[ 69.079321][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.081333][ T5325] kasan_report+0x143/0x180
[ 69.083256][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.085329][ T5325] kasan_check_range+0x282/0x290
[ 69.087197][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.089243][ T5325] __asan_memcpy+0x40/0x70
[ 69.090993][ T5325] ext4_insert_dentry+0x36a/0x6d0
[ 69.092934][ T5325] add_dirent_to_buf+0x3d9/0x750
[ 69.094840][ T5325] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 69.096895][ T5325] ? __ext4_handle_dirty_metadata+0x30d/0x820
[ 69.099283][ T5325] make_indexed_dir+0xf98/0x1600
[ 69.101121][ T5325] ? __pfx_make_indexed_dir+0x10/0x10
[ 69.103114][ T5325] ? add_dirent_to_buf+0x398/0x750
[ 69.105090][ T5325] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 69.107215][ T5325] ? __ext4_read_dirblock+0x527/0x890
[ 69.109273][ T5325] ext4_add_entry+0x222a/0x25d0
[ 69.111131][ T5325] ? __pfx_ext4_initxattrs+0x10/0x10
[ 69.113118][ T5325] ? __pfx_security_inode_init_security+0x10/0x10
[ 69.115579][ T5325] ? rcu_is_watching+0x15/0xb0
[ 69.117403][ T5325] ? __brelse+0x59/0xa0
[ 69.118967][ T5325] ? __ext4_new_inode+0x380f/0x4380
[ 69.121047][ T5325] ? __pfx_ext4_add_entry+0x10/0x10
[ 69.123383][ T5325] ext4_add_nondir+0x8d/0x290
[ 69.125236][ T5325] ? ext4_symlink+0x6ce/0xb50
[ 69.127041][ T5325] ext4_symlink+0x920/0xb50
[ 69.128784][ T5325] ? __pfx_ext4_symlink+0x10/0x10
[ 69.130684][ T5325] ? generic_permission+0x1e0/0x550
[ 69.132571][ T5325] ? inode_permission+0xff/0x460
[ 69.134768][ T5325] ? bpf_lsm_inode_symlink+0x9/0x10
[ 69.136873][ T5325] ? security_inode_symlink+0xbe/0x330
[ 69.138937][ T5325] vfs_symlink+0x137/0x2e0
[ 69.140648][ T5325] do_symlinkat+0x222/0x3a0
[ 69.142357][ T5325] ? __pfx_do_symlinkat+0x10/0x10
[ 69.144236][ T5325] ? strncpy_from_user+0x13a/0x260
[ 69.146163][ T5325] ? getname_flags+0x1e3/0x540
[ 69.147903][ T5325] __x64_sys_symlink+0x7a/0x90
[ 69.149653][ T5325] do_syscall_64+0xf3/0x230
[ 69.151505][ T5325] ? clear_bhb_loop+0x35/0x90
[ 69.153181][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.155457][ T5325] RIP: 0033:0x7f8c2617e719
[ 69.157184][ T5325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 69.164476][ T5325] RSP: 002b:00007f8c26ea4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[ 69.167615][ T5325] RAX: ffffffffffffffda RBX: 00007f8c26335f80 RCX: 00007f8c2617e719
[ 69.170523][ T5325] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0
[ 69.173267][ T5325] RBP: 00007f8c261f139e R08: 0000000000000000 R09: 0000000000000000
[ 69.176117][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 69.179029][ T5325] R13: 0000000000000000 R14: 00007f8c26335f80 R15: 00007ffec201be78
[ 69.182025][ T5325]
[ 69.183335][ T5325]
[ 69.184395][ T5325] The buggy address belongs to the physical page:
[ 69.187129][ T5325] page: refcount:3 mapcount:0 mapping:ffff888031cd4d78 index:0x3f pfn:0x4c7c9
[ 69.190505][ T5325] memcg:ffff888030476000
[ 69.192123][ T5325] aops:def_blk_aops ino:700000 dentry name(?):""
[ 69.194532][ T5325] flags: 0x4fff08000004214(referenced|dirty|workingset|private|node=1|zone=1|lastcpupid=0x7ff)
[ 69.198486][ T5325] raw: 04fff08000004214 0000000000000000 dead000000000122 ffff888031cd4d78
[ 69.201723][ T5325] raw: 000000000000003f ffff888043d620e8 00000003ffffffff ffff888030476000
[ 69.205126][ T5325] page dumped because: kasan: bad access detected
[ 69.207739][ T5325] page_owner tracks the page as allocated
[ 69.209878][ T5325] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 5325, tgid 5324 (syz.0.0), ts 69037140096, free_ts 0
[ 69.216988][ T5325] post_alloc_hook+0x1f3/0x230
[ 69.218914][ T5325] get_page_from_freelist+0x303f/0x3190
[ 69.220967][ T5325] __alloc_pages_noprof+0x292/0x710
[ 69.222946][ T5325] alloc_pages_mpol_noprof+0x3e8/0x680
[ 69.225088][ T5325] folio_alloc_noprof+0x128/0x180
[ 69.227030][ T5325] filemap_alloc_folio_noprof+0xdf/0x500
[ 69.229268][ T5325] __filemap_get_folio+0x446/0xbd0
[ 69.231230][ T5325] bdev_getblk+0x1d8/0x550
[ 69.232895][ T5325] ext4_getblk+0x303/0x800
[ 69.234607][ T5325] ext4_bread+0x2e/0x180
[ 69.236135][ T5325] ext4_append+0x327/0x5c0
[ 69.237867][ T5325] make_indexed_dir+0x523/0x1600
[ 69.239803][ T5325] ext4_add_entry+0x222a/0x25d0
[ 69.241677][ T5325] ext4_add_nondir+0x8d/0x290
[ 69.243447][ T5325] ext4_symlink+0x920/0xb50
[ 69.245272][ T5325] vfs_symlink+0x137/0x2e0
[ 69.246922][ T5325] page_owner free stack trace missing
[ 69.248848][ T5325]
[ 69.249779][ T5325] Memory state around the buggy address:
[ 69.251899][ T5325] ffff88804c7c9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.254787][ T5325] ffff88804c7c9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.257587][ T5325] >ffff88804c7ca000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 69.260639][ T5325] ^
[ 69.262214][ T5325] ffff88804c7ca080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 69.265293][ T5325] ffff88804c7ca100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 69.268198][ T5325] ==================================================================
[ 69.283641][ T5325] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 69.286370][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.12.0-rc6-syzkaller #0
[ 69.289492][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.293504][ T5325] Call Trace:
[ 69.294793][ T5325]
[ 69.295932][ T5325] dump_stack_lvl+0x241/0x360
[ 69.297731][ T5325] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.299740][ T5325] ? __pfx__printk+0x10/0x10
[ 69.301452][ T5325] ? preempt_schedule+0xe1/0xf0
[ 69.303285][ T5325] ? vscnprintf+0x5d/0x90
[ 69.304885][ T5325] panic+0x349/0x880
[ 69.306404][ T5325] ? check_panic_on_warn+0x21/0xb0
[ 69.308360][ T5325] ? __pfx_panic+0x10/0x10
[ 69.310060][ T5325] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 69.312348][ T5325] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 69.314819][ T5325] ? print_report+0x502/0x550
[ 69.316556][ T5325] check_panic_on_warn+0x86/0xb0
[ 69.318410][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.320264][ T5325] end_report+0x77/0x160
[ 69.321963][ T5325] kasan_report+0x154/0x180
[ 69.323672][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.325694][ T5325] kasan_check_range+0x282/0x290
[ 69.327532][ T5325] ? ext4_insert_dentry+0x36a/0x6d0
[ 69.329494][ T5325] __asan_memcpy+0x40/0x70
[ 69.331493][ T5325] ext4_insert_dentry+0x36a/0x6d0
[ 69.333715][ T5325] add_dirent_to_buf+0x3d9/0x750
[ 69.335719][ T5325] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 69.337719][ T5325] ? __ext4_handle_dirty_metadata+0x30d/0x820
[ 69.340075][ T5325] make_indexed_dir+0xf98/0x1600
[ 69.342042][ T5325] ? __pfx_make_indexed_dir+0x10/0x10
[ 69.344083][ T5325] ? add_dirent_to_buf+0x398/0x750
[ 69.345964][ T5325] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 69.347933][ T5325] ? __ext4_read_dirblock+0x527/0x890
[ 69.350003][ T5325] ext4_add_entry+0x222a/0x25d0
[ 69.352038][ T5325] ? __pfx_ext4_initxattrs+0x10/0x10
[ 69.354279][ T5325] ? __pfx_security_inode_init_security+0x10/0x10
[ 69.356815][ T5325] ? rcu_is_watching+0x15/0xb0
[ 69.358655][ T5325] ? __brelse+0x59/0xa0
[ 69.360210][ T5325] ? __ext4_new_inode+0x380f/0x4380
[ 69.362192][ T5325] ? __pfx_ext4_add_entry+0x10/0x10
[ 69.364221][ T5325] ext4_add_nondir+0x8d/0x290
[ 69.366109][ T5325] ? ext4_symlink+0x6ce/0xb50
[ 69.367844][ T5325] ext4_symlink+0x920/0xb50
[ 69.369649][ T5325] ? __pfx_ext4_symlink+0x10/0x10
[ 69.371634][ T5325] ? generic_permission+0x1e0/0x550
[ 69.373509][ T5325] ? inode_permission+0xff/0x460
[ 69.375420][ T5325] ? bpf_lsm_inode_symlink+0x9/0x10
[ 69.377493][ T5325] ? security_inode_symlink+0xbe/0x330
[ 69.379571][ T5325] vfs_symlink+0x137/0x2e0
[ 69.381301][ T5325] do_symlinkat+0x222/0x3a0
[ 69.383085][ T5325] ? __pfx_do_symlinkat+0x10/0x10
[ 69.385033][ T5325] ? strncpy_from_user+0x13a/0x260
[ 69.386968][ T5325] ? getname_flags+0x1e3/0x540
[ 69.388520][ T5325] __x64_sys_symlink+0x7a/0x90
[ 69.390430][ T5325] do_syscall_64+0xf3/0x230
[ 69.392505][ T5325] ? clear_bhb_loop+0x35/0x90
[ 69.394664][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.397108][ T5325] RIP: 0033:0x7f8c2617e719
[ 69.398767][ T5325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 69.406124][ T5325] RSP: 002b:00007f8c26ea4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
[ 69.409251][ T5325] RAX: ffffffffffffffda RBX: 00007f8c26335f80 RCX: 00007f8c2617e719
[ 69.412250][ T5325] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0
[ 69.415147][ T5325] RBP: 00007f8c261f139e R08: 0000000000000000 R09: 0000000000000000
[ 69.418136][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 69.421007][ T5325] R13: 0000000000000000 R14: 00007f8c26335f80 R15: 00007ffec201be78
[ 69.423875][ T5325]
[ 69.425304][ T5325] Kernel Offset: disabled
[ 69.426873][ T5325] Rebooting in 86400 seconds..