program: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800700, &(0x7f0000000880)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}, {@nogrpid}, {@nobh}, {@minixdf}, {@resgid}, {@sysvgroups}, {@usrjquota}]}, 0x3, 0x467, &(0x7f0000002280)="$eJzs3M9rHFUcAPDvzCb93SbWKrRWjRYx+CNp0qo9eFEUPFQU9FCPcZOW0m0jTQRbio0i9SJIQc/iUfAv8OZF1JPgVe9SKBqEVk+R2Z1JN9vdZNNsdmv384Fp39t5M/O+O+/tvJm3mwD61kj2TxKxKyJ+i4ihWnZlgZHafzcXL5X/WbxUTmJp6a0/k2q5G4uXykXRYrudeWY0jUg/SfKDxNb63c5duHhmqlKZOZ/nx+fPvjc+d+His6fPTp2aOTVzbvLYsaNHJl54fvK5tuJI1lifxXXjwIezB/e/9s7V18snrr7707fZNrvy9fVxdMpIFvhfS1WN657o9MF6bHddOhnoYUVYl1JEZKdrsNr/h6IUt07eULz6cU8rB2yq7Nq0tfXqhSXgHpbE2mX+7kZFgC4rLvTZ/W+xdGnocVe4/lLtBiiL+2a+1NYMRJqXGWy4v+2kkYg4sfDvV9kSm/QcAgCg3mflL4/HM83Gf2k8WFduTz6HMhwR90XE3oi4PyL2RcQDEVnZxiFlW0Ya8rePf9JrdxhaW7Lx34v53NbK8V8x+ovhUp7bXY1/MDl5ujJzOH9PRmNwa5afWOUY37/y6+et1tWP/7IlO34xFszrcW2g4QHd9NT8VHVQ2gHXP4o4MNAs/mR5JiCJiP0RcWB9u95TJE4/9c3B7QebF1o7/lV0YJ5p6euIJ2vnfyEa4i8kq89Pjm+Lyszh8aJV3O7nX6682er4LeLfsvHI2pOd/x0r239jkeGkfr52bv3HuPL7py3vae60/W9J3q6el+KN+mBqfv78RMSW5Hg1v+L1yVvbFvmifBb/6KHm/X9vvk12nIciImvCD0fEIxHxaF73xyLi8Yg4tEr8P76cJ5q01w21/w7I4p9u+vm33P4bzv/6E6UzP3xX7GzbuuPPzv/Ramo0f6X6+beGdiu40fcPAAAA/g/S6nfgk3RsOZ2mY2O17/Dvix1pZXZu/umTs++fm659V344BtPiSddQ3fPQiWQh32MtP5k/Ky7WH8mfG39R2l7Nj5VnK9M9jh363c4W/T/zR6nXtQM2XbN5tMmuTUEBvdTY/9OV2ctvdLMyQFf5vTb0rzX6f9qtegDd5/oP/atZ/7/ckDcXAPcm13/oX/o/9C/9H/qX/g99aSO/65fo50Sklcr0tojVCxd/EOjuqLNE+4lefzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0xn8BAAD///xQ9VA=") chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) mkdir(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x5) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002c00)={'ip6gretap0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x48, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x48}}, 0x0) creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) symlink(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x1f00, 0x12) [ 58.089307][ T5318] loop0: detected capacity change from 0 to 512 [ 58.102338][ T5318] EXT4-fs: Ignoring removed nobh option [ 58.145227][ T5318] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz.0.0: corrupted in-inode xattr: invalid ea_ino [ 58.156982][ T5318] EXT4-fs error (device loop0): ext4_orphan_get:1394: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 58.163408][ T5318] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.181223][ T5318] ================================================================== [ 58.184257][ T5318] BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 [ 58.187077][ T5318] Write of size 251 at addr ffff888043775f14 by task syz.0.0/5318 [ 58.189878][ T5318] [ 58.190771][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-08291-g805ba04cb7cc #0 [ 58.190786][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 58.190795][ T5318] Call Trace: [ 58.190801][ T5318] [ 58.190806][ T5318] dump_stack_lvl+0x241/0x360 [ 58.190825][ T5318] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.190836][ T5318] ? __pfx__printk+0x10/0x10 [ 58.190853][ T5318] ? _printk+0xd5/0x120 [ 58.190869][ T5318] ? __virt_addr_valid+0x183/0x530 [ 58.190884][ T5318] ? __virt_addr_valid+0x183/0x530 [ 58.190899][ T5318] print_report+0x169/0x550 [ 58.190913][ T5318] ? __virt_addr_valid+0x183/0x530 [ 58.190928][ T5318] ? __virt_addr_valid+0x183/0x530 [ 58.190941][ T5318] ? __virt_addr_valid+0x45f/0x530 [ 58.190956][ T5318] ? __phys_addr+0xba/0x170 [ 58.190970][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.190984][ T5318] kasan_report+0x143/0x180 [ 58.190999][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.191013][ T5318] kasan_check_range+0x282/0x290 [ 58.191022][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.191035][ T5318] __asan_memcpy+0x40/0x70 [ 58.191049][ T5318] ext4_insert_dentry+0x36a/0x6d0 [ 58.191064][ T5318] add_dirent_to_buf+0x315/0x660 [ 58.191079][ T5318] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 58.191093][ T5318] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 58.191106][ T5318] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 58.191121][ T5318] make_indexed_dir+0xd0e/0x1350 [ 58.191138][ T5318] ? __pfx_make_indexed_dir+0x10/0x10 [ 58.191152][ T5318] ? add_dirent_to_buf+0x2a7/0x660 [ 58.191165][ T5318] ? add_dirent_to_buf+0x2c5/0x660 [ 58.191180][ T5318] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 58.191195][ T5318] ? __ext4_read_dirblock+0x486/0x790 [ 58.191209][ T5318] ext4_add_entry+0xbcd/0xe00 [ 58.191225][ T5318] ? __pfx_ext4_add_entry+0x10/0x10 [ 58.191243][ T5318] ext4_add_nondir+0x8d/0x290 [ 58.191258][ T5318] ? ext4_symlink+0x70e/0xc90 [ 58.191272][ T5318] ext4_symlink+0x9b1/0xc90 [ 58.191289][ T5318] ? __pfx_ext4_symlink+0x10/0x10 [ 58.191305][ T5318] ? inode_permission+0xff/0x460 [ 58.191316][ T5318] ? bpf_lsm_inode_symlink+0x9/0x10 [ 58.191332][ T5318] ? security_inode_symlink+0xbe/0x330 [ 58.191395][ T5318] vfs_symlink+0x137/0x2e0 [ 58.191412][ T5318] do_symlinkat+0x222/0x3a0 [ 58.191429][ T5318] ? __pfx_do_symlinkat+0x10/0x10 [ 58.191441][ T5318] ? strncpy_from_user+0x146/0x270 [ 58.191454][ T5318] ? getname_flags+0x1e3/0x540 [ 58.191465][ T5318] __x64_sys_symlink+0x7a/0x90 [ 58.191480][ T5318] do_syscall_64+0xf3/0x230 [ 58.191526][ T5318] ? clear_bhb_loop+0x35/0x90 [ 58.191543][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.191558][ T5318] RIP: 0033:0x7f874cf8cda9 [ 58.191570][ T5318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.191578][ T5318] RSP: 002b:00007f87493f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 58.191591][ T5318] RAX: ffffffffffffffda RBX: 00007f874d1a5fa0 RCX: 00007f874cf8cda9 [ 58.191599][ T5318] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 58.191605][ T5318] RBP: 00007f874d00e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 58.191613][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.191620][ T5318] R13: 0000000000000000 R14: 00007f874d1a5fa0 R15: 00007ffc0ff62e18 [ 58.191632][ T5318] [ 58.191636][ T5318] [ 58.314494][ T5318] The buggy address belongs to the physical page: [ 58.317273][ T5318] page: refcount:3 mapcount:0 mapping:ffff888000884d78 index:0x3f pfn:0x43775 [ 58.320556][ T5318] memcg:ffff888052f70000 [ 58.322166][ T5318] aops:def_blk_aops ino:700000 dentry name(?):"" [ 58.324614][ T5318] flags: 0x4fff10000004014(referenced|dirty|private|node=1|zone=1|lastcpupid=0x7ff) [ 58.327909][ T5318] raw: 04fff10000004014 0000000000000000 dead000000000122 ffff888000884d78 [ 58.330804][ T5318] raw: 000000000000003f ffff888031cbaae0 00000003ffffffff ffff888052f70000 [ 58.333937][ T5318] page dumped because: kasan: bad access detected [ 58.336304][ T5318] page_owner tracks the page as allocated [ 58.338516][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5318, tgid 5317 (syz.0.0), ts 58180196067, free_ts 58140064821 [ 58.345323][ T5318] post_alloc_hook+0x1f4/0x240 [ 58.347026][ T5318] get_page_from_freelist+0x365c/0x37a0 [ 58.349268][ T5318] __alloc_frozen_pages_noprof+0x292/0x710 [ 58.351808][ T5318] alloc_pages_mpol+0x311/0x660 [ 58.353725][ T5318] alloc_pages_noprof+0x121/0x190 [ 58.355711][ T5318] folio_alloc_noprof+0x1e/0x30 [ 58.357580][ T5318] filemap_alloc_folio_noprof+0xe1/0x540 [ 58.359773][ T5318] __filemap_get_folio+0x438/0xae0 [ 58.361753][ T5318] bdev_getblk+0x1d4/0x670 [ 58.363450][ T5318] ext4_getblk+0x31b/0x880 [ 58.365019][ T5318] ext4_bread+0x2e/0x180 [ 58.366555][ T5318] ext4_append+0x327/0x5c0 [ 58.368216][ T5318] make_indexed_dir+0x430/0x1350 [ 58.370225][ T5318] ext4_add_entry+0xbcd/0xe00 [ 58.372021][ T5318] ext4_add_nondir+0x8d/0x290 [ 58.373776][ T5318] ext4_symlink+0x9b1/0xc90 [ 58.375554][ T5318] page last free pid 5299 tgid 5299 stack trace: [ 58.377956][ T5318] free_frozen_pages+0xe0d/0x10e0 [ 58.379912][ T5318] __put_partials+0x160/0x1c0 [ 58.381801][ T5318] put_cpu_partial+0x17c/0x250 [ 58.383583][ T5318] __slab_free+0x290/0x380 [ 58.385119][ T5318] qlist_free_all+0x9a/0x140 [ 58.386734][ T5318] kasan_quarantine_reduce+0x14f/0x170 [ 58.388632][ T5318] __kasan_slab_alloc+0x23/0x80 [ 58.390291][ T5318] kmem_cache_alloc_noprof+0x1d9/0x380 [ 58.392274][ T5318] getname_flags+0xb7/0x540 [ 58.393873][ T5318] vfs_fstatat+0x3f/0x130 [ 58.395498][ T5318] __x64_sys_newfstatat+0x117/0x190 [ 58.397355][ T5318] do_syscall_64+0xf3/0x230 [ 58.398976][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.401128][ T5318] [ 58.401995][ T5318] Memory state around the buggy address: [ 58.404010][ T5318] ffff888043775f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.406775][ T5318] ffff888043775f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.409536][ T5318] >ffff888043776000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.412190][ T5318] ^ [ 58.413466][ T5318] ffff888043776080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.415957][ T5318] ffff888043776100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.418873][ T5318] ================================================================== [ 58.424148][ T4666] Bluetooth: hci0: command tx timeout [ 58.443898][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.446615][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-08291-g805ba04cb7cc #0 [ 58.450320][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 58.454159][ T5318] Call Trace: [ 58.455410][ T5318] [ 58.456409][ T5318] dump_stack_lvl+0x241/0x360 [ 58.457898][ T5318] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.459451][ T5318] ? __pfx__printk+0x10/0x10 [ 58.460840][ T5318] ? preempt_schedule+0xe1/0xf0 [ 58.462465][ T5318] ? vscnprintf+0x5d/0x90 [ 58.463932][ T5318] panic+0x349/0x880 [ 58.465294][ T5318] ? check_panic_on_warn+0x21/0xb0 [ 58.467094][ T5318] ? __pfx_panic+0x10/0x10 [ 58.468678][ T5318] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 58.470844][ T5318] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 58.473112][ T5318] ? print_report+0x502/0x550 [ 58.474837][ T5318] check_panic_on_warn+0x86/0xb0 [ 58.476645][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.478503][ T5318] end_report+0x77/0x160 [ 58.479998][ T5318] kasan_report+0x154/0x180 [ 58.481598][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.483464][ T5318] kasan_check_range+0x282/0x290 [ 58.485143][ T5318] ? ext4_insert_dentry+0x36a/0x6d0 [ 58.487014][ T5318] __asan_memcpy+0x40/0x70 [ 58.488444][ T5318] ext4_insert_dentry+0x36a/0x6d0 [ 58.490203][ T5318] add_dirent_to_buf+0x315/0x660 [ 58.492066][ T5318] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 58.493873][ T5318] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 58.495762][ T5318] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 58.497534][ T5318] make_indexed_dir+0xd0e/0x1350 [ 58.499078][ T5318] ? __pfx_make_indexed_dir+0x10/0x10 [ 58.500829][ T5318] ? add_dirent_to_buf+0x2a7/0x660 [ 58.502658][ T5318] ? add_dirent_to_buf+0x2c5/0x660 [ 58.504504][ T5318] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 58.506542][ T5318] ? __ext4_read_dirblock+0x486/0x790 [ 58.508617][ T5318] ext4_add_entry+0xbcd/0xe00 [ 58.510292][ T5318] ? __pfx_ext4_add_entry+0x10/0x10 [ 58.511934][ T5318] ext4_add_nondir+0x8d/0x290 [ 58.513609][ T5318] ? ext4_symlink+0x70e/0xc90 [ 58.515364][ T5318] ext4_symlink+0x9b1/0xc90 [ 58.516987][ T5318] ? __pfx_ext4_symlink+0x10/0x10 [ 58.518822][ T5318] ? inode_permission+0xff/0x460 [ 58.520649][ T5318] ? bpf_lsm_inode_symlink+0x9/0x10 [ 58.522576][ T5318] ? security_inode_symlink+0xbe/0x330 [ 58.524513][ T5318] vfs_symlink+0x137/0x2e0 [ 58.526108][ T5318] do_symlinkat+0x222/0x3a0 [ 58.527699][ T5318] ? __pfx_do_symlinkat+0x10/0x10 [ 58.529468][ T5318] ? strncpy_from_user+0x146/0x270 [ 58.531254][ T5318] ? getname_flags+0x1e3/0x540 [ 58.532902][ T5318] __x64_sys_symlink+0x7a/0x90 [ 58.534395][ T5318] do_syscall_64+0xf3/0x230 [ 58.535863][ T5318] ? clear_bhb_loop+0x35/0x90 [ 58.537596][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.539850][ T5318] RIP: 0033:0x7f874cf8cda9 [ 58.541835][ T5318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.548826][ T5318] RSP: 002b:00007f87493f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 58.551869][ T5318] RAX: ffffffffffffffda RBX: 00007f874d1a5fa0 RCX: 00007f874cf8cda9 [ 58.554710][ T5318] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 58.557614][ T5318] RBP: 00007f874d00e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 58.560251][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.563005][ T5318] R13: 0000000000000000 R14: 00007f874d1a5fa0 R15: 00007ffc0ff62e18 [ 58.565709][ T5318] [ 58.567142][ T5318] Kernel Offset: disabled [ 58.568699][ T5318] Rebooting in 86400 seconds..