./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1378659102 <...> forked to background, child pid 3178 no interfaces have a carrier [ 21.728736][ T3179] 8021q: adding VLAN 0 to HW filter on device bond0 [ 21.738141][ T3179] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.78' (ECDSA) to the list of known hosts. execve("./syz-executor1378659102", ["./syz-executor1378659102"], 0x7fff22ca0d60 /* 10 vars */) = 0 brk(NULL) = 0x5555570a1000 brk(0x5555570a1c40) = 0x5555570a1c40 arch_prctl(ARCH_SET_FS, 0x5555570a1300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1378659102", 4096) = 28 brk(0x5555570c2c40) = 0x5555570c2c40 brk(0x5555570c3000) = 0x5555570c3000 mprotect(0x7fa6cff02000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 sendmsg(-1, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x63\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=40}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EBADF (Bad file descriptor) sendmsg(-1, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EBADF (Bad file descriptor) sendmsg(-1, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=NULL, msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EBADF (Bad file descriptor) memfd_create("syzkaller", 0) = 3 ftruncate(3, 539650) = 0 pwrite64(3, "\x20\x00\x00\x00\x01\x02\x00\x00\x19\x00\x00\x00\x60\x01\x00\x00\x0f\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x02\x00\x00\x20\x00\x00\x20\x00\x00\x00\xdd\xf4\x65\x5f\xdd\xf4\x65\x5f\x01\x00\xff\xff\x53\xef\x01\x00\x01\x00\x00\x00\xdd\xf4\x65\x5f\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x01\x00\x00\x08\x00\x00\x00\xd2\x42\x00\x00"..., 102, 1024) = 102 pwrite64(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x68\x56\xd4\x9a\x00\xcc\x43\x71\xbd\x6a\x7c\x89\x3f\x28\x00\x45\x01\x00\x40", 31, 1248) = 31 pwrite64(3, "\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65201, 1600) = 65201 pwrite64(3, "\x14\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65475, 2048) = 65475 pwrite64(3, "\xed\x41\x00\x00\x00\x04\x00\x00\xdd\xf4\x65\x5f\xdd\xf4\x65\x5f\xdd\xf4\x65\x5f\x00\x00\x00\x00\x00\x00\x04\x00\x20", 29, 5376) = 29 pwrite64(3, "\x80\x81\x00\x00\x00\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x63\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 64571, 5632) = 64571 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 pwrite64(3, NULL, 0, 0) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 mkdir("./file0", 0777) = 0 syzkaller login: [ 41.647572][ T3607] loop0: detected capacity change from 0 to 1054 [ 41.659867][ T3607] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (14603!=0) [ 41.671505][ T3607] EXT4-fs (loop0): orphan cleanup on readonly fs [ 41.679009][ T3607] EXT4-fs error (device loop0): ext4_mb_clear_bb:5962: comm syz-executor137: Freeing blocks in system zone - Block = 16, count = 16 [ 41.694474][ T3607] EXT4-fs (loop0): Remounting filesystem read-only [ 41.701256][ T3607] ------------[ cut here ]------------ [ 41.706801][ T3607] kernel BUG at fs/ext4/ext4.h:3319! [ 41.712550][ T3607] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 41.718609][ T3607] CPU: 1 PID: 3607 Comm: syz-executor137 Not tainted 5.19.0-syzkaller-02972-g200e340f2196 #0 [ 41.728737][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 41.738768][ T3607] RIP: 0010:ext4_get_group_info+0x36e/0x3d0 [ 41.744645][ T3607] Code: ff 48 c7 c2 a0 b5 e2 89 be c3 02 00 00 48 c7 c7 00 b6 e2 89 c6 05 39 e3 89 0b 01 e8 fc 1d 16 07 e9 d9 fd ff ff e8 22 af 5d ff <0f> 0b e8 9b 76 aa ff e9 ea fc ff ff e8 91 76 aa ff e9 24 fd ff ff [ 41.764316][ T3607] RSP: 0018:ffffc90002fcf210 EFLAGS: 00010293 [ 41.770360][ T3607] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 0000000000000000 [ 41.778401][ T3607] RDX: ffff888024b99d80 RSI: ffffffff821d2a9e RDI: 0000000000000004 [ 41.786356][ T3607] RBP: ffff888021e86000 R08: 0000000000000004 R09: 0000000000000001 [ 41.794304][ T3607] R10: 00000000ffffffff R11: 0000000000000001 R12: ffff888021ee2000 [ 41.802256][ T3607] R13: ffff888021ee2678 R14: 0000000000000001 R15: dffffc0000000000 [ 41.810216][ T3607] FS: 00005555570a1300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 41.819219][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.825790][ T3607] CR2: 00000000005ded08 CR3: 0000000025559000 CR4: 0000000000350ee0 [ 41.833745][ T3607] Call Trace: [ 41.837010][ T3607] [ 41.839927][ T3607] ext4_free_blocks+0x4a2/0x2060 [ 41.844861][ T3607] ? ext4_mb_new_blocks+0x4f50/0x4f50 [ 41.850220][ T3607] ? ext4_sb_block_valid+0x380/0x610 [ 41.855495][ T3607] ? __ext4_journal_ensure_credits+0x260/0x2e0 [ 41.861634][ T3607] ? ext4_ind_truncate_ensure_credits+0x584/0x7b0 [ 41.868037][ T3607] ext4_clear_blocks+0x329/0x430 [ 41.872964][ T3607] ext4_free_data+0x1a3/0x3e0 [ 41.877628][ T3607] ext4_ind_truncate+0x6a2/0x950 [ 41.882553][ T3607] ? _raw_spin_trylock+0x2a/0x70 [ 41.887499][ T3607] ? ext4_ind_trans_blocks+0x70/0x70 [ 41.892772][ T3607] ? ext4_mb_mark_bb+0xe00/0xe00 [ 41.897697][ T3607] ? down_write+0xde/0x150 [ 41.902097][ T3607] ? down_write_killable+0x170/0x170 [ 41.907370][ T3607] ? __ext4_journal_start_sb+0x1ea/0x4a0 [ 41.912986][ T3607] ext4_truncate+0x696/0x1440 [ 41.917648][ T3607] ? ext4_punch_hole+0x1210/0x1210 [ 41.922745][ T3607] ? ext4_journal_check_start+0x1b1/0x2a0 [ 41.928455][ T3607] ext4_evict_inode+0xa5f/0x1970 [ 41.933378][ T3607] ? ext4_da_write_begin+0xaf0/0xaf0 [ 41.938647][ T3607] ? rwlock_bug.part.0+0x90/0x90 [ 41.943579][ T3607] ? ext4_da_write_begin+0xaf0/0xaf0 [ 41.948846][ T3607] evict+0x2ed/0x6b0 [ 41.952731][ T3607] iput.part.0+0x562/0x820 [ 41.957134][ T3607] ? ext4_nfs_commit_metadata+0x300/0x300 [ 41.962842][ T3607] iput+0x58/0x70 [ 41.966462][ T3607] ext4_enable_quotas+0x5c4/0xb70 [ 41.971474][ T3607] ? ext4_force_commit+0xe0/0xe0 [ 41.976422][ T3607] ? ext4_decode_error+0x190/0x190 [ 41.981526][ T3607] ? lock_downgrade+0x6e0/0x6e0 [ 41.986359][ T3607] ? lowpan_xmit_fragment+0xf0/0x740 [ 41.991637][ T3607] ? pde_free+0x100/0x100 [ 41.995953][ T3607] ext4_orphan_cleanup+0xde1/0x10f0 [ 42.001138][ T3607] ? proc_create_seq_private+0x124/0x180 [ 42.006754][ T3607] ? ext4_process_orphan+0x410/0x410 [ 42.012028][ T3607] ext4_fill_super+0xac9a/0xe830 [ 42.016966][ T3607] ? ext4_reconfigure+0x29c0/0x29c0 [ 42.022148][ T3607] ? snprintf+0xbb/0xf0 [ 42.026294][ T3607] ? vsprintf+0x30/0x30 [ 42.030437][ T3607] ? wait_for_completion_io_timeout+0x20/0x20 [ 42.036498][ T3607] ? set_blocksize+0x2e5/0x370 [ 42.041250][ T3607] get_tree_bdev+0x440/0x760 [ 42.045915][ T3607] ? ext4_reconfigure+0x29c0/0x29c0 [ 42.051097][ T3607] vfs_get_tree+0x89/0x2f0 [ 42.055497][ T3607] path_mount+0x1320/0x1fa0 [ 42.059987][ T3607] ? putname+0xfe/0x140 [ 42.064127][ T3607] ? kmem_cache_free+0xed/0x5b0 [ 42.068966][ T3607] ? finish_automount+0xaf0/0xaf0 [ 42.073979][ T3607] ? putname+0xfe/0x140 [ 42.078122][ T3607] __x64_sys_mount+0x27f/0x300 [ 42.082875][ T3607] ? copy_mnt_ns+0xae0/0xae0 [ 42.087447][ T3607] ? lockdep_hardirqs_on+0x79/0x100 [ 42.092632][ T3607] ? _raw_spin_unlock_irq+0x2a/0x40 [ 42.097816][ T3607] ? ptrace_notify+0xfa/0x140 [ 42.102483][ T3607] do_syscall_64+0x35/0xb0 [ 42.106892][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.112772][ T3607] RIP: 0033:0x7fa6cfe974da [ 42.117173][ T3607] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 42.136943][ T3607] RSP: 002b:00007ffc803cf6f8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 42.145341][ T3607] RAX: ffffffffffffffda RBX: 00007ffc803cf750 RCX: 00007fa6cfe974da [ 42.153299][ T3607] RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffc803cf710 [ 42.161258][ T3607] RBP: 00007ffc803cf710 R08: 00007ffc803cf750 R09: 0000000800000015 [ 42.169217][ T3607] R10: 0000000000000081 R11: 0000000000000206 R12: 0000000000000004 [ 42.177176][ T3607] R13: 0000000000000003 R14: 0000000000000003 R15: 0000000000000010 [ 42.185136][ T3607] [ 42.188139][ T3607] Modules linked in: [ 42.198277][ T3607] ---[ end trace 0000000000000000 ]--- [ 42.203797][ T3607] RIP: 0010:ext4_get_group_info+0x36e/0x3d0 [ 42.210012][ T3607] Code: ff 48 c7 c2 a0 b5 e2 89 be c3 02 00 00 48 c7 c7 00 b6 e2 89 c6 05 39 e3 89 0b 01 e8 fc 1d 16 07 e9 d9 fd ff ff e8 22 af 5d ff <0f> 0b e8 9b 76 aa ff e9 ea fc ff ff e8 91 76 aa ff e9 24 fd ff ff [ 42.230060][ T3607] RSP: 0018:ffffc90002fcf210 EFLAGS: 00010293 [ 42.236143][ T3607] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 0000000000000000 [ 42.244196][ T3607] RDX: ffff888024b99d80 RSI: ffffffff821d2a9e RDI: 0000000000000004 [ 42.252225][ T3607] RBP: ffff888021e86000 R08: 0000000000000004 R09: 0000000000000001 [ 42.260231][ T3607] R10: 00000000ffffffff R11: 0000000000000001 R12: ffff888021ee2000 [ 42.268235][ T3607] R13: ffff888021ee2678 R14: 0000000000000001 R15: dffffc0000000000 [ 42.276255][ T3607] FS: 00005555570a1300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 42.285216][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.291821][ T3607] CR2: 00007ffc803d0000 CR3: 0000000025559000 CR4: 0000000000350ef0 [ 42.299827][ T3607] Kernel panic - not syncing: Fatal exception [ 42.306463][ T3607] Kernel Offset: disabled [ 42.311091][ T3607] Rebooting in 86400 seconds..