program: r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000100)=0x10, 0x800) bind$llc(r0, &(0x7f0000000180)={0x1a, 0x18, 0x26, 0x9, 0x7, 0x5}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x40, &(0x7f00000000c0), 0xff, 0x4df, &(0x7f0000010a80)="$eJzs3c9rHFUcAPDv7Cb9GZuotdraarSKwR9Jk/6wBw8qCoIKgh7qMSZprd020kRoS9AoUs8F7+JR8OjJmxdRD+IfoOBRCkWD0FQUIrM7k2R/Jdsm6TbJ5wPbfW/2zcx7M+9l37y3Mw1g0+pN/0kiuiLi14jorkSrE/RW3mZnpkZuzEyNJDE39+afSTnd9ZmpkTxpvt7OLNJXiCh8msTzSf1+Jy5eOjNcKo2dz+IDk2ffH5i4eOmZ02eHT42dGjs3dPz4kcODzx4bOlq1XoNN1dneYFlaruv7Phzfv/eVt6+8PnLiyjs/fp1ua8+ByudZOba0sPmIG3W5eDViui5Zb3rU/porq/3s8ZZ2tH7ctSicdLQxI9yUYkSkp6uz3P67oxgLJ687Xv6krZkD1lT63bS1+cfTc8AGlkS7cwC0R/5Fn17/5q/47zZ1Pu4A115YuOifnZkamZ0fz+iIQra8cw333xsRJ6b/+SJ9Rc14CgDAWij3bZ6u6f+VFWJP+b0y17Erm0PpiYi7I+KeiLg3InZHxH0R5bT3R8QDlZXnulvcf29NvL7/U7jaMM+rJO3/Pbeo7zc7M1U9HFaInmL5rTLH0ROdycnTpbFD2THpi86taXxwiX1891LzaaXF/b/0leahJgNXOyoL5jcyOjw5vFoH4drHEfs6qsqfHf9kfiYgrQF7I2LfzW16Vx44/eRX+5slalT+vC+8rFWYZ5r7MuKJyvmfjpry55Im85NpHT82dHRgW5TGDg3ktaLeT79cfqPZ/ldU/lWQnv8d1fW/JkX330llvrYzSqWx8xM3v4/Lv33W9Jpm+fLP1/95af3fkrxVnrP++d3KsgvDk5PnByO2JK+V41lj2Rbp8qGFdS9k8Tx9Wv6+g43qf6H8Ny6y8/9gRKSV+EDEroci4uEs749ExKMRcXCJ8v/w4mPvLVH+JJJo6/kfjcbtP9OTLJ6vv4VA8cz33zabt2/t/B8pz673ZUvKf/+W0WoGV3j4AAAAYF0oRERXJIX+Sri3KwqF/v7Kb/h3x45CaXxi8qmT4x+cG63cI9ATnYV8pKt70XjoYJL//r0SH8rGivPPD2fjxp8Xt5fj/SPjpdE2lx02u53V7T/y9p/6o9ju3AFrrvk82hK3BgAbQm37L7QpH8Dt18rvaFwLwMbUoP0veobGv9W3CtU/5wJYxzoahIDNoVGr/6gmXtf/b/SULWDdqW//vzd4ZB2wEen1w+al/cPmpf3DprSS+/pvPZDfLLBk4jyLDdNsa/kO/80SyB8Ps5b72h4LS6JQDnRF07V2tOto5GPVSybubmWDEfHNivNTXIVypS2meklxuQKuMNDqf4YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwZ/s/AAD//16M4Cg=") r1 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) write$FUSE_BMAP(r1, &(0x7f00000026c0)={0x18, 0x7b3620c31cc0b28a}, 0x18) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)={0x246000, 0x80, 0x8}, 0x18) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x139) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x200000000004, 0x0, 0x0, 0x19, 0x8, "ef359f413bb93852f7d6a4ae5c70f20ff8ee09e737ff0edf1139c2eb4b68c660e677df7019051caafa00afaaf755a314a10400", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a323ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000522100000001", [0x8, 0x100]}) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r1, &(0x7f0000000000), 0x100000, 0x100fbff}]) [ 95.192989][ T4661] Bluetooth: hci0: command tx timeout [ 95.322317][ T5332] loop0: detected capacity change from 0 to 512 [ 95.368904][ T5332] ======================================================= [ 95.368904][ T5332] WARNING: The mand mount option has been deprecated and [ 95.368904][ T5332] and is ignored by this kernel. Remove the mand [ 95.368904][ T5332] option from the mount to silence this warning. [ 95.368904][ T5332] ======================================================= [ 95.500936][ T5332] EXT4-fs error (device loop0): ext4_orphan_get:1397: inode #15: comm syz.0.0: inode has both inline data and extents flags [ 95.515225][ T5332] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 95.518144][ T5332] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 95.526377][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 95.526414][ C0] EXT4-fs (loop0): initial error at time 1780091906: ext4_orphan_get:1397: inode 15 [ 95.526426][ C0] EXT4-fs (loop0): last error at time 1780091906: ext4_orphan_get:1397: inode 15 [ 95.575776][ T5332] loop0: lost filesystem error report for type 5 error -117 [ 95.580497][ T5332] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 95.666095][ T5332] loop0: detected capacity change from 512 to 511 [ 95.695229][ T5332] ================================================================== [ 95.698496][ T5332] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.701781][ T5332] Read of size 18446744073709551600 at addr ffff888023e4d5b8 by task syz.0.0/5332 [ 95.705596][ T5332] [ 95.706612][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.706624][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.706629][ T5332] Call Trace: [ 95.706635][ T5332] [ 95.706639][ T5332] dump_stack_lvl+0xe8/0x150 [ 95.706651][ T5332] print_address_description+0x55/0x1e0 [ 95.706661][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.706668][ T5332] print_report+0x58/0x70 [ 95.706675][ T5332] kasan_report+0x117/0x150 [ 95.706687][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.706694][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.706702][ T5332] kasan_check_range+0x264/0x2c0 [ 95.706712][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.706719][ T5332] __asan_memmove+0x29/0x70 [ 95.706727][ T5332] ext4_xattr_set_entry+0x9c1/0x1e20 [ 95.706737][ T5332] ext4_xattr_ibody_set+0x254/0x6a0 [ 95.706749][ T5332] ext4_destroy_inline_data_nolock+0x23a/0x5e0 [ 95.706760][ T5332] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 95.706770][ T5332] ? down_write+0x16d/0x200 [ 95.706827][ T5332] ext4_convert_inline_data_to_extent+0x547/0xde0 [ 95.706839][ T5332] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 95.706847][ T5332] ? irqentry_exit+0x218/0x8b0 [ 95.706855][ T5332] ? ext4_inode_journal_mode+0x193/0x470 [ 95.706865][ T5332] ? trace_irq_disable+0x3b/0x140 [ 95.706876][ T5332] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 95.706888][ T5332] ext4_write_begin+0x357/0x1890 [ 95.706902][ T5332] ? folio_unlock+0x101/0x160 [ 95.706915][ T5332] ? ext4_load_tail_bh+0x452/0x7f0 [ 95.706926][ T5332] ? __pfx_ext4_write_begin+0x10/0x10 [ 95.706935][ T5332] generic_perform_write+0x2e2/0x8f0 [ 95.706950][ T5332] ? __pfx_generic_perform_write+0x10/0x10 [ 95.706966][ T5332] ext4_buffered_write_iter+0xce/0x3a0 [ 95.706983][ T5332] ext4_file_write_iter+0x298/0x1bf0 [ 95.706996][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.707006][ T5332] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.707023][ T5332] ? io_submit_one+0x7bb/0x14c0 [ 95.707045][ T5332] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 95.707061][ T5332] ? aio_write+0x547/0x870 [ 95.707077][ T5332] aio_write+0x5cd/0x870 [ 95.707095][ T5332] ? __pfx_aio_write+0x10/0x10 [ 95.707114][ T5332] ? __might_fault+0xaf/0x130 [ 95.707131][ T5332] io_submit_one+0x7bb/0x14c0 [ 95.707145][ T5332] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.707156][ T5332] ? __pfx_io_submit_one+0x10/0x10 [ 95.707165][ T5332] ? __might_fault+0xaf/0x130 [ 95.707174][ T5332] ? __might_fault+0xaf/0x130 [ 95.707182][ T5332] __se_sys_io_submit+0x195/0x340 [ 95.707191][ T5332] ? __pfx___se_sys_io_submit+0x10/0x10 [ 95.707201][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.707209][ T5332] do_syscall_64+0x174/0x580 [ 95.707216][ T5332] ? trace_irq_disable+0x3b/0x140 [ 95.707225][ T5332] ? clear_bhb_loop+0x40/0x90 [ 95.707233][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.707240][ T5332] RIP: 0033:0x7f710fb9ce59 [ 95.707249][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.707256][ T5332] RSP: 002b:00007f710bfecfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 95.707265][ T5332] RAX: ffffffffffffffda RBX: 00007f710fe15fa0 RCX: 00007f710fb9ce59 [ 95.707271][ T5332] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f710bfa3000 [ 95.707276][ T5332] RBP: 00007f710fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 95.707283][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.707287][ T5332] R13: 00007f710fe16038 R14: 00007f710fe15fa0 R15: 00007ffc86b9b4c8 [ 95.707295][ T5332] [ 95.707297][ T5332] [ 95.858877][ T5332] The buggy address belongs to the physical page: [ 95.861646][ T5332] page: refcount:3 mapcount:0 mapping:ffff88801cc25940 index:0x2 pfn:0x23e4d [ 95.865410][ T5332] memcg:ffff888033c9a700 [ 95.867286][ T5332] aops:def_blk_aops ino:700000 dentry name(?):"" [ 95.869994][ T5332] flags: 0xfff18000004214(referenced|dirty|workingset|private|node=0|zone=1|lastcpupid=0x7ff) [ 95.874415][ T5332] raw: 00fff18000004214 0000000000000000 dead000000000122 ffff88801cc25940 [ 95.878172][ T5332] raw: 0000000000000002 ffff888046aa5000 00000003ffffffff ffff888033c9a700 [ 95.881959][ T5332] page dumped because: kasan: bad access detected [ 95.884740][ T5332] page_owner tracks the page as allocated [ 95.887149][ T5332] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5332, tgid 5331 (syz.0.0), ts 95691709616, free_ts 95452525551 [ 95.895274][ T5332] post_alloc_hook+0x22d/0x280 [ 95.897292][ T5332] get_page_from_freelist+0x2593/0x2610 [ 95.899664][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.902215][ T5332] alloc_pages_mpol+0x235/0x490 [ 95.904106][ T5332] alloc_pages_noprof+0xac/0x2a0 [ 95.906255][ T5332] folio_alloc_noprof+0x1e/0x30 [ 95.908395][ T5332] filemap_alloc_folio_noprof+0x111/0x470 [ 95.910914][ T5332] __filemap_get_folio_mpol+0x3fc/0xb00 [ 95.913361][ T5332] bdev_getblk+0x1f6/0x6e0 [ 95.915407][ T5332] __ext4_get_inode_loc+0x528/0xfa0 [ 95.917582][ T5332] ext4_reserve_inode_write+0x18b/0x360 [ 95.919907][ T5332] __ext4_mark_inode_dirty+0x14b/0x710 [ 95.922193][ T5332] ext4_dirty_inode+0xd0/0x110 [ 95.924215][ T5332] __mark_inode_dirty+0x3a4/0x13b0 [ 95.926367][ T5332] file_update_time_flags+0x3ee/0x4a0 [ 95.928824][ T5332] ext4_write_checks+0x2a9/0x480 [ 95.930922][ T5332] page last free pid 75 tgid 75 stack trace: [ 95.933548][ T5332] free_unref_folios+0xd9f/0x14c0 [ 95.935865][ T5332] shrink_folio_list+0x4a88/0x52a0 [ 95.938018][ T5332] evict_folios+0x4998/0x5ac0 [ 95.940169][ T5332] try_to_shrink_lruvec+0xbca/0x1050 [ 95.942245][ T5332] shrink_one+0x25c/0x710 [ 95.944128][ T5332] shrink_node+0x31bf/0x3ae0 [ 95.946185][ T5332] kswapd+0x1736/0x2de0 [ 95.948016][ T5332] kthread+0x389/0x470 [ 95.949798][ T5332] ret_from_fork+0x514/0xb70 [ 95.951805][ T5332] ret_from_fork_asm+0x1a/0x30 [ 95.953902][ T5332] [ 95.954976][ T5332] Memory state around the buggy address: [ 95.957272][ T5332] ffff888023e4d480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.960684][ T5332] ffff888023e4d500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.964135][ T5332] >ffff888023e4d580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.968023][ T5332] ^ [ 95.971228][ T5332] ffff888023e4d600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.974679][ T5332] ffff888023e4d680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.978403][ T5332] ================================================================== [ 96.056902][ T5332] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 96.060145][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.063957][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.068149][ T5332] Call Trace: [ 96.069624][ T5332] [ 96.070920][ T5332] vpanic+0x56c/0xa60 [ 96.072597][ T5332] ? __pfx_vpanic+0x10/0x10 [ 96.074634][ T5332] ? __pfx___schedule+0x10/0x10 [ 96.076815][ T5332] panic+0xc5/0xd0 [ 96.078357][ T5332] ? __pfx_panic+0x10/0x10 [ 96.080247][ T5332] ? preempt_schedule_thunk+0x16/0x30 [ 96.082596][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.085126][ T5332] check_panic_on_warn+0x89/0xb0 [ 96.087370][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.089761][ T5332] end_report+0x73/0x170 [ 96.091664][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.094015][ T5332] kasan_report+0x128/0x150 [ 96.096177][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.098628][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.100959][ T5332] kasan_check_range+0x264/0x2c0 [ 96.103132][ T5332] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.105527][ T5332] __asan_memmove+0x29/0x70 [ 96.107454][ T5332] ext4_xattr_set_entry+0x9c1/0x1e20 [ 96.109817][ T5332] ext4_xattr_ibody_set+0x254/0x6a0 [ 96.112061][ T5332] ext4_destroy_inline_data_nolock+0x23a/0x5e0 [ 96.114761][ T5332] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 96.117654][ T5332] ? down_write+0x16d/0x200 [ 96.119629][ T5332] ext4_convert_inline_data_to_extent+0x547/0xde0 [ 96.122338][ T5332] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 96.125184][ T5332] ? irqentry_exit+0x218/0x8b0 [ 96.127284][ T5332] ? ext4_inode_journal_mode+0x193/0x470 [ 96.129766][ T5332] ? trace_irq_disable+0x3b/0x140 [ 96.132005][ T5332] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 96.134716][ T5332] ext4_write_begin+0x357/0x1890 [ 96.136894][ T5332] ? folio_unlock+0x101/0x160 [ 96.138928][ T5332] ? ext4_load_tail_bh+0x452/0x7f0 [ 96.141071][ T5332] ? __pfx_ext4_write_begin+0x10/0x10 [ 96.143408][ T5332] generic_perform_write+0x2e2/0x8f0 [ 96.145780][ T5332] ? __pfx_generic_perform_write+0x10/0x10 [ 96.148235][ T5332] ext4_buffered_write_iter+0xce/0x3a0 [ 96.150594][ T5332] ext4_file_write_iter+0x298/0x1bf0 [ 96.152837][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.155351][ T5332] ? lockdep_hardirqs_on+0x7a/0x110 [ 96.157573][ T5332] ? io_submit_one+0x7bb/0x14c0 [ 96.159700][ T5332] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 96.162153][ T5332] ? aio_write+0x547/0x870 [ 96.164054][ T5332] aio_write+0x5cd/0x870 [ 96.165961][ T5332] ? __pfx_aio_write+0x10/0x10 [ 96.168080][ T5332] ? __might_fault+0xaf/0x130 [ 96.170218][ T5332] io_submit_one+0x7bb/0x14c0 [ 96.172331][ T5332] ? lockdep_hardirqs_on+0x7a/0x110 [ 96.174716][ T5332] ? __pfx_io_submit_one+0x10/0x10 [ 96.177088][ T5332] ? __might_fault+0xaf/0x130 [ 96.179176][ T5332] ? __might_fault+0xaf/0x130 [ 96.181269][ T5332] __se_sys_io_submit+0x195/0x340 [ 96.183440][ T5332] ? __pfx___se_sys_io_submit+0x10/0x10 [ 96.185839][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.188389][ T5332] do_syscall_64+0x174/0x580 [ 96.190231][ T5332] ? trace_irq_disable+0x3b/0x140 [ 96.192691][ T5332] ? clear_bhb_loop+0x40/0x90 [ 96.194922][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.197464][ T5332] RIP: 0033:0x7f710fb9ce59 [ 96.199326][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.207395][ T5332] RSP: 002b:00007f710bfecfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 96.210946][ T5332] RAX: ffffffffffffffda RBX: 00007f710fe15fa0 RCX: 00007f710fb9ce59 [ 96.214338][ T5332] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f710bfa3000 [ 96.217816][ T5332] RBP: 00007f710fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 96.221217][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.224500][ T5332] R13: 00007f710fe16038 R14: 00007f710fe15fa0 R15: 00007ffc86b9b4c8 [ 96.227814][ T5332] [ 96.229505][ T5332] Kernel Offset: disabled [ 96.231328][ T5332] Rebooting in 86400 seconds..