program: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r1 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000008940)={0x0, {}, 0x0, {}, 0x9, 0x5, 0x6, 0x9, "9e959f16deab7b08aa26e66c4056a516950773ff0000000000eef4fb0efcc1d8a6078ed9d5f8643902dd8f6fac274de9d940ffa5e592bbd48685450d004b0b00", "f625c10e6e0080ffffffffffffffff7e904dc8df6aa3a893ec00347f41be6908", [0xa, 0x80000476]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file1\x00', &(0x7f0000000080), &(0x7f00000000c0)='./bus\x00', 0x6, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) write$FUSE_DIRENT(r0, 0x0, 0x88) [ 93.814493][ T5290] Bluetooth: hci0: command tx timeout [ 93.950513][ T5329] loop0: detected capacity change from 0 to 512 [ 94.026625][ T5329] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 94.048651][ T5329] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 94.079606][ T5329] EXT4-fs error (device loop0): ext4_orphan_get:1425: comm syz.0.0: bad orphan inode 131083 [ 94.097072][ T5329] loop0: lost filesystem error report for type 5 error -117 [ 94.099133][ T5329] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.122093][ T25] audit: type=1800 audit(1785113747.561:2): pid=5329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 94.146119][ T5329] loop0: detected capacity change from 512 to 511 [ 94.201456][ T5329] ================================================================== [ 94.204765][ T5329] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.207919][ T5329] Read of size 18446744073709551600 at addr ffff88804d4662d8 by task syz.0.0/5329 [ 94.211783][ T5329] [ 94.212849][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.212864][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.212872][ T5329] Call Trace: [ 94.212880][ T5329] [ 94.212886][ T5329] dump_stack_lvl+0xe8/0x150 [ 94.212908][ T5329] print_address_description+0x55/0x1e0 [ 94.212925][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.212938][ T5329] print_report+0x58/0x70 [ 94.212950][ T5329] kasan_report+0x117/0x150 [ 94.212965][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.212977][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.212988][ T5329] kasan_check_range+0x264/0x2c0 [ 94.213002][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.213013][ T5329] __asan_memmove+0x29/0x70 [ 94.213023][ T5329] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.213039][ T5329] ext4_xattr_ibody_set+0x262/0x710 [ 94.213052][ T5329] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.213068][ T5329] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.213082][ T5329] ? ext4_read_inline_folio+0x6fe/0x860 [ 94.213095][ T5329] ? __pfx_ext4_read_inline_folio+0x10/0x10 [ 94.213107][ T5329] ? down_write+0x16d/0x200 [ 94.214006][ T5329] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.214019][ T5329] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.214034][ T5329] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.214049][ T5329] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.214067][ T5329] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.214082][ T5329] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.214091][ T5329] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.214103][ T5329] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 94.214116][ T5329] ext4_write_begin+0x349/0x1850 [ 94.214127][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 94.214149][ T5329] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.214165][ T5329] generic_perform_write+0x2d5/0x8f0 [ 94.214181][ T5329] ? __pfx_generic_perform_write+0x10/0x10 [ 94.214195][ T5329] ext4_buffered_write_iter+0xcb/0x370 [ 94.214212][ T5329] ext4_file_write_iter+0x947/0x1c70 [ 94.214230][ T5329] ? vfs_write+0x22b/0xba0 [ 94.214244][ T5329] ? vfs_write+0x22b/0xba0 [ 94.214258][ T5329] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.214275][ T5329] vfs_write+0x612/0xba0 [ 94.214291][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 94.214308][ T5329] ? __fget_files+0x2a/0x420 [ 94.214322][ T5329] ksys_write+0x150/0x270 [ 94.214336][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 94.214352][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.214363][ T5329] do_syscall_64+0x174/0x580 [ 94.214374][ T5329] ? trace_irq_disable+0x3b/0x140 [ 94.214387][ T5329] ? clear_bhb_loop+0x40/0x90 [ 94.214397][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.214408][ T5329] RIP: 0033:0x7f132639de99 [ 94.214420][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.214430][ T5329] RSP: 002b:00007f13271b3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.214443][ T5329] RAX: ffffffffffffffda RBX: 00007f1326625fa0 RCX: 00007f132639de99 [ 94.214452][ T5329] RDX: 0000000000000088 RSI: 0000000000000000 RDI: 0000000000000004 [ 94.214459][ T5329] RBP: 00007f1326433eaf R08: 0000000000000000 R09: 0000000000000000 [ 94.214467][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.214474][ T5329] R13: 00007f1326626038 R14: 00007f1326625fa0 R15: 00007fff3c9c6808 [ 94.214486][ T5329] [ 94.214491][ T5329] [ 94.359591][ T5329] The buggy address belongs to the physical page: [ 94.362271][ T5329] page: refcount:2 mapcount:0 mapping:ffff88801d02d940 index:0x2 pfn:0x4d466 [ 94.365981][ T5329] memcg:ffff8880125f7c00 [ 94.367814][ T5329] aops:def_blk_aops ino:700000 dentry name(?):"" [ 94.370177][ T5329] flags: 0x4fff58000004234(referenced|dirty|lru|workingset|private|node=1|zone=1|lastcpupid=0x7ff) [ 94.374314][ T5329] raw: 04fff58000004234 ffff888030450a80 ffff888030450a80 ffff88801d02d940 [ 94.377903][ T5329] raw: 0000000000000002 ffff8880441b0c40 00000002ffffffff ffff8880125f7c00 [ 94.381303][ T5329] page dumped because: kasan: bad access detected [ 94.384135][ T5329] page_owner tracks the page as allocated [ 94.386602][ T5329] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5329, tgid 5328 (syz.0.0), ts 94177910944, free_ts 94013290689 [ 94.394870][ T5329] post_alloc_hook+0x1f9/0x250 [ 94.397034][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 94.399535][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.402088][ T5329] alloc_pages_mpol+0x212/0x380 [ 94.404226][ T5329] alloc_pages_noprof+0xac/0x2a0 [ 94.406332][ T5329] folio_alloc_noprof+0x1e/0x30 [ 94.408301][ T5329] filemap_alloc_folio_noprof+0x111/0x470 [ 94.410583][ T5329] __filemap_get_folio_mpol+0x402/0x1000 [ 94.412898][ T5329] bdev_getblk+0x1f4/0x6e0 [ 94.414764][ T5329] __ext4_get_inode_loc+0x56c/0xf40 [ 94.416796][ T5329] ext4_reserve_inode_write+0x18b/0x360 [ 94.418944][ T5329] ext4_xattr_set_handle+0x55d/0x1540 [ 94.421093][ T5329] ext4_xattr_set+0x257/0x340 [ 94.423060][ T5329] __vfs_setxattr+0x442/0x480 [ 94.425077][ T5329] __vfs_setxattr_noperm+0x12a/0x660 [ 94.427361][ T5329] vfs_setxattr+0x163/0x360 [ 94.429298][ T5329] page last free pid 5334 tgid 5334 stack trace: [ 94.432005][ T5329] free_unref_folios+0xd84/0x14a0 [ 94.434179][ T5329] folios_put_refs+0x9e9/0xb30 [ 94.436201][ T5329] free_pages_and_swap_cache+0x41e/0x490 [ 94.438647][ T5329] tlb_flush_mmu+0x6d3/0xa30 [ 94.440740][ T5329] tlb_finish_mmu+0xf4/0x220 [ 94.442626][ T5329] exit_mmap+0x4b2/0x9f0 [ 94.444460][ T5329] __mmput+0x118/0x420 [ 94.446353][ T5329] exit_mm+0x221/0x2d0 [ 94.448119][ T5329] do_exit+0x6cd/0x2360 [ 94.449972][ T5329] do_group_exit+0x22d/0x2f0 [ 94.452005][ T5329] __x64_sys_exit_group+0x3f/0x40 [ 94.454213][ T5329] x64_sys_call+0x221a/0x2240 [ 94.456346][ T5329] do_syscall_64+0x174/0x580 [ 94.458388][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.461003][ T5329] [ 94.462090][ T5329] Memory state around the buggy address: [ 94.464482][ T5329] ffff88804d466180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.467875][ T5329] ffff88804d466200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.471412][ T5329] >ffff88804d466280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.474872][ T5329] ^ [ 94.477827][ T5329] ffff88804d466300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.481219][ T5329] ffff88804d466380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 94.484531][ T5329] ================================================================== [ 94.499213][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.502434][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.506209][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.510399][ T5329] Call Trace: [ 94.511819][ T5329] [ 94.513128][ T5329] vpanic+0x56c/0xa60 [ 94.514843][ T5329] ? __pfx_vpanic+0x10/0x10 [ 94.516866][ T5329] panic+0xc5/0xd0 [ 94.518460][ T5329] ? __pfx_panic+0x10/0x10 [ 94.520380][ T5329] ? preempt_schedule_thunk+0x16/0x40 [ 94.522705][ T5329] ? preempt_schedule_thunk+0x16/0x40 [ 94.525002][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.527274][ T5329] check_panic_on_warn+0x89/0xb0 [ 94.529405][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.531748][ T5329] end_report+0x73/0x170 [ 94.533536][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.535813][ T5329] kasan_report+0x128/0x150 [ 94.537800][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.540183][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.542564][ T5329] kasan_check_range+0x264/0x2c0 [ 94.544772][ T5329] ? ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.547156][ T5329] __asan_memmove+0x29/0x70 [ 94.549192][ T5329] ext4_xattr_set_entry+0x92b/0x1ed0 [ 94.551423][ T5329] ext4_xattr_ibody_set+0x262/0x710 [ 94.553662][ T5329] ext4_destroy_inline_data_nolock+0x23a/0x5f0 [ 94.556247][ T5329] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 94.558801][ T5329] ? ext4_read_inline_folio+0x6fe/0x860 [ 94.560972][ T5329] ? __pfx_ext4_read_inline_folio+0x10/0x10 [ 94.563311][ T5329] ? down_write+0x16d/0x200 [ 94.565060][ T5329] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.567456][ T5329] ? ext4_fc_track_inode+0x4d/0x3f0 [ 94.569759][ T5329] ? ext4_fc_track_inode+0xf3/0x3f0 [ 94.571969][ T5329] ext4_convert_inline_data_to_extent+0x549/0xde0 [ 94.574738][ T5329] ? __pfx_ext4_convert_inline_data_to_extent+0x10/0x10 [ 94.577707][ T5329] ? ext4_inode_journal_mode+0x18d/0x470 [ 94.580013][ T5329] ? ext4_chunk_trans_extent+0x201/0x2a0 [ 94.582430][ T5329] ? ext4_try_to_write_inline_data+0x49/0xa0 [ 94.584972][ T5329] ext4_write_begin+0x349/0x1850 [ 94.587230][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 94.589386][ T5329] ? __pfx_ext4_write_begin+0x10/0x10 [ 94.591626][ T5329] generic_perform_write+0x2d5/0x8f0 [ 94.593804][ T5329] ? __pfx_generic_perform_write+0x10/0x10 [ 94.595998][ T5329] ext4_buffered_write_iter+0xcb/0x370 [ 94.598094][ T5329] ext4_file_write_iter+0x947/0x1c70 [ 94.600212][ T5329] ? vfs_write+0x22b/0xba0 [ 94.601922][ T5329] ? vfs_write+0x22b/0xba0 [ 94.603571][ T5329] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 94.605767][ T5329] vfs_write+0x612/0xba0 [ 94.607479][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 94.609550][ T5329] ? __fget_files+0x2a/0x420 [ 94.611455][ T5329] ksys_write+0x150/0x270 [ 94.613273][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 94.615287][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.617678][ T5329] do_syscall_64+0x174/0x580 [ 94.619483][ T5329] ? trace_irq_disable+0x3b/0x140 [ 94.621555][ T5329] ? clear_bhb_loop+0x40/0x90 [ 94.623668][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.626150][ T5329] RIP: 0033:0x7f132639de99 [ 94.628293][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.636164][ T5329] RSP: 002b:00007f13271b3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.639642][ T5329] RAX: ffffffffffffffda RBX: 00007f1326625fa0 RCX: 00007f132639de99 [ 94.642799][ T5329] RDX: 0000000000000088 RSI: 0000000000000000 RDI: 0000000000000004 [ 94.646169][ T5329] RBP: 00007f1326433eaf R08: 0000000000000000 R09: 0000000000000000 [ 94.649489][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.652711][ T5329] R13: 00007f1326626038 R14: 00007f1326625fa0 R15: 00007fff3c9c6808 [ 94.656029][ T5329] [ 94.657781][ T5329] Kernel Offset: disabled [ 94.659534][ T5329] Rebooting in 86400 seconds..