program: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x400, &(0x7f0000000280)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x81, 0x7ac, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXt8q8EADpRNTY6vgouJCBAsFXduGyTTUTDIlMylNCLRFBDeCigtBN137o+7c+mOr/4ULaamaFisuZOROZpJJM5MmbWYmms8Hbu4599ybc75z7o8zcy8zARxYo+mfTMTRiHg3iRiuLU8ioq+a6o04vbbe/dWVXDolUam8+nNSXefe6kouGrZJHa5l/hsR37wVcSyztd7S0vLsVKGQX6jlx8tzl8ZLS8vHL85NzeRn8vMnJyYnT5x65tTJvYv11++Xj9x+76UnPz/9+5v/ufnOt0mcjiO1ssY49spojNZek770Jdzkxb2urMuSbjeAR5Iemj1rR3kcjeHoqaZaGOxkywCAdrkaERUA4IBJXP8B4ICpfw5wb3UlV5+6+4lEZ915ISIOrcVfv7+5VtJbu2d3qHofdOhesunOSBIRI3tQ/2hEfPzl65+mU7TpPiRAM9euR8T5kdGt5/9kyzMLu/XUdoWVgeps9IHFzn/QOV+l459nm43/Muvjn2gy/hlocuw+iocf/5lbe1BNS+n47/mGZ9vuN8RfM9JTy/2jOubrSy5cLOTTc9s/I2Is+gbS/ER11eZPQY3d/eNuq/obx3+/vP/GJ2n96Xxjjcyt3oHN20xPlaceN+66O9cj/tfbLP5kvf+TFuPfszus4+Xn3v6oVVkafxpvfdoaf3tVbkQ80bT/N/oy2fb5xPHq7jBe3yma+OKHD4da1b/R/wPVeVp//b1AJ6T9P7R9/CNJ4/Oapd3X8d2N4a9blTXu/83jb77/9yevVdP9tWVXpsrlhYmI/uSVrctPbGxbz9fXT+Mf+3/z47/V/p+pPRt7fj23vd7bP31W+1dN46+61ir+9krjn95V/2+TqNS2eaDo5v3Znlb176z/J6upsdqSnZz/HtLSx9ibAQAAAAAAAAAAAAAAAAAAAAAAAGD3MhFxJJJMdj2dyWSza7/h/e8YyhSKpfKxC8XF+emo/lb2SPRl6l91OdzwfagTte/Dr+dPPJB/OiL+FREfDAxW89lcsTDd7eABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoObw5t//v5rOstm1sh8Hut06AKBtDnW7AQBAx7n+A8DBs7vr/2Db2gEAdM6u3/9XkvY0BADomB1f/8+3tx0AQOe4/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECbnT1zJp0qv62u5NL89OWlxdni5ePT+dJsdm4xl80VFy5lZ4rFmUI+myvOtfxH19ZmhWLx0mTML14ZL+dL5fHS0vK5ueLifPncxbmpmfy5fF/HIgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnSstLc9OFQr5hUdODD/e5n+RxOD+aMa+SfTGvmjG3z7R37XaG88Sg907QQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADsc38GAAD//zdpJOY=") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) r4 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x6042, 0x106) sendfile(r5, r4, 0x0, 0x80000002) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)={0x30, 0x30, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) r7 = socket$inet6(0xa, 0x1, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f0000000140)=[0x0], &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x1, 0x1}) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000200)='./file1\x00', 0x0, &(0x7f0000000240)=ANY=[], 0x1, 0x1a4, &(0x7f0000000440)="$eJzs0L9rE2Ecx/H397knPypUjYpDBRuwGC9Uk7uqg1NwipADBxfBoCGNTTFR08tgSwtdpCDVDv4DOtVRBZ1EFJyLg+Cg59JNmqE4iINE7vJU8G/weQ33ue8H7p6HbzvshRng9+5ykwoJh/18RNDApIw6pUb52szfTW6MgotmXjf5zOREuLh0q9HptBbyF/Lk/imAH0n3twpfcFQxECrI593lZkNuBAwrdNVsQK5G8SFOnZ77iAk9zpHrOAwL61xS9KRQgwOlfvduKVxcOj3fbcy15lq3fX/mfPlsuXzOL92c77TKrxD3gSiesIIbkAkYc1dI1bm/pfcxLYjbVpEjxQHpOhtbzqkT0wOUu8MQ4V1hQOarbufVFU6SvRZfvsph4SlOwFSNMYUmOaiKXFYvxdOf9M+UIrvqOGeadzqza1eV/EpvVmQnK942qYKHX/SYiVfDId6zFjEVUY3YjNj+xqS8iU/Z26tejZ/PzXSM45DmXqPfX/DS8EF08Pgg4OdgPPmdSu6Vg7fmGxN82XuxLMuyLMuyLMuy/gN/AgAA//96xWPy") listxattr(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000300)=""/195, 0xc3) newfstatat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1\x00', &(0x7f0000001000), 0x1000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r8, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000280)=[r9, r10], 0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_SETCRTC(r11, 0xc06864a2, &(0x7f0000000340)={0x0, 0x0, r9, 0x0, 0x0, 0x0, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, "b1eddb851ba62b00d8730000000000000000000800"}}) close_range(r7, 0xffffffffffffffff, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) [ 77.591657][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 77.594571][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.770177][ T5285] Bluetooth: hci0: command tx timeout [ 77.793598][ T5325] loop0: detected capacity change from 0 to 2048 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xaa000) [ 77.921245][ T5325] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.951448][ T1029] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 77.961816][ T1029] ata1: failed to read log page 10h (errno=-5) [ 77.969282][ T1029] ata1.00: exception Emask 0x1 SAct 0x40000001 SErr 0x0 action 0x0 [ 77.982260][ T1029] ata1.00: irq_stat 0x41000000 [ 77.989183][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 77.994995][ T1029] ata1.00: cmd 61/e0:00:76:18:08/02:00:00:00:00/40 tag 0 ncq dma 376832 out [ 77.994995][ T1029] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 78.004491][ T5325] loop0: detected capacity change from 2048 to 64 [ 78.013863][ T1029] ata1.00: status: { DRDY } [ 78.024229][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 78.039262][ T1029] ata1.00: cmd 61/50:f0:26:13:08/05:00:00:00:00/40 tag 30 ncq dma 696320 out [ 78.039262][ T1029] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 78.059773][ T5325] EXT4-fs error (device loop0): xattr_find_entry:337: inode #15: comm syz.0.0: corrupted xattr entries [ 78.073939][ T1029] ata1.00: status: { DRDY } [ 78.085656][ T1029] ata1.00: configured for UDMA/100 [ 78.089319][ T5325] EXT4-fs error (device loop0): get_max_inline_xattr_value_size:74: inode #15: comm syz.0.0: corrupt xattr in inline inode [ 78.096999][ T1029] ata1: EH complete [ 78.099779][ T5331] EXT4-fs error (device loop0): ext4_validate_block_bitmap:432: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 78.157547][ T5325] ================================================================== [ 78.161102][ T5325] BUG: KASAN: slab-use-after-free in ext4_xattr_list_entries+0x302/0x3d0 [ 78.164662][ T5325] Read of size 4 at addr ffff888044179014 by task syz.0.0/5325 [ 78.167753][ T5325] [ 78.168785][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 78.168795][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.168801][ T5325] Call Trace: [ 78.168807][ T5325] [ 78.168811][ T5325] dump_stack_lvl+0xe8/0x150 [ 78.168826][ T5325] print_address_description+0x55/0x1e0 [ 78.168838][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.168848][ T5325] print_report+0x58/0x70 [ 78.168857][ T5325] kasan_report+0x117/0x150 [ 78.168871][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.168885][ T5325] ext4_xattr_list_entries+0x302/0x3d0 [ 78.168897][ T5325] ? ext4_get_inode_loc+0xc5/0xf0 [ 78.168909][ T5325] ext4_listxattr+0x229/0x680 [ 78.168921][ T5325] ? listxattr+0xb9/0x380 [ 78.168936][ T5325] ? __pfx_ext4_listxattr+0x10/0x10 [ 78.168948][ T5325] ? __kvmalloc_node_noprof+0x35c/0x860 [ 78.168961][ T5325] ? listxattr+0xb9/0x380 [ 78.168976][ T5325] ? __pfx_ext4_listxattr+0x10/0x10 [ 78.168986][ T5325] listxattr+0x19d/0x380 [ 78.169000][ T5325] ? __pfx_listxattr+0x10/0x10 [ 78.169015][ T5325] ? strncpy_from_user+0x150/0x2c0 [ 78.169078][ T5325] path_listxattrat+0x1a3/0x3f0 [ 78.169095][ T5325] ? __pfx_path_listxattrat+0x10/0x10 [ 78.169113][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.169125][ T5325] do_syscall_64+0x174/0x580 [ 78.169175][ T5325] ? trace_irq_disable+0x3b/0x140 [ 78.169191][ T5325] ? clear_bhb_loop+0x40/0x90 [ 78.169204][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.169215][ T5325] RIP: 0033:0x7fb23b19de99 [ 78.169226][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.169232][ T5325] RSP: 002b:00007fb23c132fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 78.169241][ T5325] RAX: ffffffffffffffda RBX: 00007fb23b425fa0 RCX: 00007fb23b19de99 [ 78.169246][ T5325] RDX: 00000000000000c3 RSI: 0000200000000300 RDI: 00002000000000c0 [ 78.169250][ T5325] RBP: 00007fb23b233eaf R08: 0000000000000000 R09: 0000000000000000 [ 78.169254][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.169258][ T5325] R13: 00007fb23b426038 R14: 00007fb23b425fa0 R15: 00007ffd474f58b8 [ 78.169266][ T5325] [ 78.169268][ T5325] [ 78.261655][ T5325] Allocated by task 5284: [ 78.263542][ T5325] kasan_save_track+0x3e/0x80 [ 78.265566][ T5325] __kasan_slab_alloc+0x6c/0x80 [ 78.267587][ T5325] kmem_cache_alloc_node_noprof+0x355/0x610 [ 78.269998][ T5325] __alloc_skb+0x1d7/0x7a0 [ 78.272039][ T5325] skb_copy+0x19d/0x870 [ 78.273693][ T5325] mac80211_hwsim_tx_frame_no_nl+0xfab/0x1760 [ 78.276252][ T5325] mac80211_hwsim_tx_frame+0x199/0x1f0 [ 78.278554][ T5325] mac80211_hwsim_beacon_tx+0x396/0x820 [ 78.280827][ T5325] __iterate_interfaces+0x2af/0x5a0 [ 78.283093][ T5325] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 78.286092][ T5325] mac80211_hwsim_beacon+0xaf/0x240 [ 78.288298][ T5325] __hrtimer_run_queues+0x3bc/0xa10 [ 78.290486][ T5325] hrtimer_run_softirq+0x17a/0x240 [ 78.292665][ T5325] handle_softirqs+0x225/0x840 [ 78.294735][ T5325] __irq_exit_rcu+0xca/0x220 [ 78.296657][ T5325] irq_exit_rcu+0x9/0x30 [ 78.298491][ T5325] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 78.300912][ T5325] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.303469][ T5325] [ 78.304681][ T5325] Freed by task 12: [ 78.306337][ T5325] kasan_save_track+0x3e/0x80 [ 78.308326][ T5325] kasan_save_free_info+0x40/0x50 [ 78.310448][ T5325] __kasan_slab_free+0x5c/0x80 [ 78.312384][ T5325] kmem_cache_free+0x182/0x650 [ 78.314435][ T5325] ieee80211_iface_work+0x259/0x1010 [ 78.316709][ T5325] cfg80211_wiphy_work+0x29e/0x420 [ 78.319101][ T5325] process_scheduled_works+0xa8e/0x14e0 [ 78.321500][ T5325] worker_thread+0xa47/0xfb0 [ 78.323488][ T5325] kthread+0x388/0x470 [ 78.325208][ T5325] ret_from_fork+0x514/0xb70 [ 78.327126][ T5325] ret_from_fork_asm+0x1a/0x30 [ 78.329094][ T5325] [ 78.330097][ T5325] The buggy address belongs to the object at ffff888044179000 [ 78.330097][ T5325] which belongs to the cache skbuff_head_cache of size 240 [ 78.335916][ T5325] The buggy address is located 20 bytes inside of [ 78.335916][ T5325] freed 240-byte region [ffff888044179000, ffff8880441790f0) [ 78.341344][ T5325] [ 78.342273][ T5325] The buggy address belongs to the physical page: [ 78.344817][ T5325] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x44179 [ 78.348296][ T5325] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 78.351058][ T5325] page_type: f5(slab) [ 78.352673][ T5325] raw: 04fff00000000000 ffff88801c38b780 dead000000000122 0000000000000000 [ 78.355851][ T5325] raw: 0000000000000000 00000008000c000c 00000000f5000000 0000000000000000 [ 78.359094][ T5325] page dumped because: kasan: bad access detected [ 78.361753][ T5325] page_owner tracks the page as allocated [ 78.364145][ T5325] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u4:0), ts 75889642742, free_ts 74567616253 [ 78.372251][ T5325] post_alloc_hook+0x1f9/0x250 [ 78.374212][ T5325] get_page_from_freelist+0x21fa/0x2270 [ 78.376661][ T5325] __alloc_frozen_pages_noprof+0x18d/0x380 [ 78.379143][ T5325] allocate_slab+0x79/0x5e0 [ 78.381063][ T5325] refill_objects+0x2d5/0x350 [ 78.383091][ T5325] __pcs_replace_empty_main+0x2bf/0x6b0 [ 78.385368][ T5325] kmem_cache_alloc_node_noprof+0x42f/0x610 [ 78.387840][ T5325] __alloc_skb+0x1d7/0x7a0 [ 78.389658][ T5325] nsim_dev_trap_report_work+0x25f/0xb40 [ 78.391994][ T5325] process_scheduled_works+0xa8e/0x14e0 [ 78.394321][ T5325] worker_thread+0xa47/0xfb0 [ 78.396261][ T5325] kthread+0x388/0x470 [ 78.397948][ T5325] ret_from_fork+0x514/0xb70 [ 78.399841][ T5325] ret_from_fork_asm+0x1a/0x30 [ 78.401866][ T5325] page last free pid 5282 tgid 5282 stack trace: [ 78.404590][ T5325] __free_frozen_pages+0xc1e/0xd10 [ 78.406893][ T5325] __slab_free+0x274/0x2c0 [ 78.408772][ T5325] qlist_free_all+0x99/0x100 [ 78.410745][ T5325] kasan_quarantine_reduce+0x148/0x160 [ 78.413038][ T5325] __kasan_slab_alloc+0x22/0x80 [ 78.415151][ T5325] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 78.417429][ T5325] do_getname+0x2e/0x250 [ 78.419240][ T5325] __se_sys_unlink+0x1e/0x140 [ 78.421252][ T5325] do_syscall_64+0x174/0x580 [ 78.423257][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.425789][ T5325] [ 78.426847][ T5325] Memory state around the buggy address: [ 78.429235][ T5325] ffff888044178f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 78.432596][ T5325] ffff888044178f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 78.435900][ T5325] >ffff888044179000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.439159][ T5325] ^ [ 78.441016][ T5325] ffff888044179080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 78.443966][ T5325] ffff888044179100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 78.447050][ T5325] ================================================================== [ 78.572252][ T5325] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 78.575428][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 78.579041][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.583053][ T5325] Call Trace: [ 78.584361][ T5325] [ 78.585710][ T5325] vpanic+0x56c/0xa60 [ 78.587447][ T5325] ? __pfx_vpanic+0x10/0x10 [ 78.589376][ T5325] panic+0xc5/0xd0 [ 78.591006][ T5325] ? __pfx_panic+0x10/0x10 [ 78.592962][ T5325] ? preempt_schedule_thunk+0x16/0x40 [ 78.595277][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.597594][ T5325] ? preempt_schedule_thunk+0x16/0x40 [ 78.599793][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.602095][ T5325] check_panic_on_warn+0x89/0xb0 [ 78.604173][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.606465][ T5325] end_report+0x73/0x170 [ 78.608280][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.610611][ T5325] kasan_report+0x128/0x150 [ 78.612558][ T5325] ? ext4_xattr_list_entries+0x302/0x3d0 [ 78.614798][ T5325] ext4_xattr_list_entries+0x302/0x3d0 [ 78.616958][ T5325] ? ext4_get_inode_loc+0xc5/0xf0 [ 78.619048][ T5325] ext4_listxattr+0x229/0x680 [ 78.621055][ T5325] ? listxattr+0xb9/0x380 [ 78.622912][ T5325] ? __pfx_ext4_listxattr+0x10/0x10 [ 78.625125][ T5325] ? __kvmalloc_node_noprof+0x35c/0x860 [ 78.627291][ T5325] ? listxattr+0xb9/0x380 [ 78.628947][ T5325] ? __pfx_ext4_listxattr+0x10/0x10 [ 78.631116][ T5325] listxattr+0x19d/0x380 [ 78.633031][ T5325] ? __pfx_listxattr+0x10/0x10 [ 78.635564][ T5325] ? strncpy_from_user+0x150/0x2c0 [ 78.637728][ T5325] path_listxattrat+0x1a3/0x3f0 [ 78.639819][ T5325] ? __pfx_path_listxattrat+0x10/0x10 [ 78.642202][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.645284][ T5325] do_syscall_64+0x174/0x580 [ 78.647836][ T5325] ? trace_irq_disable+0x3b/0x140 [ 78.650511][ T5325] ? clear_bhb_loop+0x40/0x90 [ 78.653002][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.656208][ T5325] RIP: 0033:0x7fb23b19de99 [ 78.658624][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.666580][ T5325] RSP: 002b:00007fb23c132fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 78.669973][ T5325] RAX: ffffffffffffffda RBX: 00007fb23b425fa0 RCX: 00007fb23b19de99 [ 78.673026][ T5325] RDX: 00000000000000c3 RSI: 0000200000000300 RDI: 00002000000000c0 [ 78.676159][ T5325] RBP: 00007fb23b233eaf R08: 0000000000000000 R09: 0000000000000000 [ 78.679304][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.682419][ T5325] R13: 00007fb23b426038 R14: 00007fb23b425fa0 R15: 00007ffd474f58b8 [ 78.685649][ T5325] [ 78.687299][ T5325] Kernel Offset: disabled [ 78.689108][ T5325] Rebooting in 86400 seconds..