program: perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xac, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x9, 0xd, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x1) syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000340)={[{@nodioread_nolock}]}, 0x1, 0x453, &(0x7f0000001040)="$eJzs3U9sFFUcB/DvbrslAbRg/IP4r4JKEaW2NUESTCTKSS4GE88NLYRYqKE1EUKMJh68eTHx7EG5eeTgyXjAoyZ48aaejJEYIvGk1sx2ly5lt3RD26nu55PM7pud132/mdffzO7ryzRAzxoqHirJ1iTfJxlcWL25wtDC0/VrF47/ee3C8Urm54/9XqnX++PahePNqs2f21I8VJPhalL9oJKH2rQ7e+78mxPT01NnG+sjc6ffGpk9d/7ZU6cnTk6dnDozeuDgC+OjB8bGx1dtX1+9+O6xLa+9dOSjySu/zVz86csi3q2Nba37sVqGMnTzsWzx1Go3VrL7WsqV/hIDoSt9SYruqtXzfzB9Wey8wXzzY6nBAWtqvrCp4+b35oH/sUrKjgAoR/NCX3z/bS7r9dmD8l09vPAFsOj3641lYUt/qo06tSXf71fTUJJDl458USxZo3EYAAAAgF721eEkz7Qb/6vm/pZ6RfmBJDuSPJhkZ1Kf1/NwkkeSPJrkseZ8oi4srb90/KfSaQINq+Lq4eRQY27XzeN/zdG/bOtrrN1VrKRWOXFqeuq5JHcnGU5tU7E+ukwbl7/957tO21rH/4qlaL85FtiI49f+JX+fnpyYm7iTfWbR1feTnf3t+r9yYyZQkYKPJ9nVzRvXFos/79p7slO12/c/a2n+02RP2/xvnHivHKw/LTM/c6R+PhhpnhVu9eHo2Cud2tf/5Sryf/Ny/Z9sq7TO153tvo3LOy692Glb9+f/Hz4rzv8DldfrAQ40Xn1nYm7u7GgyUDl66+tj3cf839b5Q1PzeDSPV9H/w7vbX//vaXm33UmeSPJkY+7ynvq1P9mb5Okk+5aJ5u+XD7zRaZv8L1fR/5Nt8//G1IAl+d994dD2T452an9l+f98/Rd6uPGKz3+3t9IOKjtOAAAAAAAAAFZHtX4PvEp1/41ytbp//8I9/O7N5ur0zOzcvhMzb5+ZXLhX3rbUqs2ZXoMt80FH6+XF9bEl6+NJtif5uO+vxp0HZqYny9556HFbOuR/4Ze+sqMD1pz7tULvWkH+19YjDmD9uf5D75L/0LvkP/Qu+Q+9S/5D75L/0LtWnv8DaxoHsP5c/6En3cl9/TZaoT8bIoy2heb8qZLCaP5L/g1yNDZm4fOvk3Voqy/JRtnlZQplnpUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANo5/AwAA//9EA9s8") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x46, &(0x7f0000000040)={[{@grpid}, {@jqfmt_vfsv0}, {@auto_da_alloc_val}]}, 0x1, 0x746, &(0x7f0000000f40)="$eJzs3c9rHGUfAPDvbJOmb9vXpODBimCgBwulG5vWUkGkogcpVop689Bud7ehZLdbspvShIpWFMGTSPHsj5M3/wFRBL15FDx7kkKRUi+CsDLb2bjt7jabNJtV9/OBCc8zM5tnvjszz/Mkz8NMAGNrNv2Ri9gfER8lEdPZ+iQiJlupiYiTd/e7c/taMV2SaDZf/y1p7ZPmo+MzqT1Z5rGI+O79iEO57nLrK6uLhUqlvJTl5xrVy3P1ldXDF6uFhfJC+dL88WePzp+Yf+bE/JbF+sd7r54/9dVLX9x498dfXnvr1JNJnIy92bbOOLbKbMxm38lk+hXe48WtLmzEklEfAJuS3po77t7lsT+mY0crBQD8l70dEU0AYMwk2n8AGDPt/wO0x/aGMQ72T3brhYjY1Sv+iWzMbldrHHT3neSekZEkIma2oPzZiLj65gdfp0sMaRwSoJd3rkfEuZnZ7vov6ZqzsFFPD7DP7H159R9sn2/T/s+JXv2f3Fr/J3r0f6Z63Lubsf79n7u5BcX0lfb/nuvZ/12btDazI8v9v9Xnm0wuXKyU07rtkYg4GJNTaf7IA8o49vHzP/Tb1tn/S5e0/HZfMDuOmxNT936mVGgUHibmTreuRzw+0Sv+ZO38J336v2cGLKPx/ROf99u2fvzD1fws4qme5//vGW1Jx/zEqeianzjXuh7m2ldFt/yH0/v6lT/q+NPzv/vB8c8knfM16xsv46dP/ny537bNXv87kzda6Z3ZuquFRmPpSMTO5JXu9R1TSNv59v5p/AcPPLj+63X9p38Tnhsw/sVPvzy/+fiHK42/tKHzv/HEgZ+/6R1PM5ttvO75P9ZKHczWDFL/DXqAD/PdAQAAAAAAAAAAAAAAAAAAAAAAAMCgchGxN5Jcfi2dy+Xzd9/h/WjszlVq9cahC7XlS6VovSt7JiZz7SddTnc8D/VI9jz8dn7+vvzRiNgXETem/tfK54u1SmnUwQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZk+f9/+nfp0a9dEBAEOza9QHAABsO+0/AIwf7T8AjB/tPwCMH+0/AIwf7T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDdub06XRp/n77WjHNl66sLC/WrhwuleuL+epyMV+sLV3OL9RqC5Vyvlirrvf7KrXa5fnjsXx1rlGuN+bqK6tnq7XlS42zF6uFhfLZ8uS2RAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG1NfWV0sVCrlJQkJCYm1xKhrJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB/h78CAAD//6LRHug=") r1 = creat(&(0x7f0000000080)='./file1\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) open(&(0x7f0000000180)='./bus\x00', 0x14937e, 0x111) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0x1c, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x7f000, 0x4000}]) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14937e, 0x111) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r5 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="cf0400000000000000001200000008000300", @ANYRES32=r9, @ANYBLOB="0500c200030000000a00065500077eb57e66e2f74f563b7702f128a8e6eb387109329ca4883f2df3c8bc435426bbbeff6210d131cdf6db9c8ea7"], 0x38}}, 0x0) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2, 0x8005, 0x0, 0x0, 0x15, 0x0, "ef359f413bb93852f7d6a4ae6dddfbd1000000000000000edf1139c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a00400", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000380), 0x1040c) close(r0) setrlimit(0x2, &(0x7f00000000c0)={0x3, 0x1}) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000002000000000020000000009500b7407b93"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x47, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00'}) bind(r10, &(0x7f0000000640)=@pppoe={0x18, 0x0, {0x2, @broadcast, 'syz_tun\x00'}}, 0x80) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f00000700000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000010000000001000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) [ 85.729383][ T4701] Bluetooth: hci0: command tx timeout [ 85.822078][ T5363] loop0: detected capacity change from 0 to 512 [ 85.855540][ T5363] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.918547][ T5363] loop0: detected capacity change from 512 to 64 [ 85.957554][ T5363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 85.999901][ T5362] ================================================================== [ 86.003368][ T5362] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.006705][ T5362] Read of size 18446744073709551600 at addr ffff88804077d0b8 by task syz.0.0/5362 [ 86.010617][ T5362] [ 86.011867][ T5362] CPU: 0 UID: 0 PID: 5362 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.011880][ T5362] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.011887][ T5362] Call Trace: [ 86.011895][ T5362] [ 86.011900][ T5362] dump_stack_lvl+0x189/0x250 [ 86.011917][ T5362] ? __virt_addr_valid+0x1c8/0x5c0 [ 86.011931][ T5362] ? rcu_is_watching+0x15/0xb0 [ 86.011941][ T5362] ? __kasan_check_byte+0x12/0x40 [ 86.011954][ T5362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.011966][ T5362] ? rcu_is_watching+0x15/0xb0 [ 86.011975][ T5362] ? lock_release+0x4b/0x3e0 [ 86.011990][ T5362] ? __virt_addr_valid+0x1c8/0x5c0 [ 86.012002][ T5362] ? __virt_addr_valid+0x4a5/0x5c0 [ 86.012016][ T5362] print_report+0xca/0x240 [ 86.012026][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.012040][ T5362] kasan_report+0x118/0x150 [ 86.012053][ T5362] ? bdev_getblk+0x80/0x660 [ 86.012069][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.012083][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.012096][ T5362] kasan_check_range+0x2b0/0x2c0 [ 86.012110][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.012124][ T5362] __asan_memmove+0x29/0x70 [ 86.012135][ T5362] ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.012153][ T5362] ext4_xattr_ibody_set+0x254/0x6a0 [ 86.012167][ T5362] ext4_destroy_inline_data_nolock+0x214/0x5b0 [ 86.012179][ T5362] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 86.012189][ T5362] ? down_write+0x162/0x1f0 [ 86.012253][ T5362] ? ext4_journal_check_start+0x1cf/0x2b0 [ 86.012269][ T5362] ext4_destroy_inline_data+0x83/0xe0 [ 86.012280][ T5362] ext4_do_writepages+0x526/0x4610 [ 86.012292][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.012309][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.012327][ T5362] ? is_bpf_text_address+0x26/0x2b0 [ 86.012345][ T5362] ? __pfx_ext4_do_writepages+0x10/0x10 [ 86.012358][ T5362] ? look_up_lock_class+0x74/0x170 [ 86.012369][ T5362] ? register_lock_class+0x51/0x320 [ 86.012384][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.012400][ T5362] ? rcu_read_lock_any_held+0xb3/0x120 [ 86.012416][ T5362] ext4_writepages+0x205/0x350 [ 86.012431][ T5362] ? arch_stack_walk+0xfc/0x150 [ 86.012456][ T5362] ? __pfx_ext4_writepages+0x10/0x10 [ 86.012473][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.012489][ T5362] ? __pfx_ext4_writepages+0x10/0x10 [ 86.012505][ T5362] do_writepages+0x32e/0x550 [ 86.012522][ T5362] ? do_raw_spin_unlock+0x4d/0x240 [ 86.012535][ T5362] filemap_flush+0x191/0x230 [ 86.012548][ T5362] ? __pfx_filemap_flush+0x10/0x10 [ 86.012569][ T5362] ? __pfx___might_resched+0x10/0x10 [ 86.012580][ T5362] ? rcu_is_watching+0x15/0xb0 [ 86.012592][ T5362] ext4_release_file+0x82/0x310 [ 86.012604][ T5362] ? __pfx_ext4_release_file+0x10/0x10 [ 86.012616][ T5362] __fput+0x44c/0xa70 [ 86.012629][ T5362] task_work_run+0x1d4/0x260 [ 86.012645][ T5362] ? __pfx_task_work_run+0x10/0x10 [ 86.012660][ T5362] ? exit_to_user_mode_loop+0x40/0x110 [ 86.012676][ T5362] exit_to_user_mode_loop+0xec/0x110 [ 86.012690][ T5362] do_syscall_64+0x2bd/0x3b0 [ 86.012703][ T5362] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.012713][ T5362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.012723][ T5362] ? clear_bhb_loop+0x60/0xb0 [ 86.012735][ T5362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.012745][ T5362] RIP: 0033:0x7f55c218eec9 [ 86.012758][ T5362] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.012767][ T5362] RSP: 002b:00007fffe7196468 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 86.012779][ T5362] RAX: 0000000000000000 RBX: 0000000000014e6e RCX: 00007f55c218eec9 [ 86.012785][ T5362] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 86.012791][ T5362] RBP: 00007f55c23e7da0 R08: 0000000000000001 R09: 0000001ee719675f [ 86.012797][ T5362] R10: 00007f55c1fff02c R11: 0000000000000246 R12: 00007f55c23e5fac [ 86.012803][ T5362] R13: 00007f55c23e5fa0 R14: ffffffffffffffff R15: 00007fffe7196580 [ 86.012815][ T5362] [ 86.012819][ T5362] [ 86.180012][ T5362] The buggy address belongs to the physical page: [ 86.182634][ T5362] page: refcount:2 mapcount:0 mapping:ffff88803218cd80 index:0x3 pfn:0x4077d [ 86.185954][ T5362] memcg:ffff88801c6a8000 [ 86.187638][ T5362] aops:def_blk_aops ino:700000 dentry name(?):"" [ 86.190063][ T5362] flags: 0x4fff58000004a3c(referenced|uptodate|dirty|lru|workingset|owner_2|private|node=1|zone=1|lastcpupid=0x7ff) [ 86.194839][ T5362] raw: 04fff58000004a3c ffffea00010c0c48 ffff888030ad0240 ffff88803218cd80 [ 86.198326][ T5362] raw: 0000000000000003 ffff888043bd20e8 00000002ffffffff ffff88801c6a8000 [ 86.201926][ T5362] page dumped because: kasan: bad access detected [ 86.204611][ T5362] page_owner tracks the page as allocated [ 86.207089][ T5362] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5333, tgid 5333 (udevd), ts 85982188085, free_ts 85977686685 [ 86.215267][ T5362] post_alloc_hook+0x240/0x2a0 [ 86.217242][ T5362] get_page_from_freelist+0x21e4/0x22c0 [ 86.219563][ T5362] __alloc_frozen_pages_noprof+0x181/0x370 [ 86.222032][ T5362] alloc_pages_mpol+0x232/0x4a0 [ 86.224030][ T5362] alloc_pages_noprof+0xa9/0x190 [ 86.226095][ T5362] folio_alloc_noprof+0x1e/0x30 [ 86.228127][ T5362] filemap_alloc_folio_noprof+0xdf/0x470 [ 86.230444][ T5362] page_cache_ra_unbounded+0x2b9/0x7b0 [ 86.232709][ T5362] page_cache_sync_ra+0x3b9/0xb10 [ 86.234751][ T5362] filemap_get_pages+0x43c/0x1ea0 [ 86.236955][ T5362] filemap_read+0x3f6/0x11a0 [ 86.238919][ T5362] blkdev_read_iter+0x30a/0x440 [ 86.240914][ T5362] vfs_read+0x557/0xa30 [ 86.242711][ T5362] ksys_read+0x145/0x250 [ 86.244558][ T5362] do_syscall_64+0xfa/0x3b0 [ 86.246460][ T5362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.248974][ T5362] page last free pid 15 tgid 15 stack trace: [ 86.251603][ T5362] __free_frozen_pages+0xbc4/0xd30 [ 86.253856][ T5362] rcu_core+0xca8/0x1770 [ 86.255726][ T5362] handle_softirqs+0x286/0x870 [ 86.257730][ T5362] run_ksoftirqd+0x9b/0x100 [ 86.259712][ T5362] smpboot_thread_fn+0x542/0xa60 [ 86.261957][ T5362] kthread+0x711/0x8a0 [ 86.263828][ T5362] ret_from_fork+0x439/0x7d0 [ 86.266069][ T5362] ret_from_fork_asm+0x1a/0x30 [ 86.267952][ T5362] [ 86.269043][ T5362] Memory state around the buggy address: [ 86.271476][ T5362] ffff88804077cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.274751][ T5362] ffff88804077d000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.278262][ T5362] >ffff88804077d080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.281920][ T5362] ^ [ 86.284485][ T5362] ffff88804077d100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.287940][ T5362] ffff88804077d180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.291403][ T5362] ================================================================== [ 86.310458][ T5362] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.313544][ T5362] CPU: 0 UID: 0 PID: 5362 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.317396][ T5362] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.321800][ T5362] Call Trace: [ 86.323247][ T5362] [ 86.324510][ T5362] dump_stack_lvl+0x99/0x250 [ 86.326403][ T5362] ? __asan_memcpy+0x40/0x70 [ 86.328380][ T5362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.330572][ T5362] ? __pfx__printk+0x10/0x10 [ 86.332669][ T5362] vpanic+0x281/0x750 [ 86.334441][ T5362] ? __pfx_print_hex_dump+0x10/0x10 [ 86.336475][ T5362] ? __pfx_vpanic+0x10/0x10 [ 86.338473][ T5362] ? preempt_schedule_common+0x83/0xd0 [ 86.340746][ T5362] ? preempt_schedule+0xae/0xc0 [ 86.342898][ T5362] panic+0xb9/0xc0 [ 86.344329][ T5362] ? __pfx_panic+0x10/0x10 [ 86.346264][ T5362] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 86.348855][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.351115][ T5362] check_panic_on_warn+0x89/0xb0 [ 86.353370][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.355934][ T5362] end_report+0x78/0x160 [ 86.357755][ T5362] kasan_report+0x129/0x150 [ 86.359719][ T5362] ? bdev_getblk+0x80/0x660 [ 86.361606][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.364141][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.366576][ T5362] kasan_check_range+0x2b0/0x2c0 [ 86.368760][ T5362] ? ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.371016][ T5362] __asan_memmove+0x29/0x70 [ 86.372991][ T5362] ext4_xattr_set_entry+0x9c1/0x1e20 [ 86.375192][ T5362] ext4_xattr_ibody_set+0x254/0x6a0 [ 86.377393][ T5362] ext4_destroy_inline_data_nolock+0x214/0x5b0 [ 86.379971][ T5362] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10 [ 86.382636][ T5362] ? down_write+0x162/0x1f0 [ 86.384488][ T5362] ? ext4_journal_check_start+0x1cf/0x2b0 [ 86.386714][ T5362] ext4_destroy_inline_data+0x83/0xe0 [ 86.389025][ T5362] ext4_do_writepages+0x526/0x4610 [ 86.391375][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.393612][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.395740][ T5362] ? is_bpf_text_address+0x26/0x2b0 [ 86.397862][ T5362] ? __pfx_ext4_do_writepages+0x10/0x10 [ 86.400346][ T5362] ? look_up_lock_class+0x74/0x170 [ 86.402596][ T5362] ? register_lock_class+0x51/0x320 [ 86.404781][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.406884][ T5362] ? rcu_read_lock_any_held+0xb3/0x120 [ 86.409306][ T5362] ext4_writepages+0x205/0x350 [ 86.411362][ T5362] ? arch_stack_walk+0xfc/0x150 [ 86.413574][ T5362] ? __pfx_ext4_writepages+0x10/0x10 [ 86.415859][ T5362] ? __lock_acquire+0xab9/0xd20 [ 86.417980][ T5362] ? __pfx_ext4_writepages+0x10/0x10 [ 86.420244][ T5362] do_writepages+0x32e/0x550 [ 86.422205][ T5362] ? do_raw_spin_unlock+0x4d/0x240 [ 86.424456][ T5362] filemap_flush+0x191/0x230 [ 86.426407][ T5362] ? __pfx_filemap_flush+0x10/0x10 [ 86.428573][ T5362] ? __pfx___might_resched+0x10/0x10 [ 86.430777][ T5362] ? rcu_is_watching+0x15/0xb0 [ 86.432641][ T5362] ext4_release_file+0x82/0x310 [ 86.434848][ T5362] ? __pfx_ext4_release_file+0x10/0x10 [ 86.437678][ T5362] __fput+0x44c/0xa70 [ 86.439460][ T5362] task_work_run+0x1d4/0x260 [ 86.441309][ T5362] ? __pfx_task_work_run+0x10/0x10 [ 86.443441][ T5362] ? exit_to_user_mode_loop+0x40/0x110 [ 86.445790][ T5362] exit_to_user_mode_loop+0xec/0x110 [ 86.448112][ T5362] do_syscall_64+0x2bd/0x3b0 [ 86.449879][ T5362] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.452098][ T5362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.454745][ T5362] ? clear_bhb_loop+0x60/0xb0 [ 86.456795][ T5362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.459461][ T5362] RIP: 0033:0x7f55c218eec9 [ 86.461363][ T5362] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.469507][ T5362] RSP: 002b:00007fffe7196468 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 86.473139][ T5362] RAX: 0000000000000000 RBX: 0000000000014e6e RCX: 00007f55c218eec9 [ 86.476585][ T5362] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 86.480082][ T5362] RBP: 00007f55c23e7da0 R08: 0000000000000001 R09: 0000001ee719675f [ 86.483595][ T5362] R10: 00007f55c1fff02c R11: 0000000000000246 R12: 00007f55c23e5fac [ 86.487023][ T5362] R13: 00007f55c23e5fa0 R14: ffffffffffffffff R15: 00007fffe7196580 [ 86.490509][ T5362] [ 86.492255][ T5362] Kernel Offset: disabled [ 86.493994][ T5362] Rebooting in 86400 seconds..