program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000340)={[{@nogrpid}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_continue}, {@nombcache}, {@quota}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV")
lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0)
creat(&(0x7f0000000140)='./file2\x00', 0x1ad)
unlink(&(0x7f0000000180)='./file1\x00')
[ 85.843765][ T5313] Bluetooth: hci0: command tx timeout
[ 85.914667][ T5340] loop0: detected capacity change from 0 to 512
[ 85.938049][ T5340] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[ 85.962717][ T5340] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 85.977038][ T5340] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck.
[ 85.986519][ T5340] EXT4-fs (loop0): 1 truncate cleaned up
[ 85.990722][ T5340] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 86.014993][ T5340] ==================================================================
[ 86.018701][ T5340] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.022294][ T5340] Read of size 18446744073709551572 at addr ffff888046287850 by task syz.0.0/5340
[ 86.026483][ T5340]
[ 86.027615][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted 6.16.0-syzkaller-09014-gd6084bb815c4 #0 PREEMPT(full)
[ 86.027633][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.027641][ T5340] Call Trace:
[ 86.027648][ T5340]
[ 86.027655][ T5340] dump_stack_lvl+0x189/0x250
[ 86.027673][ T5340] ? __kasan_check_byte+0x12/0x40
[ 86.027689][ T5340] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.027700][ T5340] ? lock_release+0x4b/0x3e0
[ 86.027718][ T5340] ? __virt_addr_valid+0x4a5/0x5c0
[ 86.027732][ T5340] print_report+0xca/0x240
[ 86.027748][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.027760][ T5340] kasan_report+0x118/0x150
[ 86.027773][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.027785][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.027797][ T5340] kasan_check_range+0x2b0/0x2c0
[ 86.027810][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.027822][ T5340] __asan_memmove+0x29/0x70
[ 86.027839][ T5340] ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.027856][ T5340] ext4_xattr_block_set+0x872/0x2ac0
[ 86.027868][ T5340] ? fs_reclaim_acquire+0x7d/0x100
[ 86.027887][ T5340] ? __pfx_check_xattrs+0x10/0x10
[ 86.027907][ T5340] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 86.027920][ T5340] ? ext4_xattr_block_find+0x2d4/0x350
[ 86.027933][ T5340] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 86.027957][ T5340] __ext4_expand_extra_isize+0x30d/0x400
[ 86.027975][ T5340] __ext4_mark_inode_dirty+0x46c/0x700
[ 86.027996][ T5340] __ext4_unlink+0x631/0xab0
[ 86.028014][ T5340] ? __pfx___ext4_unlink+0x10/0x10
[ 86.028030][ T5340] ? __pfx___dquot_initialize+0x10/0x10
[ 86.028046][ T5340] ? down_write+0x162/0x1f0
[ 86.028106][ T5340] ext4_unlink+0x216/0x5d0
[ 86.028124][ T5340] vfs_unlink+0x394/0x650
[ 86.028136][ T5340] do_unlinkat+0x345/0x560
[ 86.028148][ T5340] ? __pfx_do_unlinkat+0x10/0x10
[ 86.028160][ T5340] ? getname_flags+0x1e5/0x540
[ 86.028174][ T5340] __x64_sys_unlink+0x47/0x50
[ 86.028185][ T5340] do_syscall_64+0xfa/0x3b0
[ 86.028198][ T5340] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.028211][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.028222][ T5340] ? clear_bhb_loop+0x60/0xb0
[ 86.028234][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.028245][ T5340] RIP: 0033:0x7fdd2df8eb69
[ 86.028256][ T5340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.028266][ T5340] RSP: 002b:00007fdd2ed1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 86.028280][ T5340] RAX: ffffffffffffffda RBX: 00007fdd2e1b5fa0 RCX: 00007fdd2df8eb69
[ 86.028289][ T5340] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 86.028297][ T5340] RBP: 00007fdd2e011df1 R08: 0000000000000000 R09: 0000000000000000
[ 86.028304][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.028312][ T5340] R13: 0000000000000000 R14: 00007fdd2e1b5fa0 R15: 00007ffc000b1f58
[ 86.028325][ T5340]
[ 86.028329][ T5340]
[ 86.153807][ T5340] Allocated by task 5340:
[ 86.155794][ T5340] kasan_save_track+0x3e/0x80
[ 86.157974][ T5340] __kasan_kmalloc+0x93/0xb0
[ 86.160077][ T5340] __kmalloc_node_track_caller_noprof+0x271/0x4e0
[ 86.162979][ T5340] kmemdup_noprof+0x2b/0x70
[ 86.165184][ T5340] ext4_xattr_block_set+0x781/0x2ac0
[ 86.167506][ T5340] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 86.170142][ T5340] __ext4_expand_extra_isize+0x30d/0x400
[ 86.172480][ T5340] __ext4_mark_inode_dirty+0x46c/0x700
[ 86.174877][ T5340] __ext4_unlink+0x631/0xab0
[ 86.176930][ T5340] ext4_unlink+0x216/0x5d0
[ 86.178950][ T5340] vfs_unlink+0x394/0x650
[ 86.180874][ T5340] do_unlinkat+0x345/0x560
[ 86.182850][ T5340] __x64_sys_unlink+0x47/0x50
[ 86.184912][ T5340] do_syscall_64+0xfa/0x3b0
[ 86.187081][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.189916][ T5340]
[ 86.191063][ T5340] The buggy address belongs to the object at ffff888046287800
[ 86.191063][ T5340] which belongs to the cache kmalloc-1k of size 1024
[ 86.196965][ T5340] The buggy address is located 80 bytes inside of
[ 86.196965][ T5340] 1024-byte region [ffff888046287800, ffff888046287c00)
[ 86.202997][ T5340]
[ 86.204113][ T5340] The buggy address belongs to the physical page:
[ 86.206894][ T5340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x46284
[ 86.210612][ T5340] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 86.214113][ T5340] anon flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 86.217584][ T5340] page_type: f5(slab)
[ 86.219401][ T5340] raw: 04fff00000000040 ffff88801a441dc0 0000000000000000 0000000000000001
[ 86.223027][ T5340] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 86.226827][ T5340] head: 04fff00000000040 ffff88801a441dc0 0000000000000000 0000000000000001
[ 86.230629][ T5340] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[ 86.234398][ T5340] head: 04fff00000000002 ffffea000118a101 00000000ffffffff 00000000ffffffff
[ 86.238111][ T5340] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 86.241803][ T5340] page dumped because: kasan: bad access detected
[ 86.244593][ T5340] page_owner tracks the page as allocated
[ 86.247162][ T5340] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5308, tgid 5308 (syz-executor), ts 80245543972, free_ts 0
[ 86.256033][ T5340] post_alloc_hook+0x240/0x2a0
[ 86.258169][ T5340] get_page_from_freelist+0x21e4/0x22c0
[ 86.260596][ T5340] __alloc_frozen_pages_noprof+0x181/0x370
[ 86.263013][ T5340] alloc_pages_mpol+0x232/0x4a0
[ 86.265198][ T5340] allocate_slab+0x8a/0x370
[ 86.267174][ T5340] ___slab_alloc+0xbeb/0x1410
[ 86.269359][ T5340] __kmalloc_noprof+0x305/0x4f0
[ 86.271780][ T5340] tomoyo_init_log+0x1a6e/0x1f70
[ 86.274576][ T5340] tomoyo_supervisor+0x340/0x1480
[ 86.276811][ T5340] tomoyo_env_perm+0x149/0x1e0
[ 86.279015][ T5340] tomoyo_find_next_domain+0x15cf/0x1aa0
[ 86.281487][ T5340] tomoyo_bprm_check_security+0x11c/0x180
[ 86.283998][ T5340] security_bprm_check+0x89/0x270
[ 86.286253][ T5340] bprm_execve+0x8ee/0x1450
[ 86.288134][ T5340] do_execveat_common+0x510/0x6a0
[ 86.290361][ T5340] __x64_sys_execve+0x94/0xb0
[ 86.292620][ T5340] page_owner free stack trace missing
[ 86.295193][ T5340]
[ 86.296367][ T5340] Memory state around the buggy address:
[ 86.299003][ T5340] ffff888046287700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 86.303004][ T5340] ffff888046287780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 86.307124][ T5340] >ffff888046287800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.310670][ T5340] ^
[ 86.313677][ T5340] ffff888046287880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.317352][ T5340] ffff888046287900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.320822][ T5340] ==================================================================
[ 86.333848][ T5340] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.336588][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted 6.16.0-syzkaller-09014-gd6084bb815c4 #0 PREEMPT(full)
[ 86.341456][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.346338][ T5340] Call Trace:
[ 86.347825][ T5340]
[ 86.349220][ T5340] dump_stack_lvl+0x99/0x250
[ 86.351239][ T5340] ? __asan_memcpy+0x40/0x70
[ 86.353405][ T5340] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.355650][ T5340] ? __pfx__printk+0x10/0x10
[ 86.357853][ T5340] vpanic+0x27a/0x730
[ 86.359850][ T5340] ? preempt_schedule+0xae/0xc0
[ 86.362244][ T5340] ? __pfx_vpanic+0x10/0x10
[ 86.364285][ T5340] ? preempt_schedule_common+0x83/0xd0
[ 86.366646][ T5340] ? preempt_schedule+0xae/0xc0
[ 86.368880][ T5340] ? __pfx_preempt_schedule+0x10/0x10
[ 86.371224][ T5340] panic+0xb9/0xc0
[ 86.372876][ T5340] ? __pfx_panic+0x10/0x10
[ 86.374911][ T5340] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 86.377325][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.379525][ T5340] check_panic_on_warn+0x89/0xb0
[ 86.381556][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.383643][ T5340] end_report+0x78/0x160
[ 86.385203][ T5340] kasan_report+0x129/0x150
[ 86.386988][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.388939][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.391218][ T5340] kasan_check_range+0x2b0/0x2c0
[ 86.393424][ T5340] ? ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.395790][ T5340] __asan_memmove+0x29/0x70
[ 86.398055][ T5340] ext4_xattr_set_entry+0x8e9/0x1e20
[ 86.400511][ T5340] ext4_xattr_block_set+0x872/0x2ac0
[ 86.402784][ T5340] ? fs_reclaim_acquire+0x7d/0x100
[ 86.405038][ T5340] ? __pfx_check_xattrs+0x10/0x10
[ 86.407352][ T5340] ? __pfx_ext4_xattr_block_set+0x10/0x10
[ 86.409976][ T5340] ? ext4_xattr_block_find+0x2d4/0x350
[ 86.412418][ T5340] ext4_expand_extra_isize_ea+0x12d5/0x1ea0
[ 86.415072][ T5340] __ext4_expand_extra_isize+0x30d/0x400
[ 86.417685][ T5340] __ext4_mark_inode_dirty+0x46c/0x700
[ 86.420069][ T5340] __ext4_unlink+0x631/0xab0
[ 86.422129][ T5340] ? __pfx___ext4_unlink+0x10/0x10
[ 86.424457][ T5340] ? __pfx___dquot_initialize+0x10/0x10
[ 86.426893][ T5340] ? down_write+0x162/0x1f0
[ 86.428970][ T5340] ext4_unlink+0x216/0x5d0
[ 86.430887][ T5340] vfs_unlink+0x394/0x650
[ 86.432788][ T5340] do_unlinkat+0x345/0x560
[ 86.434760][ T5340] ? __pfx_do_unlinkat+0x10/0x10
[ 86.436970][ T5340] ? getname_flags+0x1e5/0x540
[ 86.439111][ T5340] __x64_sys_unlink+0x47/0x50
[ 86.441182][ T5340] do_syscall_64+0xfa/0x3b0
[ 86.443268][ T5340] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.445480][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.448137][ T5340] ? clear_bhb_loop+0x60/0xb0
[ 86.450175][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.452819][ T5340] RIP: 0033:0x7fdd2df8eb69
[ 86.455178][ T5340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.463870][ T5340] RSP: 002b:00007fdd2ed1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 86.467261][ T5340] RAX: ffffffffffffffda RBX: 00007fdd2e1b5fa0 RCX: 00007fdd2df8eb69
[ 86.470480][ T5340] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180
[ 86.473935][ T5340] RBP: 00007fdd2e011df1 R08: 0000000000000000 R09: 0000000000000000
[ 86.477588][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.481516][ T5340] R13: 0000000000000000 R14: 00007fdd2e1b5fa0 R15: 00007ffc000b1f58
[ 86.485062][ T5340]
[ 86.486859][ T5340] Kernel Offset: disabled
[ 86.488820][ T5340] Rebooting in 86400 seconds..