./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1683884985
<...>
Warning: Permanently added '10.128.1.184' (ED25519) to the list of known hosts.
execve("./syz-executor1683884985", ["./syz-executor1683884985"], 0x7ffebaf3b5d0 /* 10 vars */) = 0
brk(NULL) = 0x55557205b000
brk(0x55557205be00) = 0x55557205be00
arch_prctl(ARCH_SET_FS, 0x55557205b480) = 0
set_tid_address(0x55557205b750) = 5820
set_robust_list(0x55557205b760, 24) = 0
rseq(0x55557205bda0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1683884985", 4096) = 28
getrandom("\xa2\xc0\x3f\xec\x66\xcc\x5c\x5e", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55557205be00
brk(0x55557207ce00) = 0x55557207ce00
brk(0x55557207d000) = 0x55557207d000
mprotect(0x7f269baf5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5820}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5) = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5) = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5) = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5) = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(3) = 0
close(4) = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f269ba48d50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f269ba519b0}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f269ba48d50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f269ba519b0}, NULL, 8) = 0
mkdir("./syzkaller.u8RRub", 0700) = 0
chmod("./syzkaller.u8RRub", 0777) = 0
chdir("./syzkaller.u8RRub") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5822 attached
, child_tidptr=0x55557205b750) = 5822
[pid 5822] set_robust_list(0x55557205b760, 24) = 0
[pid 5822] chdir("./0") = 0
[pid 5822] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5822] setpgid(0, 0) = 0
[pid 5822] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5822] write(3, "1000", 4) = 4
[pid 5822] close(3) = 0
[pid 5822] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5822] write(1, "executing program\n", 18executing program
) = 18
[pid 5822] memfd_create("syzkaller", 0) = 3
[pid 5822] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2693600000
[pid 5822] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 5822] munmap(0x7f2693600000, 138412032) = 0
[pid 5822] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5822] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5822] close(3) = 0
[pid 5822] close(4) = 0
[pid 5822] mkdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", 0777) = 0
[ 88.786757][ T5822] loop0: detected capacity change from 0 to 512
[pid 5822] mount("/dev/loop0", "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", "ext4", MS_DIRSYNC|MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, ",errors=continue") = 0
[pid 5822] openat(AT_FDCWD, "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_DIRECTORY) = 3
[pid 5822] chdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0
[pid 5822] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5822] chdir("./file0") = 0
[pid 5822] openat(AT_FDCWD, "net_prio.prioidx", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[ 88.829054][ T5822] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor168: corrupted in-inode xattr: invalid ea_ino
[ 88.844333][ T5822] EXT4-fs error (device loop0): ext4_orphan_get:1394: comm syz-executor168: couldn't read orphan inode 15 (err -117)
[ 88.858606][ T5822] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[pid 5822] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 005) = 0
[pid 5822] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5
[pid 5822] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0
[ 88.927769][ T5822] ==================================================================
[ 88.935881][ T5822] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x36a/0x6d0
[ 88.943909][ T5822] Write of size 250 at addr ffff8880293e2f18 by task syz-executor168/5822
[ 88.952413][ T5822]
[ 88.954751][ T5822] CPU: 0 UID: 0 PID: 5822 Comm: syz-executor168 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
[ 88.965965][ T5822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 88.976025][ T5822] Call Trace:
[ 88.979298][ T5822]
[ 88.982222][ T5822] dump_stack_lvl+0x241/0x360
[ 88.986905][ T5822] ? __pfx_dump_stack_lvl+0x10/0x10
[ 88.992122][ T5822] ? __pfx__printk+0x10/0x10
[ 88.996701][ T5822] ? _printk+0xd5/0x120
[ 89.000847][ T5822] ? __virt_addr_valid+0x183/0x530
[ 89.005955][ T5822] ? __virt_addr_valid+0x183/0x530
[ 89.011074][ T5822] print_report+0x169/0x550
[ 89.015571][ T5822] ? __virt_addr_valid+0x183/0x530
[ 89.020680][ T5822] ? __virt_addr_valid+0x183/0x530
[ 89.025789][ T5822] ? __virt_addr_valid+0x45f/0x530
[ 89.030946][ T5822] ? __phys_addr+0xba/0x170
[ 89.035442][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.040644][ T5822] kasan_report+0x143/0x180
[ 89.045152][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.050354][ T5822] kasan_check_range+0x282/0x290
[ 89.055375][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.060612][ T5822] __asan_memcpy+0x40/0x70
[ 89.065024][ T5822] ext4_insert_dentry+0x36a/0x6d0
[ 89.070048][ T5822] add_dirent_to_buf+0x3d9/0x750
[ 89.075160][ T5822] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 89.080667][ T5822] ? __ext4_handle_dirty_metadata+0x34b/0x820
[ 89.086741][ T5822] make_indexed_dir+0xf98/0x1600
[ 89.091769][ T5822] ? __pfx_make_indexed_dir+0x10/0x10
[ 89.097396][ T5822] ? add_dirent_to_buf+0x398/0x750
[ 89.102503][ T5822] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 89.107961][ T5822] ? __ext4_read_dirblock+0x527/0x890
[ 89.113331][ T5822] ext4_add_entry+0xcf7/0xfa0
[ 89.118093][ T5822] ? __pfx_ext4_add_entry+0x10/0x10
[ 89.123283][ T5822] ? __pfx_ext4_init_new_dir+0x10/0x10
[ 89.128749][ T5822] ? smack_inode_permission+0x2dc/0x380
[ 89.134300][ T5822] ext4_mkdir+0x554/0xcf0
[ 89.138624][ T5822] ? __pfx_ext4_mkdir+0x10/0x10
[ 89.143466][ T5822] ? bpf_lsm_inode_mkdir+0x9/0x10
[ 89.148480][ T5822] ? security_inode_mkdir+0xbe/0x340
[ 89.153759][ T5822] vfs_mkdir+0x2f9/0x4f0
[ 89.158000][ T5822] do_mkdirat+0x264/0x3a0
[ 89.162586][ T5822] ? __check_object_size+0x48e/0x900
[ 89.167862][ T5822] ? __pfx_do_mkdirat+0x10/0x10
[ 89.172709][ T5822] ? getname_flags+0x1e3/0x540
[ 89.177465][ T5822] __x64_sys_mkdirat+0x87/0xa0
[ 89.182227][ T5822] do_syscall_64+0xf3/0x230
[ 89.186734][ T5822] ? clear_bhb_loop+0x35/0x90
[ 89.191446][ T5822] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.197344][ T5822] RIP: 0033:0x7f269ba86719
[ 89.201818][ T5822] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 89.221508][ T5822] RSP: 002b:00007ffcf1b0ca58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 89.229930][ T5822] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f269ba86719
[ 89.237896][ T5822] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 00000000ffffff9c
[ 89.245880][ T5822] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 89.253840][ T5822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 89.261809][ T5822] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffcf1b0cac0
[ 89.269780][ T5822]
[ 89.272789][ T5822]
[ 89.275100][ T5822] The buggy address belongs to the physical page:
[ 89.281517][ T5822] page: refcount:3 mapcount:0 mapping:ffff888148c8cd78 index:0x3f pfn:0x293e2
[ 89.290528][ T5822] memcg:ffff88801bed4000
[ 89.294847][ T5822] aops:def_blk_aops ino:700000 dentry name(?):""
[ 89.301174][ T5822] flags: 0xfff00000004114(referenced|dirty|active|private|node=0|zone=1|lastcpupid=0x7ff)
[ 89.311557][ T5822] raw: 00fff00000004114 0000000000000000 dead000000000122 ffff888148c8cd78
[ 89.320140][ T5822] raw: 000000000000003f ffff888075c4f910 00000003ffffffff ffff88801bed4000
[ 89.328744][ T5822] page dumped because: kasan: bad access detected
[ 89.335161][ T5822] page_owner tracks the page as allocated
[ 89.340866][ T5822] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5822, tgid 5822 (syz-executor168), ts 88925553809, free_ts 88924754728
[ 89.360411][ T5822] post_alloc_hook+0x1f3/0x230
[ 89.365272][ T5822] get_page_from_freelist+0x3651/0x37a0
[ 89.370813][ T5822] __alloc_pages_noprof+0x292/0x710
[ 89.376035][ T5822] alloc_pages_mpol_noprof+0x3e8/0x680
[ 89.381487][ T5822] folio_alloc_noprof+0x128/0x180
[ 89.386502][ T5822] filemap_alloc_folio_noprof+0xdf/0x500
[ 89.392128][ T5822] __filemap_get_folio+0x446/0xbd0
[ 89.397274][ T5822] bdev_getblk+0x1d8/0x550
[ 89.401684][ T5822] ext4_getblk+0x31b/0x880
[ 89.406103][ T5822] ext4_bread+0x2e/0x180
[ 89.410427][ T5822] ext4_append+0x327/0x5c0
[ 89.414836][ T5822] make_indexed_dir+0x523/0x1600
[ 89.419763][ T5822] ext4_add_entry+0xcf7/0xfa0
[ 89.424436][ T5822] ext4_mkdir+0x554/0xcf0
[ 89.428756][ T5822] vfs_mkdir+0x2f9/0x4f0
[ 89.432992][ T5822] do_mkdirat+0x264/0x3a0
[ 89.437314][ T5822] page last free pid 0 tgid 0 stack trace:
[ 89.443111][ T5822] free_unref_page+0xde3/0x1130
[ 89.447971][ T5822] skb_release_data+0x6dc/0x8a0
[ 89.452811][ T5822] __kfree_skb+0x55/0x70
[ 89.457048][ T5822] tcp_rcv_established+0xfb7/0x1f20
[ 89.462255][ T5822] tcp_v4_do_rcv+0x96d/0xc70
[ 89.466927][ T5822] tcp_v4_rcv+0x2dc0/0x37f0
[ 89.471423][ T5822] ip_protocol_deliver_rcu+0x22e/0x440
[ 89.476884][ T5822] ip_local_deliver_finish+0x341/0x5f0
[ 89.482333][ T5822] NF_HOOK+0x3a4/0x450
[ 89.486534][ T5822] ip_sublist_rcv_finish+0x3be/0x4f0
[ 89.491819][ T5822] ip_sublist_rcv+0x75d/0xab0
[ 89.496487][ T5822] ip_list_rcv+0x42b/0x480
[ 89.500900][ T5822] __netif_receive_skb_list_core+0x94e/0x980
[ 89.506896][ T5822] netif_receive_skb_list_internal+0xa51/0xe30
[ 89.513059][ T5822] napi_complete_done+0x2b5/0x870
[ 89.518079][ T5822] virtnet_poll+0x2de9/0x39b0
[ 89.522779][ T5822]
[ 89.525098][ T5822] Memory state around the buggy address:
[ 89.530733][ T5822] ffff8880293e2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 89.538798][ T5822] ffff8880293e2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 89.546970][ T5822] >ffff8880293e3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.555018][ T5822] ^
[ 89.559078][ T5822] ffff8880293e3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 89.567129][ T5822] ffff8880293e3100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 89.575181][ T5822] ==================================================================
[ 89.583752][ T5822] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 89.591060][ T5822] CPU: 0 UID: 0 PID: 5822 Comm: syz-executor168 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
[ 89.602173][ T5822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 89.612310][ T5822] Call Trace:
[ 89.615582][ T5822]
[ 89.618595][ T5822] dump_stack_lvl+0x241/0x360
[ 89.623276][ T5822] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.628651][ T5822] ? __pfx__printk+0x10/0x10
[ 89.633349][ T5822] ? preempt_schedule+0xe1/0xf0
[ 89.638284][ T5822] ? vscnprintf+0x5d/0x90
[ 89.642636][ T5822] panic+0x349/0x880
[ 89.646716][ T5822] ? check_panic_on_warn+0x21/0xb0
[ 89.651861][ T5822] ? __pfx_panic+0x10/0x10
[ 89.656451][ T5822] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 89.662452][ T5822] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 89.668880][ T5822] ? print_report+0x502/0x550
[ 89.673555][ T5822] check_panic_on_warn+0x86/0xb0
[ 89.678579][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.683806][ T5822] end_report+0x77/0x160
[ 89.688065][ T5822] kasan_report+0x154/0x180
[ 89.692575][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.697795][ T5822] kasan_check_range+0x282/0x290
[ 89.702742][ T5822] ? ext4_insert_dentry+0x36a/0x6d0
[ 89.707954][ T5822] __asan_memcpy+0x40/0x70
[ 89.712454][ T5822] ext4_insert_dentry+0x36a/0x6d0
[ 89.717480][ T5822] add_dirent_to_buf+0x3d9/0x750
[ 89.722435][ T5822] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 89.727888][ T5822] ? __ext4_handle_dirty_metadata+0x34b/0x820
[ 89.733955][ T5822] make_indexed_dir+0xf98/0x1600
[ 89.738897][ T5822] ? __pfx_make_indexed_dir+0x10/0x10
[ 89.744362][ T5822] ? add_dirent_to_buf+0x398/0x750
[ 89.749472][ T5822] ? __pfx_add_dirent_to_buf+0x10/0x10
[ 89.754937][ T5822] ? __ext4_read_dirblock+0x527/0x890
[ 89.760315][ T5822] ext4_add_entry+0xcf7/0xfa0
[ 89.765002][ T5822] ? __pfx_ext4_add_entry+0x10/0x10
[ 89.770198][ T5822] ? __pfx_ext4_init_new_dir+0x10/0x10
[ 89.775745][ T5822] ? smack_inode_permission+0x2dc/0x380
[ 89.781294][ T5822] ext4_mkdir+0x554/0xcf0
[ 89.785618][ T5822] ? __pfx_ext4_mkdir+0x10/0x10
[ 89.790462][ T5822] ? bpf_lsm_inode_mkdir+0x9/0x10
[ 89.795502][ T5822] ? security_inode_mkdir+0xbe/0x340
[ 89.800799][ T5822] vfs_mkdir+0x2f9/0x4f0
[ 89.805040][ T5822] do_mkdirat+0x264/0x3a0
[ 89.809364][ T5822] ? __check_object_size+0x48e/0x900
[ 89.814702][ T5822] ? __pfx_do_mkdirat+0x10/0x10
[ 89.819580][ T5822] ? getname_flags+0x1e3/0x540
[ 89.824363][ T5822] __x64_sys_mkdirat+0x87/0xa0
[ 89.829165][ T5822] do_syscall_64+0xf3/0x230
[ 89.833753][ T5822] ? clear_bhb_loop+0x35/0x90
[ 89.838434][ T5822] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.844345][ T5822] RIP: 0033:0x7f269ba86719
[ 89.848796][ T5822] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 89.868668][ T5822] RSP: 002b:00007ffcf1b0ca58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 89.877361][ T5822] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f269ba86719
[ 89.885333][ T5822] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 00000000ffffff9c
[ 89.893301][ T5822] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 89.901267][ T5822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 89.909498][ T5822] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffcf1b0cac0
[ 89.917470][ T5822]
[ 89.920628][ T5822] Kernel Offset: disabled
[ 89.924940][ T5822] Rebooting in 86400 seconds..