program:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000400)='setgroups\x00')
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x210000, &(0x7f0000000180)={[{@auto_da_alloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x57c, &(0x7f0000000440)="$eJzs3V9rW+UfAPDvSdPu7++3DsZQL2SwCydz6dr6Z4LgvBQdDvR+hjYro+kymnSsdeB24W5EkCGIOBBfgPdeDt+Ar2KggyGj6IUIkZOedGmbtGuWmWz5fOBsz3P+7DnfPOd79jw5CQlgaB1L/8hFvBgRXycRh1q25SPbeGxtv9WH12fSJYl6/eM/kkiydc39k+zvA1nlhYj45YuIk7mt7VaXV+aL5XJpMatP1BauTFSXV05dWijOleZKl6emp8+8MT319ltv9izWV8//9d1Hd98/8+Xx1W9/un/4dhJn42C2rTWOJ3CjtXKs+E9WGo2zm3ac7EFjgyTp9wnQlZEsz0cjvQccipEs64Hn3+cRUQeGVCL/YUg1xwHNuX2P5sHPjAfvrU2AGrGPtcafX3tvJPY25kb7V5MNM6N0vjveg/bTNn7+/c7tdIlt3ofYG7Fv06rNdYBduXEzIk7n81vv/0l2/+ve6cabx9vb3Maw/f8D/XQ3Hf+81m78l1sf/0Sb8c+BNrnbjZ3zP3e/B810lI7/3mk7/l2/dY2PZLX/NcZ8o8nFS+XS6Yj4f0SciPqOjz7OrN6rd9rWOv5Ll7T95lgwO4/7+T0bj5kt1ooRMdZlyBs8uBnxUr5d/Ml6/ydt+j99Pc4/ZhtHS3de7rRt5/ifrvqPEa+07f9H3Zps/3xyonE9TDSviq3+vHX0107t9zv+tP/3bx//eNL6vLa6+zZ+2Pt3qdO2bq//seSTRrmZBNeKtdriZMRY8uHW9VOPjm3Wm/un8Z84vv39r931n06+Pn3M+G8dudVx10Ho/9ld9f/uC/c++Oz7Tu0/Xv+/3iidyNZk97/2smul7emkHbjpBJ/09QMAAAAAAIBBkouIg5HkCuvlXK5QWPt8x5HYnytXqrWTFytLl2ej8V3Z8RjNNZ90H2r5PMRk9nnYZn1qU306Ig5HxDcj+xr1wkylPNvv4AEAAAAAAAAAAAAAAAAAAGBAHOjw/f/UbyP9PjvgqWv8sMGefp8F0A87/uR/L37pCRhIO+Y/8NyS/zC85D8ML/kPw0v+w/CS/zC85D8ML/kPAAAAAAAAAAAAAAAAAAAAAAAAAAAAPXX+3Ll0qa8+vD6T1mevLi/NV66emi1V5wsLSzOFmcrilcJcpTJXLhVmKgs7/XvlSuXK5FQsXZuolaq1ieryyoWFytLl2oVLC8W50oXS6H8SFQAAAAAAAAAAAAAAAAAAADxbqssr88VyubSo0LHwbgzEaTzFAL9auxi6Ojw/KFEodCjczHJ9d0f1864EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABv9GwAA//9qpDBi")
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/clear_refs\x00', 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wlan0\x00'})
r2 = socket$phonet_pipe(0x23, 0x5, 0x2)
ioctl$sock_proto_private(r2, 0x8b26, &(0x7f00000003c0))
r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x4)
ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f00000002c0)={{}, 'syz0\x00'})
ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x6)
ioctl$UI_DEV_CREATE(r3, 0x5501)
r4 = openat(0xffffffffffffff9c, &(0x7f00000009c0)='./file1\x00', 0x42, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x4]}, 0x8, 0xc0000)
r5 = syz_open_dev$loop(&(0x7f0000000a00), 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x12, 0x3, "d2273078cf6175866187bbf62372bbb65d940f27bc28a5a442ff5a8d374a182008a1fd92701ce53ee6aa5d922917aeecbfb3db24b09909c24cc157a3780cf5d5", "09b49809fc32a5fc7be9f88c6b84907998105e3111daa2bd51b0d0c3bc93fb2d0f0244a8c7a99a75e76613c745458f5c1212e72d93b272fed81941f04edd0059", "a960f08042e09119b6f87de59f19912c538884e7a95c3d50e4be66184e295eb1", [0x4, 0x6c]})
fallocate(r4, 0x0, 0x0, 0xffff)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)=@keyring={'key_or_keyring:', r1})
write$make_it_fail(r0, 0x0, 0x0)
[ 119.231366][ T4651] Bluetooth: hci0: command tx timeout
[ 119.344269][ T5345] loop0: detected capacity change from 0 to 1024
[ 119.345870][ T5345] EXT4-fs: Ignoring removed bh option
[ 119.401613][ T5345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 119.462293][ T5346] input: syz0 as /devices/virtual/input/input5
[ 119.534344][ T5351] ==================================================================
[ 119.534359][ T5351] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534462][ T5351] Read of size 18446744073709551600 at addr ffff88801fa922b8 by task syz.0.0/5351
[ 119.534473][ T5351]
[ 119.534491][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 119.534504][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 119.534512][ T5351] Call Trace:
[ 119.534517][ T5351]
[ 119.534524][ T5351] dump_stack_lvl+0xe8/0x150
[ 119.534542][ T5351] print_address_description+0x55/0x1e0
[ 119.534559][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534571][ T5351] print_report+0x58/0x70
[ 119.534585][ T5351] kasan_report+0x117/0x150
[ 119.534599][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534610][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534620][ T5351] kasan_check_range+0x264/0x2c0
[ 119.534635][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534646][ T5351] __asan_memmove+0x29/0x70
[ 119.534665][ T5351] ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.534682][ T5351] ext4_xattr_ibody_set+0x262/0x710
[ 119.534694][ T5351] ext4_destroy_inline_data_nolock+0x23a/0x5f0
[ 119.534721][ T5351] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10
[ 119.534739][ T5351] ? __asan_memcpy+0x40/0x70
[ 119.534755][ T5351] ? ext4_read_inline_data+0x100/0x2b0
[ 119.534768][ T5351] ext4_convert_inline_data_nolock+0x208/0x980
[ 119.534784][ T5351] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10
[ 119.534795][ T5351] ? down_write+0x16b/0x200
[ 119.534848][ T5351] ext4_convert_inline_data+0x484/0x5c0
[ 119.534884][ T5351] ? __pfx_ext4_convert_inline_data+0x10/0x10
[ 119.534898][ T5351] ? down_write+0x16b/0x200
[ 119.534912][ T5351] ? __pfx_down_write+0x10/0x10
[ 119.534930][ T5351] ext4_fallocate+0x1e2/0x400
[ 119.534944][ T5351] vfs_fallocate+0x65a/0x7e0
[ 119.534955][ T5351] ? __fget_files+0x2a/0x420
[ 119.534970][ T5351] ? __pfx_vfs_fallocate+0x10/0x10
[ 119.534980][ T5351] ? __fget_files+0x2a/0x420
[ 119.534996][ T5351] ? fdget+0x1ac/0x250
[ 119.535011][ T5351] __x64_sys_fallocate+0xbf/0x110
[ 119.535022][ T5351] do_syscall_64+0x166/0x520
[ 119.535035][ T5351] ? trace_irq_disable+0x3b/0x140
[ 119.535047][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 119.535058][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 119.535070][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 119.535081][ T5351] RIP: 0033:0x7f09c139f559
[ 119.535093][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 119.535103][ T5351] RSP: 002b:00007f09c2295fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 119.535116][ T5351] RAX: ffffffffffffffda RBX: 00007f09c1626180 RCX: 00007f09c139f559
[ 119.535125][ T5351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
[ 119.535132][ T5351] RBP: 00007f09c1436b20 R08: 0000000000000000 R09: 0000000000000000
[ 119.535139][ T5351] R10: 000000000000ffff R11: 0000000000000246 R12: 0000000000000000
[ 119.535147][ T5351] R13: 00007f09c1626218 R14: 00007f09c1626180 R15: 00007ffe087f2438
[ 119.535159][ T5351]
[ 119.535163][ T5351]
[ 119.535166][ T5351] The buggy address belongs to the physical page:
[ 119.535171][ T5351] page: refcount:3 mapcount:0 mapping:ffff88801e025940 index:0x2 pfn:0x1fa92
[ 119.535182][ T5351] memcg:ffff888035e37900
[ 119.535188][ T5351] aops:def_blk_aops ino:700000 dentry name(?):""
[ 119.535278][ T5351] flags: 0xfff18000004204(referenced|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
[ 119.535296][ T5351] raw: 00fff18000004204 0000000000000000 dead000000000122 ffff88801e025940
[ 119.535312][ T5351] raw: 0000000000000002 ffff8880443ffa80 00000003ffffffff ffff888035e37900
[ 119.535318][ T5351] page dumped because: kasan: bad access detected
[ 119.535324][ T5351] page_owner tracks the page as allocated
[ 119.535329][ T5351] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_MOVABLE|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5351, tgid 5344 (syz.0.0), ts 119529384894
[ 119.535347][ T5351] post_alloc_hook+0x1f9/0x250
[ 119.535365][ T5351] get_page_from_freelist+0x2209/0x2280
[ 119.535374][ T5351] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 119.535386][ T5351] alloc_pages_mpol+0x21e/0x390
[ 119.535398][ T5351] alloc_pages_noprof+0xb1/0x2b0
[ 119.535409][ T5351] folio_alloc_noprof+0x1e/0x30
[ 119.535420][ T5351] filemap_alloc_folio_noprof+0x111/0x460
[ 119.535432][ T5351] __filemap_get_folio_mpol+0x402/0x1000
[ 119.535444][ T5351] bdev_getblk+0x1f4/0x6e0
[ 119.535455][ T5351] __ext4_get_inode_loc+0x56c/0xf40
[ 119.535470][ T5351] ext4_get_inode_loc+0x81/0xf0
[ 119.535483][ T5351] ext4_convert_inline_data+0x261/0x5c0
[ 119.535494][ T5351] ext4_fallocate+0x1e2/0x400
[ 119.535505][ T5351] vfs_fallocate+0x65a/0x7e0
[ 119.535514][ T5351] __x64_sys_fallocate+0xbf/0x110
[ 119.535523][ T5351] do_syscall_64+0x166/0x520
[ 119.535534][ T5351] page last free pid 79 tgid 79 ts 116508884530 stack trace:
[ 119.535542][ T5351] free_unref_folios+0xdc2/0x14e0
[ 119.535556][ T5351] shrink_folio_list+0x2be2/0x5250
[ 119.535565][ T5351] evict_folios+0x3055/0x3fb0
[ 119.535579][ T5351] try_to_shrink_lruvec+0xe3b/0x1340
[ 119.535588][ T5351] shrink_one+0x233/0x730
[ 119.535597][ T5351] shrink_node+0x35d0/0x3e30
[ 119.535606][ T5351] kswapd+0x185e/0x32c0
[ 119.535617][ T5351] kthread+0x38b/0x480
[ 119.535626][ T5351] ret_from_fork+0x514/0xb70
[ 119.535636][ T5351] ret_from_fork_asm+0x1a/0x30
[ 119.535645][ T5351]
[ 119.535648][ T5351] Memory state around the buggy address:
[ 119.535654][ T5351] ffff88801fa92180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 119.535662][ T5351] ffff88801fa92200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 119.535669][ T5351] >ffff88801fa92280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 119.535675][ T5351] ^
[ 119.535681][ T5351] ffff88801fa92300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 119.535687][ T5351] ffff88801fa92380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 119.535693][ T5351] ==================================================================
[ 119.538610][ T5346] loop0: detected capacity change from 1024 to 0
[ 119.835280][ T5351] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 119.838554][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 119.842399][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 119.846526][ T5351] Call Trace:
[ 119.847921][ T5351]
[ 119.849198][ T5351] vpanic+0x56d/0xa60
[ 119.850909][ T5351] ? __pfx_vpanic+0x10/0x10
[ 119.852873][ T5351] panic+0xc5/0xd0
[ 119.854474][ T5351] ? __pfx_panic+0x10/0x10
[ 119.856678][ T5351] ? preempt_schedule_thunk+0x16/0x40
[ 119.859257][ T5351] ? preempt_schedule_thunk+0x16/0x40
[ 119.861546][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.863760][ T5351] check_panic_on_warn+0x89/0xb0
[ 119.865848][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.868227][ T5351] end_report+0x73/0x170
[ 119.870073][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.872315][ T5351] kasan_report+0x128/0x150
[ 119.874377][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.876700][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.878825][ T5351] kasan_check_range+0x264/0x2c0
[ 119.880536][ T5351] ? ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.882697][ T5351] __asan_memmove+0x29/0x70
[ 119.884564][ T5351] ext4_xattr_set_entry+0x92b/0x1ed0
[ 119.886795][ T5351] ext4_xattr_ibody_set+0x262/0x710
[ 119.889128][ T5351] ext4_destroy_inline_data_nolock+0x23a/0x5f0
[ 119.891920][ T5351] ? __pfx_ext4_destroy_inline_data_nolock+0x10/0x10
[ 119.894713][ T5351] ? __asan_memcpy+0x40/0x70
[ 119.896750][ T5351] ? ext4_read_inline_data+0x100/0x2b0
[ 119.899093][ T5351] ext4_convert_inline_data_nolock+0x208/0x980
[ 119.901566][ T5351] ? __pfx_ext4_convert_inline_data_nolock+0x10/0x10
[ 119.904013][ T5351] ? down_write+0x16b/0x200
[ 119.905642][ T5351] ext4_convert_inline_data+0x484/0x5c0
[ 119.907684][ T5351] ? __pfx_ext4_convert_inline_data+0x10/0x10
[ 119.910817][ T5351] ? down_write+0x16b/0x200
[ 119.912889][ T5351] ? __pfx_down_write+0x10/0x10
[ 119.914688][ T5351] ext4_fallocate+0x1e2/0x400
[ 119.916853][ T5351] vfs_fallocate+0x65a/0x7e0
[ 119.918798][ T5351] ? __fget_files+0x2a/0x420
[ 119.920552][ T5351] ? __pfx_vfs_fallocate+0x10/0x10
[ 119.922641][ T5351] ? __fget_files+0x2a/0x420
[ 119.924391][ T5351] ? fdget+0x1ac/0x250
[ 119.926123][ T5351] __x64_sys_fallocate+0xbf/0x110
[ 119.928129][ T5351] do_syscall_64+0x166/0x520
[ 119.930078][ T5351] ? trace_irq_disable+0x3b/0x140
[ 119.932302][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 119.935072][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 119.937195][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 119.939532][ T5351] RIP: 0033:0x7f09c139f559
[ 119.941187][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 119.948983][ T5351] RSP: 002b:00007f09c2295fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 119.952632][ T5351] RAX: ffffffffffffffda RBX: 00007f09c1626180 RCX: 00007f09c139f559
[ 119.955922][ T5351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
[ 119.959120][ T5351] RBP: 00007f09c1436b20 R08: 0000000000000000 R09: 0000000000000000
[ 119.962495][ T5351] R10: 000000000000ffff R11: 0000000000000246 R12: 0000000000000000
[ 119.965873][ T5351] R13: 00007f09c1626218 R14: 00007f09c1626180 R15: 00007ffe087f2438
[ 119.968951][ T5351]
[ 119.970594][ T5351] Kernel Offset: disabled
[ 119.972217][ T5351] Rebooting in 86400 seconds..