Warning: Permanently added '10.128.1.167' (ECDSA) to the list of known hosts. executing program [ 40.264109][ T4217] loop0: detected capacity change from 0 to 512 [ 40.268066][ T4217] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 40.275497][ T4217] EXT4-fs (loop0): 1 truncate cleaned up [ 40.276789][ T4217] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 40.283273][ T4217] ------------[ cut here ]------------ [ 40.284472][ T4217] WARNING: CPU: 0 PID: 4217 at mm/slab_common.c:923 free_large_kmalloc+0x34/0x15c [ 40.286428][ T4217] Modules linked in: [ 40.287214][ T4217] CPU: 0 PID: 4217 Comm: syz-executor366 Not tainted 6.1.27-syzkaller #0 [ 40.288978][ T4217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 40.290995][ T4217] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 40.292617][ T4217] pc : free_large_kmalloc+0x34/0x15c [ 40.293750][ T4217] lr : kfree+0x10c/0x1b8 [ 40.294588][ T4217] sp : ffff80001d9c74e0 [ 40.295406][ T4217] x29: ffff80001d9c74e0 x28: ffff0000cb50dc00 x27: dfff800000000000 [ 40.297051][ T4217] x26: 0000000000000020 x25: ffff0001b2e275a4 x24: 0000000000000020 [ 40.298730][ T4217] x23: ffff0000cb50df00 x22: 0000000000000000 x21: ffff800008809f54 [ 40.300445][ T4217] x20: ffff0001b2e275a4 x19: fffffc0006cb89c0 x18: ffff80001d9c69e0 [ 40.302087][ T4217] x17: ffff80001558d000 x16: ffff8000120e6354 x15: ffff800008a69cdc [ 40.303737][ T4217] x14: ffff800008a698ac x13: ffff800008061bb4 x12: 0000000000000003 [ 40.305358][ T4217] x11: ff80800008098054 x10: 0000000000000000 x9 : 0000000006cb89c0 [ 40.307072][ T4217] x8 : ffff800017ea4000 x7 : ffff800008061ea0 x6 : ffff8000080620b0 [ 40.308818][ T4217] x5 : ffff0000cc8d4178 x4 : ffff80001d9c72b0 x3 : 0000000000000000 [ 40.310521][ T4217] x2 : 0000000000000006 x1 : ffff0001b2e275a4 x0 : fffffc0006cb89c0 [ 40.312260][ T4217] Call trace: [ 40.312952][ T4217] free_large_kmalloc+0x34/0x15c [ 40.314050][ T4217] kfree+0x10c/0x1b8 [ 40.314868][ T4217] kvfree+0x40/0x50 [ 40.315652][ T4217] ext4_expand_extra_isize_ea+0xcbc/0x1688 [ 40.316939][ T4217] __ext4_expand_extra_isize+0x290/0x348 [ 40.318127][ T4217] __ext4_mark_inode_dirty+0x484/0x8fc [ 40.319251][ T4217] __ext4_unlink+0x758/0x988 [ 40.320207][ T4217] ext4_unlink+0x1d8/0x7d0 [ 40.321141][ T4217] vfs_unlink+0x2f0/0x508 [ 40.322048][ T4217] do_unlinkat+0x4c8/0x82c [ 40.323048][ T4217] __arm64_sys_unlinkat+0xcc/0xfc [ 40.324119][ T4217] invoke_syscall+0x98/0x2c0 [ 40.325032][ T4217] el0_svc_common+0x138/0x258 [ 40.326054][ T4217] do_el0_svc+0x64/0x218 [ 40.326990][ T4217] el0_svc+0x58/0x168 [ 40.327893][ T4217] el0t_64_sync_handler+0x84/0xf0 [ 40.328962][ T4217] el0t_64_sync+0x18c/0x190 [ 40.329913][ T4217] irq event stamp: 19094 [ 40.330798][ T4217] hardirqs last enabled at (19093): [<ffff80000896b310>] kasan_quarantine_put+0xdc/0x204 [ 40.332884][ T4217] hardirqs last disabled at (19094): [<ffff8000120e200c>] el1_dbg+0x24/0x80 [ 40.334735][ T4217] softirqs last enabled at (18910): [<ffff800008032b74>] local_bh_enable+0x10/0x34 [ 40.336845][ T4217] softirqs last disabled at (18908): [<ffff800008032b40>] local_bh_disable+0x10/0x34 [ 40.338935][ T4217] ---[ end trace 0000000000000000 ]--- [ 40.340601][ T4217] object pointer: 0x00000000d64fdf11 [ 40.341800][ T4217] ================================================================== [ 40.343416][ T4217] BUG: KASAN: invalid-free in kfree+0x10c/0x1b8 [ 40.344636][ T4217] Free of addr ffff0001b2e275a4 by task syz-executor366/4217 [ 40.346170][ T4217] [ 40.346646][ T4217] CPU: 0 PID: 4217 Comm: syz-executor366 Tainted: G W 6.1.27-syzkaller #0 [ 40.348679][ T4217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 40.350682][ T4217] Call trace: [ 40.351357][ T4217] dump_backtrace+0x1c8/0x1f4 [ 40.352290][ T4217] show_stack+0x2c/0x3c [ 40.353221][ T4217] dump_stack_lvl+0x108/0x170 [ 40.354209][ T4217] print_report+0x174/0x4c0 [ 40.355119][ T4217] kasan_report_invalid_free+0xc4/0x114 [ 40.356351][ T4217] __kasan_kfree_large+0xa4/0xc0 [ 40.357425][ T4217] free_large_kmalloc+0x70/0x15c [ 40.358504][ T4217] kfree+0x10c/0x1b8 [ 40.359313][ T4217] kvfree+0x40/0x50 [ 40.360128][ T4217] ext4_expand_extra_isize_ea+0xcbc/0x1688 [ 40.361408][ T4217] __ext4_expand_extra_isize+0x290/0x348 [ 40.362618][ T4217] __ext4_mark_inode_dirty+0x484/0x8fc [ 40.363815][ T4217] __ext4_unlink+0x758/0x988 [ 40.364729][ T4217] ext4_unlink+0x1d8/0x7d0 [ 40.365642][ T4217] vfs_unlink+0x2f0/0x508 [ 40.366528][ T4217] do_unlinkat+0x4c8/0x82c [ 40.367474][ T4217] __arm64_sys_unlinkat+0xcc/0xfc [ 40.368547][ T4217] invoke_syscall+0x98/0x2c0 [ 40.369587][ T4217] el0_svc_common+0x138/0x258 [ 40.370590][ T4217] do_el0_svc+0x64/0x218 [ 40.371469][ T4217] el0_svc+0x58/0x168 [ 40.372320][ T4217] el0t_64_sync_handler+0x84/0xf0 [ 40.373325][ T4217] el0t_64_sync+0x18c/0x190 [ 40.374305][ T4217] [ 40.374755][ T4217] The buggy address belongs to the physical page: [ 40.376121][ T4217] page:000000009404f30f refcount:3 mapcount:0 mapping:00000000793fb8c4 index:0x1 pfn:0x1f2e27 [ 40.378235][ T4217] memcg:ffff0000c0930000 [ 40.379148][ T4217] aops:def_blk_aops ino:700000 [ 40.380079][ T4217] flags: 0x5ffc6000002204e(referenced|uptodate|dirty|workingset|private|mappedtodisk|node=0|zone=2|lastcpupid=0x7ff) [ 40.382524][ T4217] raw: 05ffc6000002204e 0000000000000000 dead000000000122 ffff0000c054bf10 [ 40.384350][ T4217] raw: 0000000000000001 ffff0000e24443a0 00000003ffffffff ffff0000c0930000 [ 40.386012][ T4217] page dumped because: kasan: bad access detected [ 40.387405][ T4217] [ 40.387893][ T4217] Memory state around the buggy address: [ 40.389167][ T4217] ffff0001b2e27480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.390844][ T4217] ffff0001b2e27500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.392635][ T4217] >ffff0001b2e27580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.394318][ T4217] ^ [ 40.395294][ T4217] ffff0001b2e27600: 00 00 00 00