program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000240)={[{@block_validity}, {}, {@sysvgroups}, {@inode_readahead_blks}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@nolazytime}, {@nogrpid}, {@jqfmt_vfsv1}, {@norecovery}]}, 0x3, 0x58c, &(0x7f0000000ac0)="$eJzs3c9rHFUcAPDvbH70pzaFUtSDBIpYqd00iT8qCK1H0WJB73VJpqFk0y3ZTWlise3BXrxIEUQsiH9A7x6LB6/+FQUtFClBD4JEZjObbpvdZJtuzbb7+cC0782bzZvvvHlv3+zsMgH0rdHsn0LEyxHxTRKxr6lsMPLC0dXtlu9fnsqWJFZWPv0ziSRf19g+yf/fk2deiohfvoo4Ulhfb3VxabZULqfzeX6sNndhrLq4dPTcXGkmnUnPT0xOHn97cuK9d9/pWqxvnP77+09uf3j860PL3926u/9GEidjb17WHMcTuNqcGY3R/JgMxclHNhzvQmW9JNnuHWBLBvJ+PhTZGLAvBvJeDzz/rkTECtCnEv0f+lRjHtC4tu/SdfAz494HqxdAD8d/tb6y/tlI7KxfG+1eTh66Msqud0e6UH9Wx89/3LyRLbHJ5xBXulAfQMPVaxFxbHBw/fif5OPf1h2rf3i8sUfr6Lf3H9hOt7P5z5ut5n+FtflPtJj/7GnRd7di8/5fuNuFatrK5n/vt5z/rg1dIwN57oX6nG8oOXuunB6LiBcj4nAM7cjyG93POb58Z6VdWfP8L1uy+htzwXw/7g7uePg106Va6UlibnbvWsQrD+a/Sdy/PLxakqy1f9Ki/bPjcbrDOg6mN19tV7Z5/M131bo/A175KeL1lu3/4I5WsvH9ybH6+TDWOCvW++v6wd/a1d9R/BEx3J1w18naf/fG8Y8kzfdrq49fx487/0nblW31/B9OPqunG8flUqlWmx+PGE4+Xr9+4sFrG/nG9ln8hw9tPP792uL83xURn3cY//UD19dtemtvp/E/XVn804/V/o+fuPPRFz+0qf61Lztq/7fqqcP5mk7Gv0538IkOHgAAAAAAAPSYQkTsjaRQXEsXCsXi6vc7DsTuQrlSrR05W1k4Px3138qOxFChcad7X9P3Icbz78M28hOP5CcjYn9EfDuwq54vTlXK09sdPAAAAAAAAAAAAAAAAAAAAPSIPW1+/5/5fWC79w546jzyG/rXpv2/G096AnqS93/oX/o/9C/9H/pX2/7f9rHFwPPC+z/0L/0f+pf+D/1L/wcAAAAAAAAAAAAAAAAAAAAAAAAAAICuOn3qVLasLN+/PJXlpy8uLsxWLh6dTquzxbmFqeJUZf5CcaZSmSmnxanK3GZ/r1ypXBifiIVLY7W0WhurLi6dmassnK+dOTdXmknPpEP/S1QAAAAAAAAAAAAAAAAAAADwbKkuLs2WyuV0XqJt4kT0xG5sOZFs1son8pNhS1UMbn+A6fy/vXCcn6/ENg9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANDkvwAAAP//33g3+g==")
setxattr$security_ima(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000180), &(0x7f0000000300)=@v2={0x5, 0x0, 0x12, 0x401, 0xe1, "aea0e787abd8ae0afaf1630412f3e83961ea458069308c63c1dded827234c4a72fc748d79352466812ec89aacbeaed6d9cb0beba02c6e39ffc5a0a67f4c67a2dc9a0396584d1a64be1c770ee3518301e44e35f775ba79a14c91efb7b445872920d43d2a4606201218bad8194379088990a0fb147009e174e8f6c7109e3980dd4b53f2944cbbe24031dc999a4f4b08b12c7f8625cbda35e53520697c6394aad2e8d38f47fb60762901eddde81c4f744a45e356cc31fc9ac391dac8cd3219bc947180bb9ad0e56460588f2ff7e30cf0c4eb39e5f1678205d5688654c9415238e11d2"}, 0xea, 0x1)
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'bridge_slave_0\x00'}}, 0x1e)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x101000, 0x8)
[ 94.254140][ T5280] Bluetooth: hci0: command tx timeout
[ 94.437939][ T5317] loop0: detected capacity change from 0 to 1024
[ 94.610112][ T5317] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 94.617599][ T5317] ==================================================================
[ 94.617612][ T5317] BUG: KASAN: use-after-free in ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.617839][ T5317] Write of size 234 at addr ffff888053917fb8 by task syz.0.0/5317
[ 94.617849][ T5317]
[ 94.617856][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.617869][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.617876][ T5317] Call Trace:
[ 94.617889][ T5317]
[ 94.617905][ T5317] dump_stack_lvl+0xe8/0x150
[ 94.617948][ T5317] print_address_description+0x55/0x1e0
[ 94.617963][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.617977][ T5317] print_report+0x58/0x70
[ 94.617990][ T5317] kasan_report+0x117/0x150
[ 94.618004][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.618020][ T5317] kasan_check_range+0x264/0x2c0
[ 94.618034][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.618051][ T5317] __asan_memcpy+0x40/0x70
[ 94.618062][ T5317] ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.618084][ T5317] ext4_xattr_ibody_set+0x262/0x710
[ 94.618101][ T5317] ext4_xattr_set_handle+0xd86/0x15f0
[ 94.618123][ T5317] ? __pfx_ext4_xattr_set_handle+0x10/0x10
[ 94.618143][ T5317] ? ext4_xattr_set_credits+0x163/0x310
[ 94.618155][ T5317] ext4_xattr_set+0x257/0x340
[ 94.618168][ T5317] ? __pfx_ext4_xattr_set+0x10/0x10
[ 94.618179][ T5317] ? ima_get_hash_algo+0x1d4/0x4a0
[ 94.618226][ T5317] ? __pfx_evm_protect_xattr+0x10/0x10
[ 94.618238][ T5317] ? __pfx_ext4_xattr_security_set+0x10/0x10
[ 94.618253][ T5317] __vfs_setxattr+0x442/0x480
[ 94.618271][ T5317] __vfs_setxattr_noperm+0x12a/0x660
[ 94.618290][ T5317] vfs_setxattr+0x163/0x360
[ 94.618334][ T5317] ? __pfx_vfs_setxattr+0x10/0x10
[ 94.618355][ T5317] filename_setxattr+0x296/0x630
[ 94.618375][ T5317] ? __pfx_filename_setxattr+0x10/0x10
[ 94.618390][ T5317] ? do_getname+0x151/0x250
[ 94.618405][ T5317] path_setxattrat+0x408/0x450
[ 94.618421][ T5317] ? __pfx_path_setxattrat+0x10/0x10
[ 94.618440][ T5317] ? do_futex+0x458/0x4e0
[ 94.618484][ T5317] ? rcu_is_watching+0x16/0xb0
[ 94.618504][ T5317] __x64_sys_setxattr+0xbc/0xe0
[ 94.618519][ T5317] do_syscall_64+0x166/0x520
[ 94.618601][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.618615][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.618629][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.618644][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.618656][ T5317] RIP: 0033:0x7fe23339e1d9
[ 94.618676][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.618687][ T5317] RSP: 002b:00007fe23419ffe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[ 94.618707][ T5317] RAX: ffffffffffffffda RBX: 00007fe233625fa0 RCX: 00007fe23339e1d9
[ 94.618715][ T5317] RDX: 0000200000000300 RSI: 0000200000000180 RDI: 0000200000000100
[ 94.618723][ T5317] RBP: 00007fe233435888 R08: 0000000000000001 R09: 0000000000000000
[ 94.618732][ T5317] R10: 00000000000000ea R11: 0000000000000246 R12: 0000000000000000
[ 94.618740][ T5317] R13: 00007fe233626038 R14: 00007fe233625fa0 R15: 00007fff5a3de0e8
[ 94.618753][ T5317]
[ 94.618758][ T5317]
[ 94.618763][ T5317] The buggy address belongs to the physical page:
[ 94.618769][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x559020243 pfn:0x53917
[ 94.618781][ T5317] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.618799][ T5317] raw: 04fff00000000000 ffffea00014e6e48 ffffea00014e5b08 0000000000000000
[ 94.618808][ T5317] raw: 0000000559020243 0000000000000000 00000000ffffffff 0000000000000000
[ 94.618813][ T5317] page dumped because: kasan: bad access detected
[ 94.618819][ T5317] page_owner tracks the page as freed
[ 94.618825][ T5317] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 4988, tgid 4988 (dhcpcd), ts 94450135385
[ 94.618842][ T5317] post_alloc_hook+0x1f9/0x250
[ 94.618861][ T5317] get_page_from_freelist+0x2209/0x2280
[ 94.618872][ T5317] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.618884][ T5317] alloc_pages_mpol+0x21e/0x390
[ 94.618897][ T5317] folio_alloc_mpol_noprof+0x39/0x160
[ 94.618908][ T5317] vma_alloc_folio_noprof+0xe1/0x1e0
[ 94.618922][ T5317] do_wp_page+0x117d/0x4b80
[ 94.618935][ T5317] handle_mm_fault+0x15d7/0x3750
[ 94.618946][ T5317] do_user_addr_fault+0xa4f/0x1340
[ 94.618960][ T5317] exc_page_fault+0x6a/0xc0
[ 94.618969][ T5317] asm_exc_page_fault+0x26/0x30
[ 94.618978][ T5317] page last free pid 5320 tgid 5320 ts 94547647641 stack trace:
[ 94.618988][ T5317] free_unref_folios+0xdc2/0x14e0
[ 94.619002][ T5317] folios_put_refs+0x9e9/0xb30
[ 94.619019][ T5317] free_pages_and_swap_cache+0x2ba/0x490
[ 94.619033][ T5317] tlb_flush_mmu+0x6d3/0xa30
[ 94.619042][ T5317] tlb_finish_mmu+0xf4/0x220
[ 94.619053][ T5317] exit_mmap+0x4b2/0x9f0
[ 94.619066][ T5317] __mmput+0x118/0x420
[ 94.619079][ T5317] exit_mm+0x18e/0x240
[ 94.619088][ T5317] do_exit+0x6cd/0x2360
[ 94.619097][ T5317] do_group_exit+0x22d/0x2f0
[ 94.619106][ T5317] __x64_sys_exit_group+0x3f/0x40
[ 94.619119][ T5317] x64_sys_call+0x18c6/0x18d0
[ 94.619128][ T5317] do_syscall_64+0x166/0x520
[ 94.619137][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.619149][ T5317]
[ 94.619152][ T5317] Memory state around the buggy address:
[ 94.619158][ T5317] ffff888053917e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.619164][ T5317] ffff888053917f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.619172][ T5317] >ffff888053917f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.619178][ T5317] ^
[ 94.619184][ T5317] ffff888053918000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.619191][ T5317] ffff888053918080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.619196][ T5317] ==================================================================
[ 94.619252][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.871850][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.875389][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.879511][ T5317] Call Trace:
[ 94.880862][ T5317]
[ 94.882136][ T5317] vpanic+0x56d/0xa60
[ 94.883867][ T5317] ? __pfx_vpanic+0x10/0x10
[ 94.885749][ T5317] panic+0xc5/0xd0
[ 94.887212][ T5317] ? __pfx_panic+0x10/0x10
[ 94.889068][ T5317] ? preempt_schedule_thunk+0x16/0x40
[ 94.891307][ T5317] ? preempt_schedule_thunk+0x16/0x40
[ 94.893606][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.896033][ T5317] check_panic_on_warn+0x89/0xb0
[ 94.898028][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.900463][ T5317] end_report+0x73/0x170
[ 94.902374][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.904808][ T5317] kasan_report+0x128/0x150
[ 94.906840][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.909243][ T5317] kasan_check_range+0x264/0x2c0
[ 94.911421][ T5317] ? ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.913818][ T5317] __asan_memcpy+0x40/0x70
[ 94.915907][ T5317] ext4_xattr_set_entry+0xdc9/0x1ed0
[ 94.918382][ T5317] ext4_xattr_ibody_set+0x262/0x710
[ 94.920741][ T5317] ext4_xattr_set_handle+0xd86/0x15f0
[ 94.922762][ T5317] ? __pfx_ext4_xattr_set_handle+0x10/0x10
[ 94.924818][ T5317] ? ext4_xattr_set_credits+0x163/0x310
[ 94.926815][ T5317] ext4_xattr_set+0x257/0x340
[ 94.928543][ T5317] ? __pfx_ext4_xattr_set+0x10/0x10
[ 94.930440][ T5317] ? ima_get_hash_algo+0x1d4/0x4a0
[ 94.932313][ T5317] ? __pfx_evm_protect_xattr+0x10/0x10
[ 94.934356][ T5317] ? __pfx_ext4_xattr_security_set+0x10/0x10
[ 94.936588][ T5317] __vfs_setxattr+0x442/0x480
[ 94.938401][ T5317] __vfs_setxattr_noperm+0x12a/0x660
[ 94.940375][ T5317] vfs_setxattr+0x163/0x360
[ 94.942045][ T5317] ? __pfx_vfs_setxattr+0x10/0x10
[ 94.943849][ T5317] filename_setxattr+0x296/0x630
[ 94.945642][ T5317] ? __pfx_filename_setxattr+0x10/0x10
[ 94.947573][ T5317] ? do_getname+0x151/0x250
[ 94.949228][ T5317] path_setxattrat+0x408/0x450
[ 94.951013][ T5317] ? __pfx_path_setxattrat+0x10/0x10
[ 94.953027][ T5317] ? do_futex+0x458/0x4e0
[ 94.954650][ T5317] ? rcu_is_watching+0x16/0xb0
[ 94.956550][ T5317] __x64_sys_setxattr+0xbc/0xe0
[ 94.958491][ T5317] do_syscall_64+0x166/0x520
[ 94.960341][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.962367][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.964821][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.966702][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.969027][ T5317] RIP: 0033:0x7fe23339e1d9
[ 94.970844][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.978476][ T5317] RSP: 002b:00007fe23419ffe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[ 94.981805][ T5317] RAX: ffffffffffffffda RBX: 00007fe233625fa0 RCX: 00007fe23339e1d9
[ 94.984863][ T5317] RDX: 0000200000000300 RSI: 0000200000000180 RDI: 0000200000000100
[ 94.987972][ T5317] RBP: 00007fe233435888 R08: 0000000000000001 R09: 0000000000000000
[ 94.991431][ T5317] R10: 00000000000000ea R11: 0000000000000246 R12: 0000000000000000
[ 94.994710][ T5317] R13: 00007fe233626038 R14: 00007fe233625fa0 R15: 00007fff5a3de0e8
[ 94.997806][ T5317]
[ 94.999530][ T5317] Kernel Offset: disabled
[ 95.001455][ T5317] Rebooting in 86400 seconds..