EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
==================================================================
BUG: KASAN: slab-out-of-bounds in __ext4_iget+0x254/0x31ac fs/ext4/inode.c:4652
Read of size 8 at addr ffff0000de2aff40 by task syz.2.1702/9698

CPU: 1 PID: 9698 Comm: syz.2.1702 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x174/0x1e4 mm/kasan/report.c:451
 __asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
 __ext4_iget+0x254/0x31ac fs/ext4/inode.c:4652
 ext4_fill_super+0x690c/0x8768 fs/ext4/super.c:4841
 mount_bdev+0x274/0x370 fs/super.c:1400
 ext4_mount+0x44/0x58 fs/ext4/super.c:6603
 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
 vfs_get_tree+0x90/0x274 fs/super.c:1530
 do_new_mount+0x278/0x8fc fs/namespace.c:3012
 path_mount+0x594/0x101c fs/namespace.c:3342
 do_mount fs/namespace.c:3355 [inline]
 __do_sys_mount fs/namespace.c:3563 [inline]
 __se_sys_mount fs/namespace.c:3540 [inline]
 __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3540
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Allocated by task 9313:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
 xas_alloc lib/xarray.c:374 [inline]
 xas_create+0xe70/0x1354 lib/xarray.c:676
 xas_create_range+0x1a0/0x6d0 lib/xarray.c:716
 shmem_add_to_page_cache+0x9f0/0x16a0 mm/shmem.c:735
 shmem_getpage_gfp+0x1398/0x20e4 mm/shmem.c:1940
 shmem_fault+0x194/0x560 mm/shmem.c:2118
 __do_fault+0x120/0x5d0 mm/memory.c:3926
 do_read_fault mm/memory.c:4262 [inline]
 do_fault mm/memory.c:4390 [inline]
 handle_pte_fault mm/memory.c:4648 [inline]
 __handle_mm_fault mm/memory.c:4783 [inline]
 handle_mm_fault+0x21e8/0x33a8 mm/memory.c:4881
 faultin_page mm/gup.c:976 [inline]
 __get_user_pages+0x39c/0x92c mm/gup.c:1197
 populate_vma_page_range+0x200/0x290 mm/gup.c:1529
 __mm_populate+0x278/0x41c mm/gup.c:1638
 mm_populate include/linux/mm.h:2632 [inline]
 vm_mmap_pgoff+0x1fc/0x2b4 mm/util.c:556
 ksys_mmap_pgoff+0x11c/0x668 mm/mmap.c:1623
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Last potentially related work creation:
 kasan_save_stack+0x38/0x68 mm/kasan/common.c:38
 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3007 [inline]
 call_rcu+0x118/0xb40 kernel/rcu/tree.c:3087
 xa_node_free lib/xarray.c:258 [inline]
 xas_delete_node lib/xarray.c:494 [inline]
 update_node lib/xarray.c:758 [inline]
 xas_store+0xcc0/0x1654 lib/xarray.c:843
 page_cache_delete mm/filemap.c:142 [inline]
 __delete_from_page_cache+0x4f8/0x6d4 mm/filemap.c:232
 delete_from_page_cache+0x108/0x17c mm/filemap.c:266
 truncate_inode_page+0x98/0xc8 mm/truncate.c:219
 shmem_undo_range+0x448/0x1460 mm/shmem.c:960
 shmem_truncate_range mm/shmem.c:1063 [inline]
 shmem_evict_inode+0x1c4/0x844 mm/shmem.c:1145
 evict+0x418/0x894 fs/inode.c:622
 iput_final fs/inode.c:1744 [inline]
 iput+0x744/0x824 fs/inode.c:1770
 dentry_unlink_inode+0x37c/0x4bc fs/dcache.c:380
 __dentry_kill+0x324/0x5e4 fs/dcache.c:586
 dentry_kill+0xc8/0x250
 dput+0x21c/0x458 fs/dcache.c:893
 __fput+0x494/0x800 fs/file_table.c:288
 ____fput+0x20/0x30 fs/file_table.c:308
 task_work_run+0x130/0x1e4 kernel/task_work.c:188
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0x670/0x20bc kernel/exit.c:874
 do_group_exit+0x110/0x268 kernel/exit.c:996
 get_signal+0x634/0x1550 kernel/signal.c:2900
 do_signal arch/arm64/kernel/signal.c:890 [inline]
 do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Second to last potentially related work creation:
 kasan_save_stack+0x38/0x68 mm/kasan/common.c:38
 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3007 [inline]
 call_rcu+0x118/0xb40 kernel/rcu/tree.c:3087
 xa_node_free lib/xarray.c:258 [inline]
 xas_delete_node lib/xarray.c:494 [inline]
 update_node lib/xarray.c:758 [inline]
 xas_store+0xcc0/0x1654 lib/xarray.c:843
 page_cache_delete mm/filemap.c:142 [inline]
 __delete_from_page_cache+0x4f8/0x6d4 mm/filemap.c:232
 delete_from_page_cache+0x108/0x17c mm/filemap.c:266
 truncate_inode_page+0x98/0xc8 mm/truncate.c:219
 shmem_undo_range+0x448/0x1460 mm/shmem.c:960
 shmem_truncate_range mm/shmem.c:1063 [inline]
 shmem_evict_inode+0x1c4/0x844 mm/shmem.c:1145
 evict+0x418/0x894 fs/inode.c:622
 iput_final fs/inode.c:1744 [inline]
 iput+0x744/0x824 fs/inode.c:1770
 dentry_unlink_inode+0x37c/0x4bc fs/dcache.c:380
 __dentry_kill+0x324/0x5e4 fs/dcache.c:586
 dentry_kill+0xc8/0x250
 dput+0x21c/0x458 fs/dcache.c:893
 __fput+0x494/0x800 fs/file_table.c:288
 ____fput+0x20/0x30 fs/file_table.c:308
 task_work_run+0x130/0x1e4 kernel/task_work.c:188
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0x670/0x20bc kernel/exit.c:874
 do_group_exit+0x110/0x268 kernel/exit.c:996
 get_signal+0x634/0x1550 kernel/signal.c:2900
 do_signal arch/arm64/kernel/signal.c:890 [inline]
 do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

The buggy address belongs to the object at ffff0000de2afc80
 which belongs to the cache radix_tree_node of size 576
The buggy address is located 128 bytes to the right of
 576-byte region [ffff0000de2afc80, ffff0000de2afec0)
The buggy address belongs to the page:
page:000000002f3e14de refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000de2af9c0 pfn:0x11e2ac
head:000000002f3e14de order:2 compound_mapcount:0 compound_pincount:0
memcg:ffff0000cec19a01
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0003b67808 fffffc0003a58508 ffff0000c000d500
raw: ffff0000de2af9c0 000000000017000b 00000001ffffffff ffff0000cec19a01
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000de2afe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000de2afe80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff0000de2aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff0000de2aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000de2b0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
EXT4-fs (loop2): 1 truncate cleaned up
EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,resuid=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,resgid=0x0000000000000000,nombcache,quota,. Quota mode: writeback.