EXT4-fs (sda1): Remounting file system with no journal so ignoring journalled data option EXT4-fs (sda1): Unrecognized mount option "#¼" or missing value ================================================================== BUG: KASAN: use-after-free in memset include/linux/string.h:332 [inline] BUG: KASAN: use-after-free in __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832 Write of size 2147483615 at addr ffff8881d1eb71a0 by task rs:main Q:Reg/1626 CPU: 1 PID: 1626 Comm: rs:main Q:Reg Not tainted 4.14.152+ #0 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xca/0x134 lib/dump_stack.c:53 print_address_description+0x60/0x226 mm/kasan/report.c:187 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316 memset+0x20/0x40 mm/kasan/common.c:113 memset include/linux/string.h:332 [inline] __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5884 [inline] ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5960 BUG: unable to handle kernel NULL pointer dereference ext4_dirty_inode+0x6c/0x90 fs/ext4/inode.c:5994 at (null) IP: (null) __mark_inode_dirty+0x69c/0x1080 fs/fs-writeback.c:2141 PGD 1c6b1a067 P4D 1c6b1a067 mark_inode_dirty include/linux/fs.h:2050 [inline] generic_write_end+0x19a/0x250 fs/buffer.c:2218 PUD 1c7337067 ext4_da_write_end+0x25b/0xc40 fs/ext4/inode.c:3214 PMD 0 generic_perform_write+0x281/0x460 mm/filemap.c:3143 Thread overran stack, or stack corrupted Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI Modules linked in: __generic_file_write_iter+0x32e/0x550 mm/filemap.c:3257 CPU: 0 PID: 13406 Comm: syz-executor.4 Not tainted 4.14.152+ #0 ext4_file_write_iter+0x58f/0xdb0 fs/ext4/file.c:268 task: 00000000f8395f5e task.stack: 0000000079189523 RIP: 0010: (null) RSP: 0018:ffff88819a9afb88 EFLAGS: 00010087 call_write_iter include/linux/fs.h:1798 [inline] new_sync_write fs/read_write.c:471 [inline] __vfs_write+0x401/0x5a0 fs/read_write.c:484 RAX: ffff8881d2011780 RBX: 0000000000000000 RCX: 1ffffffff7907401 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffbce30940 RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff79c6129 R10: fffffbfff79c6128 R11: 0000000000000003 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000000000108c940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 vfs_write+0x17f/0x4d0 fs/read_write.c:546 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 SYSC_write fs/read_write.c:594 [inline] SyS_write+0x102/0x250 fs/read_write.c:586 CR2: 0000000000000000 CR3: 00000001c8a40005 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292 Code: entry_SYSCALL_64_after_hwframe+0x42/0xb7 Bad RIP value. RIP: 0033:0x7f0113f3619d RSP: 002b:00007f01124d7000 EFLAGS: 00000293 RIP: (null) RSP: ffff88819a9afb88 CR2: 0000000000000000 ORIG_RAX: 0000000000000001 ---[ end trace b44e4068f8a8517b ]--- RAX: ffffffffffffffda RBX: 00000000000000fc RCX: 00007f0113f3619d