EXT4-fs error (device loop3): ext4_validate_block_bitmap:418: comm vhost-2628: bg 0: block 255: padding at end of block bitmap is not set
------------[ cut here ]------------
kernel BUG at fs/ext4/indirect.c:532!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2629 Comm: vhost-2628 Not tainted 5.4.290-syzkaller-00002-g41adfeb3d639 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:ext4_ind_map_blocks+0x2c6c/0x2e90 fs/ext4/indirect.c:532
Code: 00 74 08 4c 89 ff e8 13 09 cf ff 49 83 7c 24 18 00 0f 84 57 01 00 00 e8 d2 1e 9f ff 49 83 c4 18 e9 69 ff ff ff e8 c4 1e 9f ff <0f> 0b e8 bd 1e 9f ff 0f 0b e8 c6 c1 75 ff 65 44 8b 35 e6 04 3d 7e
RSP: 0018:ffff8881e97eeee0 EFLAGS: 00010287
RAX: ffffffff81c52c3c RBX: 0000000000080000 RCX: 0000000000100000
RDX: ffffc90007555000 RSI: 0000000000000469 RDI: 000000000000046a
RBP: ffff8881e97ef1d0 R08: ffffffff81c50198 R09: ffffed10390820b0
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103d2fde00
R13: ffff8881e97ef3c8 R14: 0000008c00080000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2576990d58 CR3: 00000001e9868000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ext4_map_blocks+0x9d6/0x1ba0 fs/ext4/inode.c:663
 _ext4_get_block+0x21b/0x610 fs/ext4/inode.c:802
 __block_write_begin_int+0x5bc/0x1630 fs/buffer.c:1980
 __block_write_begin fs/buffer.c:2030 [inline]
 block_page_mkwrite+0x1f2/0x260 fs/buffer.c:2492
 ext4_page_mkwrite+0xbda/0x1350 fs/ext4/inode.c:6485
 do_page_mkwrite mm/memory.c:2364 [inline]
 wp_page_shared+0x3f7/0x6b0 mm/memory.c:2691
 handle_pte_fault mm/memory.c:4075 [inline]
 __handle_mm_fault mm/memory.c:4183 [inline]
 handle_mm_fault+0x1888/0x4920 mm/memory.c:4220
 do_user_addr_fault arch/x86/mm/fault.c:1444 [inline]
 __do_page_fault+0x509/0xbb0 arch/x86/mm/fault.c:1505
 page_fault+0x2f/0x40 arch/x86/entry/entry_64.S:1206
RIP: 0010:vhost_put_used_flags drivers/vhost/vhost.c:943 [inline]
RIP: 0010:vhost_update_used_flags+0x124/0x3c0 drivers/vhost/vhost.c:1984
Code: 41 0f b7 ac 24 f6 00 00 00 49 8d 5c 24 40 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 72 d5 42 fe 48 8b 03 0f 01 cb <66> 89 28 e8 34 eb 12 fe 31 db 0f 01 ca e9 f0 00 00 00 e8 25 eb 12
RSP: 0018:ffff8881e97efb90 EFLAGS: 00050246
RAX: 0000200000000600 RBX: ffff8881e00100f8 RCX: 0000000000100000
RDX: ffffc90007555000 RSI: 000000000000038d RDI: ffff8881e00101ae
RBP: 0000000000000000 R08: ffffffff8351a7a9 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881e00100b8
R13: dffffc0000000000 R14: ffff8881e00101ae R15: 1ffff1103d2fdf9c
 vhost_enable_notify+0xb6/0x8e0 drivers/vhost/vhost.c:2554
 vhost_transport_do_send_pkt+0xdd5/0x1020 drivers/vhost/vsock.c:111
 vhost_worker+0x2ef/0x4c0 drivers/vhost/vhost.c:362
 kthread+0x2da/0x360 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Modules linked in:
---[ end trace b5013ddeb659af53 ]---
RIP: 0010:ext4_ind_map_blocks+0x2c6c/0x2e90 fs/ext4/indirect.c:532
Code: 00 74 08 4c 89 ff e8 13 09 cf ff 49 83 7c 24 18 00 0f 84 57 01 00 00 e8 d2 1e 9f ff 49 83 c4 18 e9 69 ff ff ff e8 c4 1e 9f ff <0f> 0b e8 bd 1e 9f ff 0f 0b e8 c6 c1 75 ff 65 44 8b 35 e6 04 3d 7e
RSP: 0018:ffff8881e97eeee0 EFLAGS: 00010287
RAX: ffffffff81c52c3c RBX: 0000000000080000 RCX: 0000000000100000
RDX: ffffc90007555000 RSI: 0000000000000469 RDI: 000000000000046a
RBP: ffff8881e97ef1d0 R08: ffffffff81c50198 R09: ffffed10390820b0
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103d2fde00
R13: ffff8881e97ef3c8 R14: 0000008c00080000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2576990d58 CR3: 00000001e9868000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	41 0f b7 ac 24 f6 00 	movzwl 0xf6(%r12),%ebp
   7:	00 00
   9:	49 8d 5c 24 40       	lea    0x40(%r12),%rbx
   e:	48 89 d8             	mov    %rbx,%rax
  11:	48 c1 e8 03          	shr    $0x3,%rax
  15:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  1a:	74 08                	je     0x24
  1c:	48 89 df             	mov    %rbx,%rdi
  1f:	e8 72 d5 42 fe       	call   0xfe42d596
  24:	48 8b 03             	mov    (%rbx),%rax
  27:	0f 01 cb             	stac
* 2a:	66 89 28             	mov    %bp,(%rax) <-- trapping instruction
  2d:	e8 34 eb 12 fe       	call   0xfe12eb66
  32:	31 db                	xor    %ebx,%ebx
  34:	0f 01 ca             	clac
  37:	e9 f0 00 00 00       	jmp    0x12c
  3c:	e8                   	.byte 0xe8
  3d:	25                   	.byte 0x25
  3e:	eb 12                	jmp    0x52