EXT4-fs (sda1): re-mounted. Opts: nobh,debug_want_extra_isize=0x0000000055ba7580,resuid=0x0000000000000000,noauto_da_alloc,,errors=continue EXT4-fs error (device sda1): ext4_xattr_set_entry:1603: inode #16532: comm syz-executor5: corrupted xattr entries ================================================================== BUG: KASAN: slab-out-of-bounds in memset include/linux/string.h:330 [inline] BUG: KASAN: slab-out-of-bounds in __ext4_expand_extra_isize+0x178/0x240 fs/ext4/inode.c:5865 Write of size 1438283104 at addr ffff8801ac2177a0 by task syz-executor0/5417 CPU: 0 PID: 5417 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #39 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 BUG: unable to handle kernel paging request at ffffed0044000000 PGD 21ffef067 P4D 21ffef067 PUD 21ffed067 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 PMD 0 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 Oops: 0000 [#1] PREEMPT SMP KASAN check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 CPU: 1 PID: 5286 Comm: rs:main Q:Reg Not tainted 4.19.0-rc6+ #39 memset+0x23/0x40 mm/kasan/kasan.c:285 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 memset include/linux/string.h:330 [inline] __ext4_expand_extra_isize+0x178/0x240 fs/ext4/inode.c:5865 RIP: 0010:memory_is_nonzero mm/kasan/kasan.c:195 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:210 [inline] RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline] RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline] RIP: 0010:check_memory_region+0x9e/0x1b0 mm/kasan/kasan.c:267 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5917 [inline] ext4_mark_inode_dirty+0x902/0xb30 fs/ext4/inode.c:5993 Code: c8 49 c1 f9 03 45 85 c9 0f 84 23 01 00 00 48 83 38 00 75 1c 45 8d 41 ff 4a 8d 5c c0 08 48 83 c0 08 48 39 c3 0f 84 a8 00 00 00 <48> 83 38 00 74 ed 4c 8d 40 08 eb 09 48 83 c0 01 49 39 c0 74 0a 80 RSP: 0018:ffff8801c051ef98 EFLAGS: 00010206 RAX: ffffed0044000000 RBX: ffffed004dc37aa0 RCX: ffffffff8216f8d8 RDX: 0000000000000001 RSI: 0000000055ba7560 RDI: ffff880218615fa0 RBP: ffff8801c051efb0 R08: 000000000156e9d4 R09: 000000000156e9d5 R10: ffffed004dc37a9f R11: ffff88026e1bd4ff R12: ffffed004dc37aa0 R13: 0000000000000004 R14: ffff880218615fa0 R15: 0000000055ba7580 ext4_unlink+0x788/0x1220 fs/ext4/namei.c:3037 FS: 00007f7b59690700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed0044000000 CR3: 00000001bdadd000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 000000000000f000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: memset+0x23/0x40 mm/kasan/kasan.c:285 memset include/linux/string.h:330 [inline] __ext4_expand_extra_isize+0x178/0x240 fs/ext4/inode.c:5865 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5917 [inline] ext4_mark_inode_dirty+0x902/0xb30 fs/ext4/inode.c:5993 vfs_unlink+0x2db/0x510 fs/namei.c:4000 do_unlinkat+0x6cc/0xa30 fs/namei.c:4063 ext4_dirty_inode+0x97/0xc0 fs/ext4/inode.c:6027 __mark_inode_dirty+0x7c3/0x1510 fs/fs-writeback.c:2129 __do_sys_unlink fs/namei.c:4110 [inline] __se_sys_unlink fs/namei.c:4108 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4108 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe mark_inode_dirty include/linux/fs.h:2068 [inline] __generic_write_end+0x320/0x400 fs/buffer.c:2117 RIP: 0033:0x4572c7 Code: 0f 1f 00 b8 58 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 bd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 9d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffecf7026c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004572c7 generic_write_end+0x6c/0x90 fs/buffer.c:2162 RDX: 00007ffecf7026e0 RSI: 00007ffecf7026e0 RDI: 00007ffecf702770 ext4_da_write_end+0x2e0/0xcd0 fs/ext4/inode.c:3173 RBP: 00000000000022c7 R08: 0000000000000000 R09: 000000000000000d R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffecf703800 R13: 00000000013c0940 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the page: page:ffffea0006b085c0 count:2 mapcount:0 mapping:ffff8801d37e0c58 index:0x42b flags: 0x2fffc0000001064(referenced|lru|active|private) raw: 02fffc0000001064 ffffea0006ced588 ffffea0006a39d48 ffff8801d37e0c58 raw: 000000000000042b ffff8801b689f930 00000002ffffffff ffff8801c7f6a980 generic_perform_write+0x4ca/0x6a0 mm/filemap.c:3150 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8801c7f6a980 Memory state around the buggy address: ffff8801b2f75f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801b2f75f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8801b2f76000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc __generic_file_write_iter+0x26e/0x630 mm/filemap.c:3264 ^ ext4_file_write_iter+0x390/0x1420 fs/ext4/file.c:266 ffff8801b2f76080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8801b2f76100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ------------[ cut here ]------------ ODEBUG: deactivate not available (active state 0) object type: work_struct hint: wb_workfn+0x0/0x1790 fs/fs-writeback.c:1218 WARNING: CPU: 0 PID: 12431 at lib/debugobjects.c:329 debug_print_object+0x16a/0x210 lib/debugobjects.c:326