loop8: detected capacity change from 0 to 1024
EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none.
==================================================================
BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x7c0/0x15a0 fs/ext4/xattr.c:1730
Read of size 18446744073709551588 at addr ffff0000ce6c6040 by task syz.8.308/5734

CPU: 1 PID: 5734 Comm: syz.8.308 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memmove+0x48/0x90 mm/kasan/shadow.c:54
 ext4_xattr_set_entry+0x7c0/0x15a0 fs/ext4/xattr.c:1730
 ext4_xattr_block_set+0x640/0x2880 fs/ext4/xattr.c:1977
 ext4_xattr_set_handle+0xc68/0x1344 fs/ext4/xattr.c:2399
 ext4_xattr_set+0x1f4/0x2c0 fs/ext4/xattr.c:2501
 ext4_xattr_security_set+0x4c/0x64 fs/ext4/xattr_security.c:31
 __vfs_setxattr+0x384/0x3a0 fs/xattr.c:182
 __vfs_setxattr_noperm+0x120/0x564 fs/xattr.c:216
 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
 vfs_setxattr+0x158/0x2ac fs/xattr.c:309
 do_setxattr fs/xattr.c:594 [inline]
 setxattr+0x258/0x2d8 fs/xattr.c:617
 path_setxattr+0x130/0x260 fs/xattr.c:636
 __do_sys_setxattr fs/xattr.c:652 [inline]
 __se_sys_setxattr fs/xattr.c:648 [inline]
 __arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 5734:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc_node_track_caller+0xe0/0x16c mm/slab_common.c:956
 kmemdup+0x5c/0x98 mm/util.c:129
 kmemdup include/linux/fortify-string.h:585 [inline]
 ext4_xattr_block_set+0x574/0x2880 fs/ext4/xattr.c:1925
 ext4_xattr_set_handle+0xc68/0x1344 fs/ext4/xattr.c:2399
 ext4_xattr_set+0x1f4/0x2c0 fs/ext4/xattr.c:2501
 ext4_xattr_security_set+0x4c/0x64 fs/ext4/xattr_security.c:31
 __vfs_setxattr+0x384/0x3a0 fs/xattr.c:182
 __vfs_setxattr_noperm+0x120/0x564 fs/xattr.c:216
 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
 vfs_setxattr+0x158/0x2ac fs/xattr.c:309
 do_setxattr fs/xattr.c:594 [inline]
 setxattr+0x258/0x2d8 fs/xattr.c:617
 path_setxattr+0x130/0x260 fs/xattr.c:636
 __do_sys_setxattr fs/xattr.c:652 [inline]
 __se_sys_setxattr fs/xattr.c:648 [inline]
 __arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 insert_work+0x64/0x37c kernel/workqueue.c:1361
 __queue_work+0xcbc/0x1234 kernel/workqueue.c:1520
 queue_work_on+0xc0/0x164 kernel/workqueue.c:1548
 queue_work include/linux/workqueue.h:512 [inline]
 xlog_bio_end_io+0x84/0x98 fs/xfs/xfs_log.c:1842
 bio_endio+0x750/0x794 block/bio.c:1554
 req_bio_endio block/blk-mq.c:782 [inline]
 blk_update_request+0x49c/0xbec block/blk-mq.c:927
 blk_mq_end_request+0x54/0x88 block/blk-mq.c:1052
 blk_flush_complete_seq+0x4f4/0xa78 block/blk-flush.c:210
 flush_end_io+0x790/0xa4c block/blk-flush.c:268
 __blk_mq_end_request+0x358/0x438 block/blk-mq.c:1042
 blk_mq_end_request+0x68/0x88 block/blk-mq.c:1054
 lo_complete_rq+0x1ec/0x250 drivers/block/loop.c:365
 blk_complete_reqs block/blk-mq.c:1132 [inline]
 blk_done_softirq+0x11c/0x168 block/blk-mq.c:1137
 handle_softirqs+0x318/0xc60 kernel/softirq.c:596
 run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
 smpboot_thread_fn+0x4b0/0x964 kernel/smpboot.c:164
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

Second to last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 kvfree_call_rcu+0xb4/0x6e8 kernel/rcu/tree.c:3405
 neigh_destroy+0x458/0x650 net/core/neighbour.c:923
 neigh_release include/net/neighbour.h:448 [inline]
 neigh_cleanup_and_release+0x154/0x3b4 net/core/neighbour.c:104
 neigh_del net/core/neighbour.c:226 [inline]
 neigh_remove_one+0x318/0x420 net/core/neighbour.c:247
 neigh_forced_gc net/core/neighbour.c:280 [inline]
 neigh_alloc net/core/neighbour.c:486 [inline]
 ___neigh_create+0x450/0x2400 net/core/neighbour.c:649
 __neigh_create+0x44/0x58 net/core/neighbour.c:738
 ip6_finish_output2+0x1678/0x1840 net/ipv6/ip6_output.c:129
 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
 ip6_finish_output+0x594/0x92c net/ipv6/ip6_output.c:216
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
 dst_output include/net/dst.h:453 [inline]
 NF_HOOK+0x15c/0x444 include/linux/netfilter.h:302
 mld_sendpack+0x88c/0x10ec net/ipv6/mcast.c:1825
 mld_send_cr net/ipv6/mcast.c:2126 [inline]
 mld_ifc_work+0x768/0xa88 net/ipv6/mcast.c:2658
 process_one_work+0x7f8/0x13a4 kernel/workqueue.c:2292
 worker_thread+0x8c4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

The buggy address belongs to the object at ffff0000ce6c6000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 64 bytes inside of
 1024-byte region [ffff0000ce6c6000, ffff0000ce6c6400)

The buggy address belongs to the physical page:
page:000000007680462f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e6c0
head:000000007680462f order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002780
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000ce6c5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000ce6c5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000ce6c6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                           ^
 ffff0000ce6c6080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000ce6c6100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================