==================================================================
BUG: KASAN: slab-out-of-bounds in crc16+0x1ce/0x2a0 lib/crc16.c:58
Read of size 1 at addr ffff88810f17a0f8 by task syz-executor.0/16825

CPU: 0 PID: 16825 Comm: syz-executor.0 Not tainted 5.10.178-syzkaller-00127-g43c801dc3325 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:452
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
 crc16+0x1ce/0x2a0 lib/crc16.c:58
 ext4_group_desc_csum+0x90b/0xc40 fs/ext4/super.c:2835
 ext4_group_desc_csum_set+0x1d8/0x270 fs/ext4/super.c:2858
 ext4_mb_clear_bb fs/ext4/mballoc.c:5460 [inline]
 ext4_free_blocks+0x1a61/0x2990 fs/ext4/mballoc.c:5606
 ext4_remove_blocks fs/ext4/extents.c:2538 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2704 [inline]
 ext4_ext_remove_space+0x260f/0x4e10 fs/ext4/extents.c:2952
 ext4_ext_truncate+0x17f/0x200 fs/ext4/extents.c:4413
 ext4_truncate+0xb19/0x1220 fs/ext4/inode.c:4365
 ext4_evict_inode+0xf07/0x1730 fs/ext4/inode.c:290
 evict+0x2a3/0x6c0 fs/inode.c:577
 iput_final fs/inode.c:1655 [inline]
 iput+0x632/0x7e0 fs/inode.c:1681
 ext4_orphan_cleanup+0x9a3/0xd50 fs/ext4/super.c:3121
 ext4_fill_super+0x89a7/0x9280 fs/ext4/super.c:5073
 mount_bdev+0x261/0x370 fs/super.c:1420
 ext4_mount+0x34/0x40 fs/ext4/super.c:6614
 legacy_get_tree+0xf1/0x190 fs/fs_context.c:592
 vfs_get_tree+0x88/0x290 fs/super.c:1550
 do_new_mount+0x28b/0xac0 fs/namespace.c:2899
 path_mount+0x56f/0xcb0 fs/namespace.c:3229
 do_mount fs/namespace.c:3242 [inline]
 __do_sys_mount fs/namespace.c:3450 [inline]
 __se_sys_mount+0x2c4/0x3b0 fs/namespace.c:3427
 __x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fc0417b769a
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc040528f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000000004c8 RCX: 00007fc0417b769a
RDX: 0000000020000040 RSI: 0000000020000500 RDI: 00007fc040528fe0
RBP: 00007fc040529020 R08: 00007fc040529020 R09: 0000000002000000
R10: 0000000002000000 R11: 0000000000000202 R12: 0000000020000040
R13: 0000000020000500 R14: 00007fc040528fe0 R15: 0000000020000080

Allocated by task 16826:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:463
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960
 kmem_cache_alloc_node include/linux/slab.h:423 [inline]
 __alloc_skb+0x80/0x510 net/core/skbuff.c:199
 alloc_skb include/linux/skbuff.h:1125 [inline]
 alloc_skb_with_frags+0xa1/0x570 net/core/skbuff.c:5922
 sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2354
 unix_dgram_sendmsg+0x700/0x1f90 net/unix/af_unix.c:1740
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2357
 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2411
 __sys_sendmmsg+0x2c3/0x510 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2523
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

The buggy address belongs to the object at ffff88810f17a000
 which belongs to the cache skbuff_head_cache of size 248
The buggy address is located 0 bytes to the right of
 248-byte region [ffff88810f17a000, ffff88810f17a0f8)
The buggy address belongs to the page:
page:ffffea00043c5e80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f17a
flags: 0x4000000000000200(slab)
raw: 4000000000000200 dead000000000100 dead000000000122 ffff888107fb1380
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 16826, ts 1832290886833, free_ts 1832253488962
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2455 [inline]
 prep_new_page+0x166/0x180 mm/page_alloc.c:2461
 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4253
 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5345
 allocate_slab mm/slub.c:1808 [inline]
 new_slab+0x80/0x400 mm/slub.c:1869
 new_slab_objects mm/slub.c:2627 [inline]
 ___slab_alloc+0x302/0x4b0 mm/slub.c:2791
 __slab_alloc+0x63/0xa0 mm/slub.c:2831
 slab_alloc_node mm/slub.c:2913 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x1b9/0x2e0 mm/slub.c:2960
 kmem_cache_alloc_node include/linux/slab.h:423 [inline]
 __alloc_skb+0x80/0x510 net/core/skbuff.c:199
 alloc_skb include/linux/skbuff.h:1125 [inline]
 alloc_skb_with_frags+0xa1/0x570 net/core/skbuff.c:5922
 sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2354
 unix_dgram_sendmsg+0x700/0x1f90 net/unix/af_unix.c:1740
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2357
 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2411
 __sys_sendmmsg+0x2c3/0x510 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2523
 do_syscall_64+0x34/0x70
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1348 [inline]
 free_pcp_prepare mm/page_alloc.c:1420 [inline]
 free_unref_page_prepare+0x2ae/0x2d0 mm/page_alloc.c:3335
 free_unref_page_list+0x122/0xb20 mm/page_alloc.c:3442
 release_pages+0xea0/0xef0 mm/swap.c:1103
 __pagevec_release+0x84/0x100 mm/swap.c:1123
 pagevec_release include/linux/pagevec.h:88 [inline]
 truncate_inode_pages_range+0xa81/0x1ae0 mm/truncate.c:367
 truncate_inode_pages+0x24/0x30 mm/truncate.c:473
 kill_bdev fs/block_dev.c:86 [inline]
 __blkdev_put+0x307/0x740 fs/block_dev.c:1795
 blkdev_put+0x2f2/0x3d0 fs/block_dev.c:1863
 blkdev_close+0x7c/0xa0 fs/block_dev.c:1870
 __fput+0x309/0x760 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x129/0x190 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xbf/0xd0 kernel/entry/common.c:172
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 syscall_exit_to_user_mode+0xbc/0x1d0 kernel/entry/common.c:274
 do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

Memory state around the buggy address:
 ffff88810f179f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88810f17a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88810f17a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
                                                                ^
 ffff88810f17a100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff88810f17a180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5877: Out of memory
EXT4-fs error (device loop0): __ext4_ext_dirty:182: inode #16: comm syz-executor.0: mark_inode_dirty error
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5877: Out of memory
EXT4-fs error (device loop0): __ext4_ext_dirty:182: inode #16: comm syz-executor.0: mark_inode_dirty error
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5877: Out of memory
EXT4-fs error (device loop0): ext4_truncate:4388: inode #16: comm syz-executor.0: mark_inode_dirty error
EXT4-fs error (device loop0): ext4_evict_inode:294: comm syz-executor.0: couldn't truncate inode 16 (err -30)
EXT4-fs (loop0): 1 orphan inode deleted
EXT4-fs (loop0): mounted filesystem without journal. Opts: Ê; errors=remount-ro,noinit_itable,auto_da_alloc=0x0000000000000000,max_dir_size_kb=0x00000000000
ext4 filesystem being mounted at /root/syzkaller-testdir3381035969/syzkaller.EueJyO/2342/file1 supports timestamps until 2038 (0x7fffffff)