EXT2-fs (loop1): error: ext2_valid_block_bitmap: Invalid block bitmap - block_group = 0, block = 252
EXT2-fs (loop1): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1, count = 1
==================================================================
BUG: KASAN: invalid-access in generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline]
BUG: KASAN: invalid-access in test_bit_le include/asm-generic/bitops/le.h:21 [inline]
BUG: KASAN: invalid-access in ext2_valid_block_bitmap fs/ext2/balloc.c:86 [inline]
BUG: KASAN: invalid-access in read_block_bitmap+0xc4/0x1a0 fs/ext2/balloc.c:153
Read at addr fdff00000bda0ff8 by task syz-executor.1/4363
Pointer tag: [fd], memory tag: [f0]

CPU: 0 PID: 4363 Comm: syz-executor.1 Not tainted 6.9.0-rc2-syzkaller-00040-gb1e6ec0a0fd0 #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x108/0x618 mm/kasan/report.c:488
 kasan_report+0x88/0xac mm/kasan/report.c:601
 report_tag_fault arch/arm64/mm/fault.c:331 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:343 [inline]
 __do_kernel_fault+0x1a0/0x1dc arch/arm64/mm/fault.c:385
 do_bad_area arch/arm64/mm/fault.c:485 [inline]
 do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:764
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:840
 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:432
 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:492
 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
 generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline]
 test_bit_le include/asm-generic/bitops/le.h:21 [inline]
 ext2_valid_block_bitmap fs/ext2/balloc.c:86 [inline]
 read_block_bitmap+0xc4/0x1a0 fs/ext2/balloc.c:153
 ext2_free_blocks+0xe4/0x380 fs/ext2/balloc.c:514
 ext2_free_data fs/ext2/inode.c:1111 [inline]
 ext2_free_branches+0x1dc/0x214 fs/ext2/inode.c:1159
 ext2_free_branches+0x94/0x214 fs/ext2/inode.c:1150
 __ext2_truncate_blocks+0x444/0x470 fs/ext2/inode.c:1225
 ext2_setsize fs/ext2/inode.c:1291 [inline]
 ext2_setattr+0x1cc/0x32c fs/ext2/inode.c:1660
 notify_change+0x1a0/0x400 fs/attr.c:497
 do_truncate+0xac/0x110 fs/open.c:65
 handle_truncate fs/namei.c:3300 [inline]
 do_open fs/namei.c:3646 [inline]
 path_openat+0xc14/0xf04 fs/namei.c:3799
 do_filp_open+0x9c/0x14c fs/namei.c:3826
 do_sys_openat2+0xc0/0xf4 fs/open.c:1406
 do_sys_open fs/open.c:1421 [inline]
 __do_sys_openat fs/open.c:1437 [inline]
 __se_sys_openat fs/open.c:1432 [inline]
 __arm64_sys_openat+0x64/0xa4 fs/open.c:1432
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:48
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152
 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598

The buggy address belongs to the physical page:
page: refcount:1 mapcount:1 mapping:0000000000000000 index:0x4000ef6 pfn:0x4bda0
memcg:f0ff000002c3a000
anon flags: 0x1ffe000000a0028(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=0|lastcpupid=0xfff|kasantag=0x0)
page_type: 0x0()
raw: 01ffe000000a0028 fffffdffc02f68c8 fffffdffc029f448 f2ff000006410d21
raw: 0000000004000ef6 0000000000000000 0000000100000000 f0ff000002c3a000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00000bda0d00: f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0
 ffff00000bda0e00: f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0
>ffff00000bda0f00: f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0
                                                                ^
 ffff00000bda1000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 ffff00000bda1100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
==================================================================
EXT2-fs (loop1): error: ext2_valid_block_bitmap: Invalid block bitmap - block_group = 0, block = 0
EXT2-fs (loop1): error: ext2_free_blocks: Freeing blocks in system zones - Block = 3, count = 1
EXT2-fs (loop1): error: ext2_free_blocks: Freeing blocks in system zones - Block = 2, count = 1