==================================================================
BUG: KASAN: slab-out-of-bounds in __ext4_iget+0x3a0/0x41f0 fs/ext4/inode.c:4766
Read of size 8 at addr ffff88812caefeb8 by task syz.7.7390/27796

CPU: 1 PID: 27796 Comm: syz.7.7390 Not tainted 5.10.234-syzkaller-00023-g3f5f2283d684 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:452
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 __ext4_iget+0x3a0/0x41f0 fs/ext4/inode.c:4766
 ext4_quota_enable fs/ext4/super.c:6423 [inline]
 ext4_enable_quotas+0x56f/0x9f0 fs/ext4/super.c:6459
 ext4_fill_super+0x86dc/0x9150 fs/ext4/super.c:5060
 mount_bdev+0x262/0x370 fs/super.c:1442
 ext4_mount+0x34/0x40 fs/ext4/super.c:6638
 legacy_get_tree+0xf1/0x190 fs/fs_context.c:593
 vfs_get_tree+0x88/0x290 fs/super.c:1572
 do_new_mount+0x2ba/0xb30 fs/namespace.c:2917
 path_mount+0x56f/0xcb0 fs/namespace.c:3247
 do_mount fs/namespace.c:3260 [inline]
 __do_sys_mount fs/namespace.c:3468 [inline]
 __se_sys_mount+0x2c4/0x3b0 fs/namespace.c:3445
 __x64_sys_mount+0xbf/0xd0 fs/namespace.c:3445
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f6d37b5590a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6d361bde68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6d361bdef0 RCX: 00007f6d37b5590a
RDX: 00004000000004c0 RSI: 00004000000000c0 RDI: 00007f6d361bdeb0
RBP: 00004000000004c0 R08: 00007f6d361bdef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00004000000000c0
R13: 00007f6d361bdeb0 R14: 0000000000000500 R15: 0000400000000100

Allocated by task 94:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:463
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960
 __d_alloc+0x2d/0x6c0 fs/dcache.c:1714
 d_alloc+0x4b/0x1d0 fs/dcache.c:1793
 __lookup_hash+0xe7/0x290 fs/namei.c:1537
 do_unlinkat+0x28b/0x8b0 fs/namei.c:4023
 __do_sys_unlink fs/namei.c:4082 [inline]
 __se_sys_unlink fs/namei.c:4080 [inline]
 __x64_sys_unlink+0x49/0x50 fs/namei.c:4080
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 12:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1595 [inline]
 slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
 slab_free mm/slub.c:3203 [inline]
 kmem_cache_free+0xa9/0x1e0 mm/slub.c:3219
 __d_free+0x23/0x30 fs/dcache.c:271
 rcu_do_batch+0x597/0xc40 kernel/rcu/tree.c:2494
 rcu_core+0x5ad/0xe40 kernel/rcu/tree.c:2735
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2748
 __do_softirq+0x268/0x5bb kernel/softirq.c:309

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 __call_rcu kernel/rcu/tree.c:2976 [inline]
 call_rcu+0x135/0x11f0 kernel/rcu/tree.c:3050
 dentry_free+0xbf/0x160
 __dentry_kill+0x505/0x650 fs/dcache.c:597
 dentry_kill+0xc0/0x2a0
 dput+0x40/0x80 fs/dcache.c:883
 do_unlinkat+0x44d/0x8b0 fs/namei.c:4038
 __do_sys_unlink fs/namei.c:4082 [inline]
 __se_sys_unlink fs/namei.c:4080 [inline]
 __x64_sys_unlink+0x49/0x50 fs/namei.c:4080
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 __call_rcu kernel/rcu/tree.c:2976 [inline]
 call_rcu+0x135/0x11f0 kernel/rcu/tree.c:3050
 dentry_free+0xbf/0x160
 __dentry_kill+0x505/0x650 fs/dcache.c:597
 dentry_kill+0xc0/0x2a0
 dput+0x40/0x80 fs/dcache.c:883
 do_unlinkat+0x44d/0x8b0 fs/namei.c:4038
 __do_sys_unlink fs/namei.c:4082 [inline]
 __se_sys_unlink fs/namei.c:4080 [inline]
 __x64_sys_unlink+0x49/0x50 fs/namei.c:4080
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff88812caefdd0
 which belongs to the cache dentry of size 208
The buggy address is located 24 bytes to the right of
 208-byte region [ffff88812caefdd0, ffff88812caefea0)
The buggy address belongs to the page:
page:ffffea0004b2bbc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812caefaa0 pfn:0x12caef
flags: 0x4000000000000200(slab)
raw: 4000000000000200 ffffea000433dfc8 ffffea0004b23ec8 ffff88810018af00
raw: ffff88812caefaa0 00000000000f000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112cd0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_RECLAIMABLE), pid 3676, ts 357497962716, free_ts 351850628686
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x166/0x180 mm/page_alloc.c:2462
 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5348
 allocate_slab mm/slub.c:1808 [inline]
 new_slab+0x80/0x400 mm/slub.c:1869
 new_slab_objects mm/slub.c:2627 [inline]
 ___slab_alloc+0x302/0x4b0 mm/slub.c:2791
 __slab_alloc+0x63/0xa0 mm/slub.c:2831
 slab_alloc_node mm/slub.c:2913 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x1b9/0x2e0 mm/slub.c:2960
 __d_alloc+0x2d/0x6c0 fs/dcache.c:1714
 d_alloc_pseudo+0x1d/0x70 fs/dcache.c:1843
 alloc_file_pseudo+0x131/0x2f0 fs/file_table.c:226
 __shmem_file_setup+0x1d6/0x2a0 mm/shmem.c:4198
 shmem_kernel_file_setup mm/shmem.c:4217 [inline]
 shmem_zero_setup+0x9f/0x1e0 mm/shmem.c:4261
 __mmap_region mm/mmap.c:1917 [inline]
 mmap_region+0x16df/0x1cd0 mm/mmap.c:3063
 do_mmap+0x800/0xeb0 mm/mmap.c:1649
 vm_mmap_pgoff+0x201/0x390 mm/util.c:543
 ksys_mmap_pgoff+0xf8/0x1f0 mm/mmap.c:1700
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x82c/0x850 mm/page_alloc.c:1629
 free_the_page+0x76/0x370 mm/page_alloc.c:5409
 __free_pages+0x67/0xc0 mm/page_alloc.c:5418
 __free_slab+0xcf/0x190 mm/slub.c:1894
 free_slab mm/slub.c:1909 [inline]
 discard_slab+0x29/0x40 mm/slub.c:1915
 __slab_free+0x30d/0x3a0 mm/slub.c:3131
 do_slab_free mm/slub.c:3191 [inline]
 ___cache_free+0x111/0x130 mm/slub.c:3210
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x47/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x15a/0x170 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583
 slab_alloc_node mm/slub.c:2947 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 jbd2_alloc_handle include/linux/jbd2.h:1554 [inline]
 new_handle fs/jbd2/transaction.c:464 [inline]
 jbd2__journal_start+0x150/0x710 fs/jbd2/transaction.c:491
 __ext4_journal_start_sb+0x249/0x4a0 fs/ext4/ext4_jbd2.c:105
 __ext4_journal_start fs/ext4/ext4_jbd2.h:328 [inline]
 ext4_dirty_inode+0xaf/0x120 fs/ext4/inode.c:6106

Memory state around the buggy address:
 ffff88812caefd80: fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb
 ffff88812caefe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88812caefe80: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
                                        ^
 ffff88812caeff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88812caeff80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs warning (device loop7): ext4_enable_quotas:6467: Failed to enable quota tracking (type=0, err=-13, ino=3). Please run e2fsck to fix.
EXT4-fs (loop7): mount failed