Extracting prog: 1m1.093922595s
Minimizing prog: 13m16.554927633s
Simplifying prog options: 0s
Extracting C: 29.664083329s
Simplifying C: 4m34.372347189s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program crashed: KASAN: use-after-free Read in ext4_find_extent
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000100)='?', 0x1)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
write(0xffffffffffffffff, &(0x7f0000000100)='?', 0x1)
sendfile(0xffffffffffffffff, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000100)='?', 0x1)
sendfile(r1, 0xffffffffffffffff, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000100)='?', 0x1)
sendfile(r1, r0, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
pwrite64(0xffffffffffffffff, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000100)='?', 0x1)
sendfile(r1, r0, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, 0x0, 0x0, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0), 0x0, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(0x0, 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(0x0, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, 0x0, 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, 0x0, 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, 0x0, 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, 0x0, 0x0)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100), 0x0)
sendfile(r2, r1, 0x0, 0x3ffff)

program did not crash
extracting C reproducer
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program crashed: KASAN: use-after-free Read in ext4_find_extent
simplifying C reproducer
testing compiled C program (duration=33.483244684s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program crashed: KASAN: use-after-free Read in __crc32c_le_base
a never seen crash title: KASAN: use-after-free Read in __crc32c_le_base, ignore
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program did not crash
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program crashed: KASAN: use-after-free Read in ext4_find_extent
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program crashed: KASAN: use-after-free Read in ext4_find_extent
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program did not crash
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program did not crash
testing compiled C program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
program did not crash
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program crashed: KASAN: use-after-free Read in ext4_find_extent
validation run: crashed=true
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program crashed: KASAN: use-after-free Read in ext4_find_extent
validation run: crashed=true
testing program (duration=33.483244684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-pwrite64-creat-mount-openat-openat-write-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@oldalloc}, {@dioread_nolock}, {@noinit_itable}]}, 0xff, 0x4be, &(0x7f0000000a00)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk929cAIOlRCVuIBUQuKGEieOYqc0UQ8p3HrggEAgIQ7c+Qu40BMVEuIMd8QBFUEJEiAhGc3YTvPl4KI0RpnfT5p4Zl5nnveN9byZeWfGE0BmnU1+5CIGI+LTiDjaWNz8hrONl7X7N6eSKRf1+uVvcun7kuXWW1u/dyQiViOiLyKefjzihdz2uNXlldnJcrm02Fwu1uYWitXllQvX5iZnSjOl+ZHxixMT48NjoxN71tbbr710+9IHT/a+/8Or9+6+/tGHSbUGm2Ub27GXGk3vieMb1h2KiP8/imBdUGi2p7/bFeE3ST6/P0XEuTT/j0Yh/TSBLKjX6/Wf64fbFa/WgQMrn+4D5/JDEdGYz+eHhhr78H+OgXy5Uq39+2plaX66sa98LHryV6+VS8PNY4Vj0ZNLlkfS+QfLo1uWxyLSfeA3Cv3p8tBUpTy9v10dsMWRZv73N/P/+0Ij/4GM2PmQv+1BAXCAGPKD7JL/kF3yH7JL/kN2yX/ILvkP2fXQ+V94NPUA9p///5Bd8h+yS/5DJj116VIy1Vv3v09fX16arVy/MF2qzg7NLU0NTVUWF4ZmKpWZ9J6duV/bXrlSWRj5TyzdKNZK1VqxurxyZa6yNF+7kt7Xf6XUsy+tAjpx/Mydz3MRsfrf/nRK9DbL5CocbPV6Lrp9DzLQHc7kQXYZ+oPscowP7PAVvZv0tStY2Pu6APsj3+0KAF1z/pTzf5BVxv8hu4z/Q3bZxweM/0P2GP+H7Bps8/yvP2x4dtdwRPwxIj4r9BxuPesLOAjyX+Ui8sn+//mjfx/cWtqb+7EQ0ZOeE3z5nctv3Zis1RZHkvXfpqcOkvW1t5vrR7vSAKBDrTxt5TEAkF1r929Otab9jPv1Y42LELbHP9Qcm+xLz1EOrOU2XauQ26NrF1ZvRcTJneLnms87b5z5GFgrbIt/ovmaa2wire+h9Lnp+xP/1Ib4f9sQ//Qu8Xofom5w0N1J+p/hnfIvn+Z0rOff5v5ncI+unWjf/+XX+79Cm/7vTIcxXnz3lS/bxr8VcXrH+K14fWmsrfGTup3vLHzu3nPP/KVdYf29xnZ2ir++gYgo1uYWitXllQvp98jNlOZHxi9OTIwPj41OFNMx6mJrpHq7/5385O5u7R94EL8/Ijpqf7Lun521P37668fPnt0l/j/O7fz5n9glflLRf3UY/7vRL55vV5bEn27z98/vEj9ZN9Zh/OqbT3iWOAD8jlSXV2Yny+XSohkzZsysz3S7ZwIetQdJ3+2aAAAAAAAAAAAAAJ3aj8uJu91GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICD4JcAAAD///3C05Q=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x40)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
creat(&(0x7f0000000580)='./bus\x00', 0x9e)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1084, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x8840, 0xa2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000100)='?', 0x1)
sendfile(r2, r1, 0x0, 0x3ffff)

program crashed: KASAN: use-after-free Read in ext4_find_extent
validation run: crashed=true
reproducing took 21m9.265486503s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:946
Read of size 4 at addr ffff88812eb7db80 by task kworker/u4:1/10

CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-7:3)
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
 ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:946
 ext4_ext_map_blocks+0x20c/0x6150 fs/ext4/extents.c:4197
 ext4_map_blocks+0x979/0x1a50 fs/ext4/inode.c:676
 mpage_map_one_extent fs/ext4/inode.c:2423 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2476 [inline]
 ext4_writepages+0x1260/0x30a0 fs/ext4/inode.c:2844
 do_writepages+0x476/0x6d0 mm/page-writeback.c:2388
 __writeback_single_inode+0xd9/0x9e0 fs/fs-writeback.c:1657
 writeback_sb_inodes+0x9f3/0x1610 fs/fs-writeback.c:1940
 wb_writeback+0x3eb/0x990 fs/fs-writeback.c:2116
 wb_do_writeback fs/fs-writeback.c:2263 [inline]
 wb_workfn+0x3ac/0xf30 fs/fs-writeback.c:2304
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

The buggy address belongs to the page:
page:ffffea0004badf40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12eb7d
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004bae048 ffffea0004badf08 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 306, ts 25400899817, free_ts 25401831755
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 do_anonymous_page mm/memory.c:4072 [inline]
 handle_pte_fault+0xee5/0x2770 mm/memory.c:4921
 __handle_mm_fault mm/memory.c:-1 [inline]
 do_handle_mm_fault+0x1b3b/0x1e30 mm/memory.c:5345
 handle_mm_fault include/linux/mm.h:1847 [inline]
 do_user_addr_fault+0x808/0x11c0 arch/x86/mm/fault.c:1416
 handle_page_fault arch/x86/mm/fault.c:1507 [inline]
 exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1560
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page_list+0x138/0x9e0 mm/page_alloc.c:3673
 release_pages+0x1264/0x12c0 mm/swap.c:1015
 free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:320
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:240 [inline]
 tlb_flush_mmu mm/mmu_gather.c:247 [inline]
 tlb_finish_mmu+0x17e/0x310 mm/mmu_gather.c:338
 unmap_region+0x344/0x3b0 mm/mmap.c:2692
 __do_munmap+0xa99/0x1090 mm/mmap.c:2925
 __vm_munmap+0x14e/0x280 mm/mmap.c:2978
 __do_sys_munmap mm/mmap.c:3004 [inline]
 __se_sys_munmap mm/mmap.c:3000 [inline]
 __x64_sys_munmap+0x6b/0x80 mm/mmap.c:3000
 x64_sys_call+0xc9/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff88812eb7da80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812eb7db00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88812eb7db80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88812eb7dc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812eb7dc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
EXT4-fs error (device loop3): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop3): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
EXT4-fs error (device loop3): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop3): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop3) in ext4_reserve_inode_write:5904: Corrupt filesystem
EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop3): This should not happen!! Data will be lost

IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
__quota_error: 53 callbacks suppressed
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop4): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop4): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop4): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem
Quota error (device loop4): qtree_write_dquot: dquota write failed
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop4): This should not happen!! Data will be lost

bridge0: port 1(bridge_slave_0) entered disabled state
bridge0: port 2(bridge_slave_1) entered disabled state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
EXT4-fs error (device loop5): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop5): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop5): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop5): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop5): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop5) in ext4_reserve_inode_write:5904: Corrupt filesystem
Quota error (device loop5): qtree_write_dquot: dquota write failed
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop5): This should not happen!! Data will be lost

IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
bridge0: port 1(bridge_slave_0) entered disabled state
bridge0: port 2(bridge_slave_1) entered disabled state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:946
Read of size 4 at addr ffff88812eb7db80 by task kworker/u4:1/10

CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-7:3)
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 ext4_ext_binsearch fs/ext4/extents.c:827 [inline]
 ext4_find_extent+0xbfb/0xe30 fs/ext4/extents.c:946
 ext4_ext_map_blocks+0x20c/0x6150 fs/ext4/extents.c:4197
 ext4_map_blocks+0x979/0x1a50 fs/ext4/inode.c:676
 mpage_map_one_extent fs/ext4/inode.c:2423 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2476 [inline]
 ext4_writepages+0x1260/0x30a0 fs/ext4/inode.c:2844
 do_writepages+0x476/0x6d0 mm/page-writeback.c:2388
 __writeback_single_inode+0xd9/0x9e0 fs/fs-writeback.c:1657
 writeback_sb_inodes+0x9f3/0x1610 fs/fs-writeback.c:1940
 wb_writeback+0x3eb/0x990 fs/fs-writeback.c:2116
 wb_do_writeback fs/fs-writeback.c:2263 [inline]
 wb_workfn+0x3ac/0xf30 fs/fs-writeback.c:2304
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

The buggy address belongs to the page:
page:ffffea0004badf40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12eb7d
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004bae048 ffffea0004badf08 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 306, ts 25400899817, free_ts 25401831755
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 do_anonymous_page mm/memory.c:4072 [inline]
 handle_pte_fault+0xee5/0x2770 mm/memory.c:4921
 __handle_mm_fault mm/memory.c:-1 [inline]
 do_handle_mm_fault+0x1b3b/0x1e30 mm/memory.c:5345
 handle_mm_fault include/linux/mm.h:1847 [inline]
 do_user_addr_fault+0x808/0x11c0 arch/x86/mm/fault.c:1416
 handle_page_fault arch/x86/mm/fault.c:1507 [inline]
 exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1560
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page_list+0x138/0x9e0 mm/page_alloc.c:3673
 release_pages+0x1264/0x12c0 mm/swap.c:1015
 free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:320
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:240 [inline]
 tlb_flush_mmu mm/mmu_gather.c:247 [inline]
 tlb_finish_mmu+0x17e/0x310 mm/mmu_gather.c:338
 unmap_region+0x344/0x3b0 mm/mmap.c:2692
 __do_munmap+0xa99/0x1090 mm/mmap.c:2925
 __vm_munmap+0x14e/0x280 mm/mmap.c:2978
 __do_sys_munmap mm/mmap.c:3004 [inline]
 __se_sys_munmap mm/mmap.c:3000 [inline]
 __x64_sys_munmap+0x6b/0x80 mm/mmap.c:3000
 x64_sys_call+0xc9/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:12
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff88812eb7da80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812eb7db00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88812eb7db80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88812eb7dc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812eb7dc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
EXT4-fs error (device loop3): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop3): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
EXT4-fs error (device loop3): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop3): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop3) in ext4_reserve_inode_write:5904: Corrupt filesystem
EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop3): This should not happen!! Data will be lost

IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
__quota_error: 53 callbacks suppressed
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop4): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop4): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop4): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem
Quota error (device loop4): qtree_write_dquot: dquota write failed
Quota error (device loop4): qtree_write_dquot: dquota write failed
EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop4): This should not happen!! Data will be lost

bridge0: port 1(bridge_slave_0) entered disabled state
bridge0: port 2(bridge_slave_1) entered disabled state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
EXT4-fs error (device loop5): ext4_map_blocks:632: inode #3: block 23: comm kworker/u4:1: lblock 5 mapped to illegal pblock 23 (length 1)
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop5): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 0
EXT4-fs error (device loop5): ext4_map_blocks:632: inode #4: block 29: comm kworker/u4:1: lblock 5 mapped to illegal pblock 29 (length 1)
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs error (device loop5): ext4_write_dquot:6207: comm kworker/u4:1: Failed to commit dquot type 1
EXT4-fs error (device loop5): __ext4_get_inode_loc:4365: comm kworker/u4:1: Invalid inode table block 1061109567 in block_group 0
EXT4-fs error (device loop5) in ext4_reserve_inode_write:5904: Corrupt filesystem
Quota error (device loop5): qtree_write_dquot: dquota write failed
Quota error (device loop5): qtree_write_dquot: dquota write failed
EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 28 with error 117
EXT4-fs (loop5): This should not happen!! Data will be lost

IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
bridge0: port 1(bridge_slave_0) entered disabled state
bridge0: port 2(bridge_slave_1) entered disabled state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready