Extracting prog: 2m22.365153553s
Minimizing prog: 1h18m46.704771085s
Simplifying prog options: 0s
Extracting C: 30.944301249s
Simplifying C: 23m7.009338758s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r0, r0, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, 0xffffffffffffffff, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r0, r0, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, 0x0, &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x0, 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
program crashed: KASAN: slab-out-of-bounds Write in ext4_expand_extra_isize_ea
a never seen crash title: KASAN: slab-out-of-bounds Write in ext4_expand_extra_isize_ea, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-quotactl$Q_QUOTAON-mprotect-openat$cgroup_ro-mmap-newfstatat-openat-sendfile
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {}, {@nouser_xattr}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodelalloc}, {@jqfmt_vfsold}, {@noinit_itable}]}, 0xfc, 0x585, &(0x7f0000001240)="$eJzs3d9rW1UcAPDvTZPup66DMVRQBntwMpeurT8mCM5H0eFA32do78pouowmHWsduD24F19kCCIOxBfffPdx+A/4Vwx0MGQUfRChctObrWuT/sxM13w+cLNz7r3Zud/c+z09JzchAfStY9lDIeLFiPg6iTi0bFsx8o3HlvZbeHh9PFuSWFz85M8kknxda/8k//dAXnkhIn79MuJkYXW79bn5qUq1Gnvz+nBj+spwfW7+1KXpymQ6mV4eHRs78+bY6Dtvv9W1WF87//d3H9/94MxXxxe+/fn+4dtJnI2D+bblcWzDjeWVY5V/81Ipzq7YcaQLje0kSa8PgC0ZyPO8FFkfcCgG8qwHdr8vImLxCSuqwC6WSHjoU61xQGtu36V58DPjwftLE6Bm7IPL4y8uvTcSe5tzo/0LyRMzo2y+O9SF9rM2fvnjzu1sibXfh9i3Th1gU27cjIjTxeLq/j/J+7+tO91883htK9vot78/0Et3s/HP6+3Gf4U8N0vNx5XjnwNtcncr1s//wv0uNNNRNv57t+3491HXNTSQ155rjvlKycVL1fR0RDwfESeitCerr3U/58zCvcVO25aP/7Ila781FsyP435xz5PPmag0KhExuJ24Wx7cjHip2C7+5NH4N2lz/rPX4/wG2zia3nml07b143+6Fn+MeLXt+X98RytZ+/7kcPN6GG5dFav9devob53a31b8Xbjplp3//WvHP5Q8vl+bztQ338YPe/9J260vbOP6H0w+bZZbSXCt0mjMjEQMJh+tXj/6+Lmtemv/LP4Tx9fq/9pf/9nk67MNxn/ryK2Ou/b6+s/in9jU+d984d6Hn3/fqf2Nnf83mqUT+Zq8/2svv1Y2eoDbff0AAAAAAABgJylExMFICuVH5UKhXF76fMeR2F+o1uqNkxdrs5cnovld2aEoFVp3ug8t+zzESP552FZ9dEV9LCIOR8Q3A/ua9fJ4rTrR6+ABAAAAAAAAAAAAAAAAAABghzjQ4fv/md8Hen10wFPX/GGDPb0+CqAX1v3J/2780hOwI62b/8CuJf+hf8l/6F/yH/qX/If+Jf+hf8l/6F/yHwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK48PD6eFafuDo3O1W7emoirU+Vp2fHy+O1mSvlyVptspqWx2vT6/1/1VrtyshozF4bbqT1xnB9bv7CdG32cuPCpenKZHohLf0vUQEAAAAAAAAAAAAAAAAAAMCzpT43P1WpVtMZhY6F92JHHMbTDHDJlp5e3ClR9FHhp5c3k7k389O7ubZ62CkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAr/BQAA///F0C+9")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f00000022c0), 0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
sendfile(r1, r1, 0x0, 0xe3aa6ea)

program crashed: KASAN: use-after-free Write in ext4_expand_extra_isize_ea
validation run: crashed=true
reproducing took 2h13m11.236049474s
repro crashed as (corrupted=false):
EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.2274: bg 0: block 144: padding at end of block bitmap is not set
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
BUG: KASAN: use-after-free in ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
Write of size 72 at addr ffff88811cdc73a0 by task syz.6.2274/9006

CPU: 1 PID: 9006 Comm: syz.6.2274 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 memmove+0x44/0x70 mm/kasan/shadow.c:55
 ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
 ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
 __ext4_expand_extra_isize+0x2fe/0x3e0 fs/ext4/inode.c:5955
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
 __ext4_mark_inode_dirty+0x39d/0x5e0 fs/ext4/inode.c:6076
 ext4_dirty_inode+0xbd/0x100 fs/ext4/inode.c:6108
 __mark_inode_dirty+0x1ef/0x9c0 fs/fs-writeback.c:2486
 generic_update_time fs/inode.c:1891 [inline]
 inode_update_time fs/inode.c:1904 [inline]
 touch_atime+0x333/0x500 fs/inode.c:1976
 file_accessed include/linux/fs.h:2566 [inline]
 filemap_read+0x1fa8/0x21e0 mm/filemap.c:2737
 generic_file_read_iter+0xac/0x420 mm/filemap.c:2816
 ext4_file_read_iter+0x2e8/0x500 fs/ext4/file.c:-1
 call_read_iter include/linux/fs.h:2206 [inline]
 generic_file_splice_read+0x3ea/0x5f0 fs/splice.c:311
 do_splice_to fs/splice.c:796 [inline]
 splice_direct_to_actor+0x40f/0xb40 fs/splice.c:870
 do_splice_direct+0x1c2/0x2d0 fs/splice.c:979
 do_sendfile+0x515/0xe20 fs/read_write.c:1249
 __do_sys_sendfile64 fs/read_write.c:1317 [inline]
 __se_sys_sendfile64 fs/read_write.c:1303 [inline]
 __x64_sys_sendfile64+0x199/0x1f0 fs/read_write.c:1303
 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d1c019e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1be7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f5d1c2a1fa0 RCX: 00007f5d1c019e99
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 00007f5d1c0afeaf R08: 0000000000000000 R09: 0000000000000000
R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5d1c2a2038 R14: 00007f5d1c2a1fa0 R15: 00007ffc90540dd8
 </TASK>

The buggy address belongs to the page:
page:ffffea00047371c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cdc7
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004c47bc8 ffffea0004c49948 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 379, ts 410440801058, free_ts 410559723322
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 __get_free_pages+0x10/0x30 mm/page_alloc.c:5861
 _pgd_alloc arch/x86/mm/pgtable.c:414 [inline]
 pgd_alloc+0x22/0x2b0 arch/x86/mm/pgtable.c:430
 mm_alloc_pgd kernel/fork.c:694 [inline]
 mm_init+0x594/0xa70 kernel/fork.c:1144
 dup_mm kernel/fork.c:1524 [inline]
 copy_mm+0x1c6/0x13a0 kernel/fork.c:1579
 copy_process+0x1184/0x3280 kernel/fork.c:2353
 kernel_clone+0x233/0x960 kernel/fork.c:2742
 __do_sys_clone kernel/fork.c:2868 [inline]
 __se_sys_clone kernel/fork.c:2852 [inline]
 __x64_sys_clone+0x198/0x210 kernel/fork.c:2852
 x64_sys_call+0x41f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page+0xae/0x540 mm/page_alloc.c:3618
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5900
 free_pages+0x82/0x90 mm/page_alloc.c:5911
 _pgd_free arch/x86/mm/pgtable.c:420 [inline]
 pgd_free+0x1a2/0x1c0 arch/x86/mm/pgtable.c:476
 mm_free_pgd kernel/fork.c:702 [inline]
 __mmdrop+0xad/0x500 kernel/fork.c:753
 mmdrop include/linux/sched/mm.h:49 [inline]
 finish_task_switch+0x2bb/0x790 kernel/sched/core.c:5075
 context_switch kernel/sched/core.c:5181 [inline]
 __schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
 schedule+0x11e/0x1e0 kernel/sched/core.c:6621
 freezable_schedule include/linux/freezer.h:197 [inline]
 do_nanosleep+0x19f/0x630 kernel/time/hrtimer.c:2048
 hrtimer_nanosleep+0x1b6/0x3d0 kernel/time/hrtimer.c:2101
 common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
 __se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
 __x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
 x64_sys_call+0x824/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:231
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88811cdc7280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88811cdc7380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff88811cdc7400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

final repro crashed as (corrupted=false):
EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.2274: bg 0: block 144: padding at end of block bitmap is not set
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
BUG: KASAN: use-after-free in ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
Write of size 72 at addr ffff88811cdc73a0 by task syz.6.2274/9006

CPU: 1 PID: 9006 Comm: syz.6.2274 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 memmove+0x44/0x70 mm/kasan/shadow.c:55
 ext4_xattr_shift_entries fs/ext4/xattr.c:2548 [inline]
 ext4_expand_extra_isize_ea+0x15c3/0x1940 fs/ext4/xattr.c:2797
 __ext4_expand_extra_isize+0x2fe/0x3e0 fs/ext4/inode.c:5955
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
 __ext4_mark_inode_dirty+0x39d/0x5e0 fs/ext4/inode.c:6076
 ext4_dirty_inode+0xbd/0x100 fs/ext4/inode.c:6108
 __mark_inode_dirty+0x1ef/0x9c0 fs/fs-writeback.c:2486
 generic_update_time fs/inode.c:1891 [inline]
 inode_update_time fs/inode.c:1904 [inline]
 touch_atime+0x333/0x500 fs/inode.c:1976
 file_accessed include/linux/fs.h:2566 [inline]
 filemap_read+0x1fa8/0x21e0 mm/filemap.c:2737
 generic_file_read_iter+0xac/0x420 mm/filemap.c:2816
 ext4_file_read_iter+0x2e8/0x500 fs/ext4/file.c:-1
 call_read_iter include/linux/fs.h:2206 [inline]
 generic_file_splice_read+0x3ea/0x5f0 fs/splice.c:311
 do_splice_to fs/splice.c:796 [inline]
 splice_direct_to_actor+0x40f/0xb40 fs/splice.c:870
 do_splice_direct+0x1c2/0x2d0 fs/splice.c:979
 do_sendfile+0x515/0xe20 fs/read_write.c:1249
 __do_sys_sendfile64 fs/read_write.c:1317 [inline]
 __se_sys_sendfile64 fs/read_write.c:1303 [inline]
 __x64_sys_sendfile64+0x199/0x1f0 fs/read_write.c:1303
 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d1c019e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1be7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f5d1c2a1fa0 RCX: 00007f5d1c019e99
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 00007f5d1c0afeaf R08: 0000000000000000 R09: 0000000000000000
R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5d1c2a2038 R14: 00007f5d1c2a1fa0 R15: 00007ffc90540dd8
 </TASK>

The buggy address belongs to the page:
page:ffffea00047371c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cdc7
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0004c47bc8 ffffea0004c49948 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 379, ts 410440801058, free_ts 410559723322
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 __alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_pages_node include/linux/gfp.h:609 [inline]
 alloc_pages include/linux/gfp.h:622 [inline]
 __get_free_pages+0x10/0x30 mm/page_alloc.c:5861
 _pgd_alloc arch/x86/mm/pgtable.c:414 [inline]
 pgd_alloc+0x22/0x2b0 arch/x86/mm/pgtable.c:430
 mm_alloc_pgd kernel/fork.c:694 [inline]
 mm_init+0x594/0xa70 kernel/fork.c:1144
 dup_mm kernel/fork.c:1524 [inline]
 copy_mm+0x1c6/0x13a0 kernel/fork.c:1579
 copy_process+0x1184/0x3280 kernel/fork.c:2353
 kernel_clone+0x233/0x960 kernel/fork.c:2742
 __do_sys_clone kernel/fork.c:2868 [inline]
 __se_sys_clone kernel/fork.c:2852 [inline]
 __x64_sys_clone+0x198/0x210 kernel/fork.c:2852
 x64_sys_call+0x41f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page+0xae/0x540 mm/page_alloc.c:3618
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5900
 free_pages+0x82/0x90 mm/page_alloc.c:5911
 _pgd_free arch/x86/mm/pgtable.c:420 [inline]
 pgd_free+0x1a2/0x1c0 arch/x86/mm/pgtable.c:476
 mm_free_pgd kernel/fork.c:702 [inline]
 __mmdrop+0xad/0x500 kernel/fork.c:753
 mmdrop include/linux/sched/mm.h:49 [inline]
 finish_task_switch+0x2bb/0x790 kernel/sched/core.c:5075
 context_switch kernel/sched/core.c:5181 [inline]
 __schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
 schedule+0x11e/0x1e0 kernel/sched/core.c:6621
 freezable_schedule include/linux/freezer.h:197 [inline]
 do_nanosleep+0x19f/0x630 kernel/time/hrtimer.c:2048
 hrtimer_nanosleep+0x1b6/0x3d0 kernel/time/hrtimer.c:2101
 common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
 __se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
 __x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
 x64_sys_call+0x824/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:231
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88811cdc7280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88811cdc7380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff88811cdc7400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88811cdc7480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================