[ 21.523474][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.531541][ T8] device bridge_slave_0 left promiscuous mode [ 21.537734][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.545966][ T8] device veth1_macvtap left promiscuous mode [ 21.552087][ T8] device veth0_vlan left promiscuous mode [ 32.397703][ T28] kauditd_printk_skb: 76 callbacks suppressed [ 32.397716][ T28] audit: type=1400 audit(1695573412.714:152): avc: denied { transition } for pid=320 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.426660][ T28] audit: type=1400 audit(1695573412.724:153): avc: denied { noatsecure } for pid=320 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.446567][ T28] audit: type=1400 audit(1695573412.744:154): avc: denied { rlimitinh } for pid=320 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.465669][ T28] audit: type=1400 audit(1695573412.744:155): avc: denied { siginh } for pid=320 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.6' (ED25519) to the list of known hosts. 2023/09/24 16:37:00 ignoring optional flag "sandboxArg"="0" 2023/09/24 16:37:00 parsed 1 programs [ 40.231317][ T28] audit: type=1400 audit(1695573420.544:156): avc: denied { mounton } for pid=342 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 40.256289][ T28] audit: type=1400 audit(1695573420.544:157): avc: denied { mount } for pid=342 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 2023/09/24 16:37:00 executed programs: 0 [ 40.286460][ T28] audit: type=1400 audit(1695573420.604:158): avc: denied { unlink } for pid=342 comm="syz-executor" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 40.312297][ T342] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 40.370204][ T348] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.377944][ T348] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.385223][ T348] device bridge_slave_0 entered promiscuous mode [ 40.392235][ T348] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.399178][ T348] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.406474][ T348] device bridge_slave_1 entered promiscuous mode [ 40.453031][ T28] audit: type=1400 audit(1695573420.764:159): avc: denied { write } for pid=348 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 40.462221][ T348] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.473830][ T28] audit: type=1400 audit(1695573420.774:160): avc: denied { read } for pid=348 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 40.480473][ T348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.480582][ T348] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.516181][ T348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.537561][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.544973][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.553219][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.560649][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.577015][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.585004][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.591896][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.599041][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.607149][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.614095][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.621831][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.630219][ T59] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.642922][ T294] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.654963][ T348] device veth0_vlan entered promiscuous mode [ 40.661612][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.669602][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.676881][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.689068][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.698000][ T348] device veth1_macvtap entered promiscuous mode [ 40.708185][ T294] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.720380][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.732756][ T28] audit: type=1400 audit(1695573421.044:161): avc: denied { mounton } for pid=348 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=370 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 40.768684][ T355] loop0: detected capacity change from 0 to 512 [ 40.775298][ T28] audit: type=1400 audit(1695573421.084:162): avc: denied { mounton } for pid=354 comm="syz-executor.0" path="/root/syzkaller-testdir2087771098/syzkaller.p0RHO2/0/file1" dev="sda1" ino=1939 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 40.808110][ T355] EXT4-fs (loop0): 1 orphan inode deleted [ 40.814230][ T355] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 40.823531][ T28] audit: type=1400 audit(1695573421.134:163): avc: denied { mount } for pid=354 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 40.826297][ T355] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/0/file1 supports timestamps until 2038 (0x7fffffff) [ 40.864463][ T28] audit: type=1400 audit(1695573421.174:164): avc: denied { write } for pid=354 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.886617][ T28] audit: type=1400 audit(1695573421.174:165): avc: denied { add_name } for pid=354 comm="syz-executor.0" name="memory.current" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.887120][ T8] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:0: lblock 0 mapped to illegal pblock 41 (length 16) [ 40.923394][ T8] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 40.935753][ T8] EXT4-fs (loop0): This should not happen!! Data will be lost [ 40.935753][ T8] [ 40.946713][ T348] EXT4-fs (loop0): unmounting filesystem. [ 40.956245][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 40.965223][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 40.987790][ T360] loop0: detected capacity change from 0 to 512 [ 40.997780][ T360] EXT4-fs (loop0): 1 orphan inode deleted [ 41.003332][ T360] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.012360][ T360] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/1/file1 supports timestamps until 2038 (0x7fffffff) [ 41.048538][ T8] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:0: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.062972][ T8] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.075444][ T8] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.075444][ T8] [ 41.086758][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.096349][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.105904][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.131473][ T364] loop0: detected capacity change from 0 to 512 [ 41.147683][ T364] EXT4-fs (loop0): 1 orphan inode deleted [ 41.153280][ T364] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.162442][ T364] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/2/file1 supports timestamps until 2038 (0x7fffffff) [ 41.187813][ T43] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:2: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.202670][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.215067][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.215067][ T43] [ 41.225867][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.236076][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.245067][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.271393][ T369] loop0: detected capacity change from 0 to 512 [ 41.288095][ T369] EXT4-fs (loop0): 1 orphan inode deleted [ 41.293824][ T369] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.303283][ T369] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/3/file1 supports timestamps until 2038 (0x7fffffff) [ 41.338350][ T10] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:1: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.353277][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.366153][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.366153][ T10] [ 41.377168][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.386236][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.395260][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.421902][ T374] loop0: detected capacity change from 0 to 512 [ 41.447890][ T374] EXT4-fs (loop0): 1 orphan inode deleted [ 41.453584][ T374] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.462475][ T374] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/4/file1 supports timestamps until 2038 (0x7fffffff) [ 41.496776][ T43] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:2: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.511218][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.523808][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.523808][ T43] [ 41.534768][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.540748][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.550136][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.574085][ T378] loop0: detected capacity change from 0 to 512 [ 41.587903][ T378] EXT4-fs (loop0): 1 orphan inode deleted [ 41.593527][ T378] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.602508][ T378] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/5/file1 supports timestamps until 2038 (0x7fffffff) [ 41.629248][ T43] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:2: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.643972][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.656262][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.656262][ T43] [ 41.667521][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.676297][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.685221][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.711178][ T382] loop0: detected capacity change from 0 to 512 [ 41.738325][ T382] EXT4-fs (loop0): 1 orphan inode deleted [ 41.744064][ T382] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.753655][ T382] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/6/file1 supports timestamps until 2038 (0x7fffffff) [ 41.781317][ T43] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:2: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.796716][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.809038][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.809038][ T43] [ 41.819986][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.826310][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.835316][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 41.861473][ T386] loop0: detected capacity change from 0 to 512 [ 41.878342][ T386] EXT4-fs (loop0): 1 orphan inode deleted [ 41.884159][ T386] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 41.893563][ T386] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/7/file1 supports timestamps until 2038 (0x7fffffff) [ 41.921991][ T10] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:1: lblock 0 mapped to illegal pblock 41 (length 16) [ 41.936830][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 41.949229][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 41.949229][ T10] [ 41.960032][ T348] EXT4-fs (loop0): unmounting filesystem. [ 41.966681][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 41.975607][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 42.000900][ T390] loop0: detected capacity change from 0 to 512 [ 42.018206][ T390] EXT4-fs (loop0): 1 orphan inode deleted [ 42.024137][ T390] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 42.033399][ T390] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/8/file1 supports timestamps until 2038 (0x7fffffff) [ 42.068957][ T43] EXT4-fs error (device loop0): ext4_map_blocks:731: inode #16: block 41: comm kworker/u4:2: lblock 0 mapped to illegal pblock 41 (length 16) [ 42.083877][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 0 with max blocks 16 with error 117 [ 42.096124][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 42.096124][ T43] [ 42.107658][ T348] EXT4-fs (loop0): unmounting filesystem. [ 42.116613][ T348] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5841: Out of memory [ 42.125765][ T348] EXT4-fs error (device loop0): ext4_quota_off:7027: inode #3: comm syz-executor.0: mark_inode_dirty error [ 42.151775][ T394] loop0: detected capacity change from 0 to 512 [ 42.168256][ T394] EXT4-fs (loop0): 1 orphan inode deleted [ 42.173954][ T394] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 42.183768][ T394] ext4 filesystem being mounted at /root/syzkaller-testdir2087771098/syzkaller.p0RHO2/9/file1 supports timestamps until 2038 (0x7fffffff) [ 42.217826][ T10] ================================================================== [ 42.225817][ T10] BUG: KASAN: use-after-free in ext4_find_extent+0xbab/0xdb0 [ 42.233171][ T10] Read of size 4 at addr ffff888126bba788 by task kworker/u4:1/10 [ 42.240972][ T10] [ 42.243173][ T10] CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.25-syzkaller-00999-g060ebb378d1c #0 [ 42.252677][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 42.262687][ T10] Workqueue: writeback wb_workfn (flush-7:0) [ 42.268505][ T10] Call Trace: [ 42.271771][ T10] [ 42.274574][ T10] dump_stack_lvl+0x151/0x1b7 [ 42.279068][ T10] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 42.284453][ T10] ? _printk+0xd1/0x111 [ 42.288524][ T10] ? __virt_addr_valid+0x242/0x2f0 [ 42.293784][ T10] print_report+0x158/0x4e0 [ 42.298115][ T10] ? __virt_addr_valid+0x242/0x2f0 [ 42.303869][ T10] ? kasan_addr_to_slab+0xd/0x80 [ 42.308627][ T10] ? ext4_find_extent+0xbab/0xdb0 [ 42.313500][ T10] kasan_report+0x13c/0x170 [ 42.317831][ T10] ? ext4_find_extent+0xbab/0xdb0 [ 42.323303][ T10] __asan_report_load4_noabort+0x14/0x20 [ 42.329479][ T10] ext4_find_extent+0xbab/0xdb0 [ 42.334552][ T10] ext4_ext_map_blocks+0x255/0x71e0 [ 42.339808][ T10] ? stack_trace_save+0x113/0x1c0 [ 42.344851][ T10] ? kasan_set_track+0x60/0x70 [ 42.349609][ T10] ? kasan_set_track+0x4b/0x70 [ 42.354172][ T10] ? kasan_save_alloc_info+0x1f/0x30 [ 42.359288][ T10] ? __kasan_slab_alloc+0x6c/0x80 [ 42.364369][ T10] ? slab_post_alloc_hook+0x53/0x2c0 [ 42.369480][ T10] ? kmem_cache_alloc+0x175/0x2c0 [ 42.375729][ T10] ? ext4_ext_release+0x10/0x10 [ 42.380668][ T10] ? writeback_sb_inodes+0xb33/0x18f0 [ 42.385859][ T10] ? wb_writeback+0x3b9/0x9f0 [ 42.390461][ T10] ? wb_workfn+0x399/0x1030 [ 42.394797][ T10] ? process_one_work+0x73d/0xcb0 [ 42.399745][ T10] ? worker_thread+0xa60/0x1260 [ 42.404535][ T10] ? kthread+0x26d/0x300 [ 42.408615][ T10] ? ret_from_fork+0x1f/0x30 [ 42.413047][ T10] ? _raw_read_unlock+0x25/0x40 [ 42.417727][ T10] ? ext4_es_lookup_extent+0x33b/0x950 [ 42.423257][ T10] ext4_map_blocks+0xa42/0x1ce0 [ 42.427944][ T10] ? kasan_save_alloc_info+0x1f/0x30 [ 42.433058][ T10] ? ext4_issue_zeroout+0x250/0x250 [ 42.438275][ T10] ? ext4_inode_journal_mode+0x1a5/0x470 [ 42.444469][ T10] ext4_writepages+0x17b5/0x3fd0 [ 42.449778][ T10] ? update_load_avg+0x513/0x1530 [ 42.454974][ T10] ? ext4_read_folio+0x240/0x240 [ 42.459826][ T10] ? check_preempt_wakeup+0x7ca/0xb30 [ 42.465160][ T10] ? raw_spin_rq_unlock+0x9/0x10 [ 42.470082][ T10] ? load_balance+0x502a/0x7c40 [ 42.474783][ T10] ? ext4_read_folio+0x240/0x240 [ 42.479540][ T10] do_writepages+0x385/0x620 [ 42.483974][ T10] ? __writepage+0x130/0x130 [ 42.488408][ T10] ? __kasan_check_write+0x14/0x20 [ 42.493346][ T10] __writeback_single_inode+0xdc/0xb80 [ 42.498653][ T10] writeback_sb_inodes+0xb33/0x18f0 [ 42.503672][ T10] ? queue_io+0x520/0x520 [ 42.507829][ T10] ? __writeback_inodes_wb+0x3f0/0x3f0 [ 42.513212][ T10] ? queue_io+0x3d0/0x520 [ 42.517382][ T10] ? memset+0x35/0x40 [ 42.521297][ T10] wb_writeback+0x3b9/0x9f0 [ 42.525628][ T10] ? inode_cgwb_move_to_attached+0x3c0/0x3c0 [ 42.531464][ T10] ? set_worker_desc+0x158/0x1c0 [ 42.536239][ T10] ? __kasan_check_write+0x14/0x20 [ 42.541340][ T10] wb_workfn+0x399/0x1030 [ 42.545506][ T10] ? inode_wait_for_writeback+0x280/0x280 [ 42.551054][ T10] ? native_set_ldt+0x130/0x130 [ 42.555740][ T10] ? kthread_data+0x53/0xc0 [ 42.560080][ T10] ? _raw_spin_unlock+0x4c/0x70 [ 42.564865][ T10] ? finish_task_switch+0x167/0x7b0 [ 42.569892][ T10] ? __kasan_check_read+0x11/0x20 [ 42.574765][ T10] ? read_word_at_a_time+0x12/0x20 [ 42.579816][ T10] ? strscpy+0x9c/0x260 [ 42.583911][ T10] process_one_work+0x73d/0xcb0 [ 42.588608][ T10] worker_thread+0xa60/0x1260 [ 42.593208][ T10] kthread+0x26d/0x300 [ 42.597277][ T10] ? worker_clr_flags+0x1a0/0x1a0 [ 42.602138][ T10] ? kthread_blkcg+0xd0/0xd0 [ 42.606561][ T10] ret_from_fork+0x1f/0x30 [ 42.611048][ T10] [ 42.613995][ T10] [ 42.616341][ T10] The buggy address belongs to the physical page: [ 42.622693][ T10] page:ffffea00049aee80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x126bba [ 42.633475][ T10] flags: 0x4000000000000000(zone=1) [ 42.639462][ T10] raw: 4000000000000000 ffffea00049aeec8 ffffea00049aee48 0000000000000000 [ 42.647879][ T10] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 42.656411][ T10] page dumped because: kasan: bad access detected [ 42.662857][ T10] page_owner info is not present (never set?) [ 42.669088][ T10] [ 42.671374][ T10] Memory state around the buggy address: [ 42.677109][ T10] ffff888126bba680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.685172][ T10] ffff888126bba700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.693067][ T10] >ffff888126bba780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.702070][ T10] ^ [ 42.706676][ T10] ffff888126bba800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.714913][ T10] ffff888126bba880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.723165][ T10] ================================================================== [ 42.734703][ T10] Disabling lock debugging due to kernel taint [ 42.740853][ T10] ------------[ cut here ]------------ [ 42.746321][ T10] kernel BUG at fs/ext4/inode.c:2433! [ 42.751728][ T10] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 42.757707][ T10] CPU: 1 PID: 10 Comm: kworker/u4:1 Tainted: G B 6.1.25-syzkaller-00999-g060ebb378d1c #0 [ 42.768727][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 42.778664][ T10] Workqueue: writeback wb_workfn (flush-7:0) [ 42.784438][ T10] RIP: 0010:ext4_writepages+0x3d6f/0x3fd0 [ 42.790103][ T10] Code: e8 b6 10 82 ff be 00 10 00 00 48 c7 c7 90 e4 6b 86 4c 89 f2 e8 12 5d ab 00 e9 0f fb ff ff e8 98 10 82 ff 0f 0b e8 91 10 82 ff <0f> 0b e8 4a 91 01 03 65 8b 05 4b 44 0f 7e 41 89 c7 4c 89 f8 48 c1 [ 42.809746][ T10] RSP: 0018:ffffc900000a7000 EFLAGS: 00010293 [ 42.815633][ T10] RAX: ffffffff81f2ccff RBX: dffffc0000000000 RCX: ffff88810037bcc0 [ 42.823620][ T10] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 42.831531][ T10] RBP: ffffc900000a7410 R08: ffffffff81f2aa0f R09: ffffed10200af74c [ 42.839333][ T10] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 [ 42.847229][ T10] R13: 0000000000000000 R14: ffff88810057ba98 R15: ffffc900000a72e0 [ 42.855038][ T10] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 42.863807][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.870227][ T10] CR2: 00005555566fa818 CR3: 000000010f5a2000 CR4: 00000000003506a0 [ 42.878045][ T10] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.885849][ T10] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.893663][ T10] Call Trace: [ 42.896790][ T10] [ 42.899569][ T10] ? update_load_avg+0x513/0x1530 [ 42.904435][ T10] ? ext4_read_folio+0x240/0x240 [ 42.909211][ T10] ? check_preempt_wakeup+0x7ca/0xb30 [ 42.914419][ T10] ? raw_spin_rq_unlock+0x9/0x10 [ 42.919183][ T10] ? load_balance+0x502a/0x7c40 [ 42.923883][ T10] ? ext4_read_folio+0x240/0x240 [ 42.929801][ T10] do_writepages+0x385/0x620 [ 42.934448][ T10] ? __writepage+0x130/0x130 [ 42.939073][ T10] ? __kasan_check_write+0x14/0x20 [ 42.944008][ T10] __writeback_single_inode+0xdc/0xb80 [ 42.949305][ T10] writeback_sb_inodes+0xb33/0x18f0 [ 42.954566][ T10] ? queue_io+0x520/0x520 [ 42.958889][ T10] ? __writeback_inodes_wb+0x3f0/0x3f0 [ 42.964422][ T10] ? queue_io+0x3d0/0x520 [ 42.968733][ T10] ? memset+0x35/0x40 [ 42.972854][ T10] wb_writeback+0x3b9/0x9f0 [ 42.978420][ T10] ? inode_cgwb_move_to_attached+0x3c0/0x3c0 [ 42.984219][ T10] ? set_worker_desc+0x158/0x1c0 [ 42.989160][ T10] ? __kasan_check_write+0x14/0x20 [ 42.994291][ T10] wb_workfn+0x399/0x1030 [ 42.998669][ T10] ? inode_wait_for_writeback+0x280/0x280 [ 43.004218][ T10] ? native_set_ldt+0x130/0x130 [ 43.008901][ T10] ? kthread_data+0x53/0xc0 [ 43.013341][ T10] ? _raw_spin_unlock+0x4c/0x70 [ 43.018024][ T10] ? finish_task_switch+0x167/0x7b0 [ 43.023078][ T10] ? __kasan_check_read+0x11/0x20 [ 43.027928][ T10] ? read_word_at_a_time+0x12/0x20 [ 43.033705][ T10] ? strscpy+0x9c/0x260 [ 43.037717][ T10] process_one_work+0x73d/0xcb0 [ 43.042918][ T10] worker_thread+0xa60/0x1260 [ 43.047667][ T10] kthread+0x26d/0x300 [ 43.051705][ T10] ? worker_clr_flags+0x1a0/0x1a0 [ 43.056989][ T10] ? kthread_blkcg+0xd0/0xd0 [ 43.061515][ T10] ret_from_fork+0x1f/0x30 [ 43.065885][ T10] [ 43.068915][ T10] Modules linked in: [ 43.074128][ T10] ---[ end trace 0000000000000000 ]--- [ 43.079886][ T10] RIP: 0010:ext4_writepages+0x3d6f/0x3fd0 [ 43.085403][ T10] Code: e8 b6 10 82 ff be 00 10 00 00 48 c7 c7 90 e4 6b 86 4c 89 f2 e8 12 5d ab 00 e9 0f fb ff ff e8 98 10 82 ff 0f 0b e8 91 10 82 ff <0f> 0b e8 4a 91 01 03 65 8b 05 4b 44 0f 7e 41 89 c7 4c 89 f8 48 c1 [ 43.108437][ T10] RSP: 0018:ffffc900000a7000 EFLAGS: 00010293 [ 43.114338][ T10] RAX: ffffffff81f2ccff RBX: dffffc0000000000 RCX: ffff88810037bcc0 [ 43.122380][ T10] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.130252][ T10] RBP: ffffc900000a7410 R08: ffffffff81f2aa0f R09: ffffed10200af74c [ 43.138183][ T10] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 [ 43.146254][ T10] R13: 0000000000000000 R14: ffff88810057ba98 R15: ffffc900000a72e0 [ 43.154064][ T10] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 43.163010][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.169603][ T10] CR2: 00005555566fa818 CR3: 000000010f5a2000 CR4: 00000000003506a0 [ 43.177466][ T10] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 43.185270][ T10] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 43.193662][ T10] Kernel panic - not syncing: Fatal exception [ 43.200158][ T10] Kernel Offset: disabled [ 43.204301][ T10] Rebooting in 86400 seconds..