Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k syz-executor.0 (1141) used greatest stack depth: 11440 bytes left EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,nombcache,noblock_validity,norecovery,debug_want_extra_isize=0x0000000000000080,lazytime,nodelalloc,usrquota,noauto_da_alloc,,errors=continue BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 PGD 800000022ec90067 P4D 800000022ec90067 PUD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 1612 Comm: syz-executor Not tainted 4.19.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1431 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1535 [inline] RIP: 0010:ext4_xattr_set_entry+0x805/0x10b0 fs/ext4/xattr.c:1663 Code: b8 88 07 00 00 e8 2b 10 e3 ff 49 8b 55 28 4c 8d 4d c8 31 c9 89 45 cc 49 8b 45 40 48 8b bd 68 ff ff ff 48 8b 52 68 44 8d 40 01 <48> 8b 72 58 6a 00 ba 80 81 00 00 6a 00 6a 00 68 00 00 20 00 e8 02 RSP: 0018:ffffc90002313928 EFLAGS: 00010246 RAX: 000000000000000c RBX: ffffc90002313b90 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffffc90002313a18 R08: 000000000000000d R09: ffffc900023139e0 R10: ffffffff81e4d300 R11: ffffffff81e4d700 R12: ffff880230f46420 R13: ffff88022ffbddd0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f3f979b1480(0000) GS:ffff880237a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000000230ade000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ext4_xattr_block_set+0x27a/0xde0 fs/ext4/xattr.c:1960 ext4_xattr_move_to_block fs/ext4/xattr.c:2611 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2678 [inline] ext4_expand_extra_isize_ea+0x3df/0x830 fs/ext4/xattr.c:2766 __ext4_expand_extra_isize.isra.14+0x71/0x90 fs/ext4/inode.c:5873 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5917 [inline] ext4_mark_inode_dirty+0x177/0x1f0 fs/ext4/inode.c:5993 ext4_dirty_inode+0x48/0x70 fs/ext4/inode.c:6027 __mark_inode_dirty+0x89/0x480 fs/fs-writeback.c:2129 mark_inode_dirty_sync include/linux/fs.h:2075 [inline] iput fs/inode.c:1570 [inline] iput+0x59/0x240 fs/inode.c:1559 dentry_unlink_inode+0xab/0xe0 fs/dcache.c:374 __dentry_kill+0xde/0x180 fs/dcache.c:566 shrink_dentry_list+0xe1/0x230 fs/dcache.c:1079 shrink_dcache_parent+0x87/0x90 fs/dcache.c:1490 do_one_tree+0xd/0x40 fs/dcache.c:1526 shrink_dcache_for_umount+0x28/0x80 fs/dcache.c:1543 generic_shutdown_super+0x1a/0x100 fs/super.c:441 kill_block_super+0x22/0x50 fs/super.c:1185 deactivate_locked_super+0x30/0x70 fs/super.c:329 deactivate_super fs/super.c:360 [inline] deactivate_super+0x4c/0x50 fs/super.c:356 cleanup_mnt+0x3a/0x70 fs/namespace.c:1098 __cleanup_mnt+0xd/0x10 fs/namespace.c:1105 task_work_run+0x8f/0xb0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0xd4/0xe0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x17a/0x180 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f3f96b3b217 Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffd82145328 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3f96b3b217 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd821453e0 RBP: 00007ffd821453e0 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd821464a0 R13: 00007f3f96b85336 R14: 000000000000b443 R15: 0000000000000005 Modules linked in: CR2: 0000000000000058 ---[ end trace 041aa697ecbfae54 ]--- RIP: 0010:ext4_xattr_inode_create fs/ext4/xattr.c:1431 [inline] RIP: 0010:ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1535 [inline] RIP: 0010:ext4_xattr_set_entry+0x805/0x10b0 fs/ext4/xattr.c:1663 Code: b8 88 07 00 00 e8 2b 10 e3 ff 49 8b 55 28 4c 8d 4d c8 31 c9 89 45 cc 49 8b 45 40 48 8b bd 68 ff ff ff 48 8b 52 68 44 8d 40 01 <48> 8b 72 58 6a 00 ba 80 81 00 00 6a 00 6a 00 68 00 00 20 00 e8 02 RSP: 0018:ffffc90002313928 EFLAGS: 00010246 RAX: 000000000000000c RBX: ffffc90002313b90 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffffc90002313a18 R08: 000000000000000d R09: ffffc900023139e0 R10: ffffffff81e4d300 R11: ffffffff81e4d700 R12: ffff880230f46420 R13: ffff88022ffbddd0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f3f979b1480(0000) GS:ffff880237a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000000230ade000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: b8 88 07 00 00 mov $0x788,%eax 5: e8 2b 10 e3 ff call 0xffe31035 a: 49 8b 55 28 mov 0x28(%r13),%rdx e: 4c 8d 4d c8 lea -0x38(%rbp),%r9 12: 31 c9 xor %ecx,%ecx 14: 89 45 cc mov %eax,-0x34(%rbp) 17: 49 8b 45 40 mov 0x40(%r13),%rax 1b: 48 8b bd 68 ff ff ff mov -0x98(%rbp),%rdi 22: 48 8b 52 68 mov 0x68(%rdx),%rdx 26: 44 8d 40 01 lea 0x1(%rax),%r8d * 2a: 48 8b 72 58 mov 0x58(%rdx),%rsi <-- trapping instruction 2e: 6a 00 push $0x0 30: ba 80 81 00 00 mov $0x8180,%edx 35: 6a 00 push $0x0 37: 6a 00 push $0x0 39: 68 00 00 20 00 push $0x200000 3e: e8 .byte 0xe8 3f: 02 .byte 0x2