EXT4-fs error (device loop0): ext4_get_group_desc:277: comm syz-executor.0: block_group >= groups_count - block_group = 4294963226, groups_count = 1
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]
BUG: KASAN: null-ptr-deref in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
BUG: KASAN: null-ptr-deref in do_raw_spin_lock include/linux/spinlock.h:187 [inline]
BUG: KASAN: null-ptr-deref in __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
BUG: KASAN: null-ptr-deref in _raw_spin_lock+0x97/0x1b0 kernel/locking/spinlock.c:154
Write of size 4 at addr 0000000000000000 by task syz-executor.0/11043
CPU: 1 PID: 11043 Comm: syz-executor.0 Not tainted 5.15.132-syzkaller-1068706-g754f8cc9b7de #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:431 [inline]
kasan_report+0x16f/0x1c0 mm/kasan/report.c:444
kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
do_raw_spin_lock include/linux/spinlock.h:187 [inline]
__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_lock+0x97/0x1b0 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
ext4_mb_release_context fs/ext4/mballoc.c:5510 [inline]
ext4_mb_new_blocks+0x17d4/0x43f0 fs/ext4/mballoc.c:5728
ext4_ext_map_blocks+0x1a0d/0x7250 fs/ext4/extents.c:4287
ext4_map_blocks+0xaa7/0x1e00 fs/ext4/inode.c:646
_ext4_get_block+0x23b/0x660 fs/ext4/inode.c:793
ext4_get_block+0x39/0x50 fs/ext4/inode.c:810
__block_write_begin_int+0x58a/0x1580 fs/buffer.c:2012
__block_write_begin+0x30/0x40 fs/buffer.c:2062
ext4_try_to_write_inline_data+0x7bb/0x11d0 fs/ext4/inline.c:756
ext4_write_begin+0x246/0x13d0 fs/ext4/inode.c:1168
ext4_da_write_begin+0x4a2/0xc30 fs/ext4/inode.c:2976
generic_perform_write+0x2bc/0x5a0 mm/filemap.c:3833
ext4_buffered_write_iter+0x48a/0x610 fs/ext4/file.c:270
ext4_file_write_iter+0x443/0x1c80
__kernel_write+0x5ab/0xa60 fs/read_write.c:539
__dump_emit+0x261/0x3a0 fs/coredump.c:875
dump_emit+0x381/0x3f0 fs/coredump.c:912
elf_core_dump+0x2ae9/0x3e80 fs/binfmt_elf.c:2240
do_coredump+0x1834/0x3050 fs/coredump.c:826
get_signal+0x4c8/0x1630 kernel/signal.c:2877
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
irqentry_exit_to_user_mode+0x9/0x20 kernel/entry/common.c:314
irqentry_exit+0x12/0x40 kernel/entry/common.c:405
exc_page_fault+0x47a/0x830 arch/x86/mm/fault.c:1608
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 002b:0000000020000473 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 0000000000000058 RCX: 00007fc197d2c959
RDX: 00007fc1978aefb0 RSI: 0000000000000058 RDI: 00007fc1978aefb0
RBP: 00007fc197d88c88 R08: 0000000000000000 R09: 0000000000000058
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fc197e4bf80 R15: 00007fff53f66418
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 11eab8067 P4D 11eab8067 PUD 1075b9067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11043 Comm: syz-executor.0 Tainted: G B 5.15.132-syzkaller-1068706-g754f8cc9b7de #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:513 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:187 [inline]
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
RIP: 0010:_raw_spin_lock+0xba/0x1b0 kernel/locking/spinlock.c:154
Code: 00 00 e8 e9 2a eb fc 4c 89 ff be 04 00 00 00 e8 dc 2a eb fc 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 41 0f b1 4d 00 75 33 48 c7 04 24 0e 36 e0 45 49 c7 04 1c 00 00
RSP: 0018:ffffc90001a3dc40 EFLAGS: 00010297
RAX: 0000000000000000 RBX: 1ffff92000347b88 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90001a3dc60
RBP: ffffc90001a3dcd0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000347b8c R11: dffffc0000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: 1ffff92000347b8c R15: ffffc90001a3dc60
FS: 00007fc1978af6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000122e28000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
spin_lock include/linux/spinlock.h:363 [inline]
ext4_mb_release_context fs/ext4/mballoc.c:5510 [inline]
ext4_mb_new_blocks+0x17d4/0x43f0 fs/ext4/mballoc.c:5728
ext4_ext_map_blocks+0x1a0d/0x7250 fs/ext4/extents.c:4287
ext4_map_blocks+0xaa7/0x1e00 fs/ext4/inode.c:646
_ext4_get_block+0x23b/0x660 fs/ext4/inode.c:793
ext4_get_block+0x39/0x50 fs/ext4/inode.c:810
__block_write_begin_int+0x58a/0x1580 fs/buffer.c:2012
__block_write_begin+0x30/0x40 fs/buffer.c:2062
ext4_try_to_write_inline_data+0x7bb/0x11d0 fs/ext4/inline.c:756
ext4_write_begin+0x246/0x13d0 fs/ext4/inode.c:1168
ext4_da_write_begin+0x4a2/0xc30 fs/ext4/inode.c:2976
generic_perform_write+0x2bc/0x5a0 mm/filemap.c:3833
ext4_buffered_write_iter+0x48a/0x610 fs/ext4/file.c:270
ext4_file_write_iter+0x443/0x1c80
__kernel_write+0x5ab/0xa60 fs/read_write.c:539
__dump_emit+0x261/0x3a0 fs/coredump.c:875
dump_emit+0x381/0x3f0 fs/coredump.c:912
elf_core_dump+0x2ae9/0x3e80 fs/binfmt_elf.c:2240
do_coredump+0x1834/0x3050 fs/coredump.c:826
get_signal+0x4c8/0x1630 kernel/signal.c:2877
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
irqentry_exit_to_user_mode+0x9/0x20 kernel/entry/common.c:314
irqentry_exit+0x12/0x40 kernel/entry/common.c:405
exc_page_fault+0x47a/0x830 arch/x86/mm/fault.c:1608
asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 002b:0000000020000473 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 0000000000000058 RCX: 00007fc197d2c959
RDX: 00007fc1978aefb0 RSI: 0000000000000058 RDI: 00007fc1978aefb0
RBP: 00007fc197d88c88 R08: 0000000000000000 R09: 0000000000000058
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fc197e4bf80 R15: 00007fff53f66418
Modules linked in:
CR2: 0000000000000000
---[ end trace 9bec7ae296db3dab ]---
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:513 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:187 [inline]
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
RIP: 0010:_raw_spin_lock+0xba/0x1b0 kernel/locking/spinlock.c:154
Code: 00 00 e8 e9 2a eb fc 4c 89 ff be 04 00 00 00 e8 dc 2a eb fc 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 41 0f b1 4d 00 75 33 48 c7 04 24 0e 36 e0 45 49 c7 04 1c 00 00
RSP: 0018:ffffc90001a3dc40 EFLAGS: 00010297
RAX: 0000000000000000 RBX: 1ffff92000347b88 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90001a3dc60
RBP: ffffc90001a3dcd0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000347b8c R11: dffffc0000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: 1ffff92000347b8c R15: ffffc90001a3dc60
FS: 00007fc1978af6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000122e28000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: e8 e9 2a eb fc call 0xfceb2af0
7: 4c 89 ff mov %r15,%rdi
a: be 04 00 00 00 mov $0x4,%esi
f: e8 dc 2a eb fc call 0xfceb2af0
14: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax
19: 84 c0 test %al,%al
1b: 0f 85 aa 00 00 00 jne 0xcb
21: 8b 44 24 20 mov 0x20(%rsp),%eax
25: b9 01 00 00 00 mov $0x1,%ecx
* 2a: f0 41 0f b1 4d 00 lock cmpxchg %ecx,0x0(%r13) <-- trapping instruction
30: 75 33 jne 0x65
32: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
39: 45
3a: 49 rex.WB
3b: c7 .byte 0xc7
3c: 04 1c add $0x1c,%al