program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x19}]}, &(0x7f0000000340)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r3, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000380)=ANY=[@ANYRES16=r4, @ANYRESDEC=r1, @ANYRES16, @ANYRES16=r2, @ANYRESDEC=0x0, @ANYRESOCT=r3], 0x841, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
write$FUSE_WRITE(r5, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 75.273838][ T4671] Bluetooth: hci0: command tx timeout
[ 75.363416][ T5322] loop0: detected capacity change from 0 to 1024
[ 75.386629][ T5322] =======================================================
[ 75.386629][ T5322] WARNING: The mand mount option has been deprecated and
[ 75.386629][ T5322] and is ignored by this kernel. Remove the mand
[ 75.386629][ T5322] option from the mount to silence this warning.
[ 75.386629][ T5322] =======================================================
[ 75.454985][ T5322] EXT4-fs: Ignoring removed oldalloc option
[ 75.461317][ T5322] EXT4-fs: Ignoring removed orlov option
[ 75.473494][ T5322] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[ 75.496831][ T5322] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 75.583537][ T5322] ==================================================================
[ 75.587068][ T5322] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[ 75.590227][ T5322] Read of size 4 at addr ffff88805223f52c by task syz.0.0/5322
[ 75.593484][ T5322]
[ 75.594531][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.594546][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.594553][ T5322] Call Trace:
[ 75.594562][ T5322]
[ 75.594567][ T5322] dump_stack_lvl+0x189/0x250
[ 75.594588][ T5322] ? __virt_addr_valid+0x1c8/0x5c0
[ 75.594612][ T5322] ? rcu_is_watching+0x15/0xb0
[ 75.594625][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.594639][ T5322] ? rcu_is_watching+0x15/0xb0
[ 75.594651][ T5322] ? lock_release+0x4b/0x3e0
[ 75.594661][ T5322] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 75.594714][ T5322] ? __virt_addr_valid+0x1c8/0x5c0
[ 75.594728][ T5322] ? __virt_addr_valid+0x4a5/0x5c0
[ 75.594743][ T5322] print_report+0xca/0x240
[ 75.594759][ T5322] ? ext4_find_extent+0xae6/0xcc0
[ 75.594769][ T5322] kasan_report+0x118/0x150
[ 75.594784][ T5322] ? ext4_find_extent+0xae6/0xcc0
[ 75.594795][ T5322] ext4_find_extent+0xae6/0xcc0
[ 75.594809][ T5322] ext4_ext_map_blocks+0x288/0x6ac0
[ 75.594826][ T5322] ? __lock_acquire+0xab9/0xd20
[ 75.594840][ T5322] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 75.594855][ T5322] ? ext4_es_lookup_extent+0x622/0xa70
[ 75.594868][ T5322] ext4_map_blocks+0x860/0x1740
[ 75.594884][ T5322] ? __pfx_ext4_map_blocks+0x10/0x10
[ 75.594896][ T5322] ? __pfx_hlock_conflict+0x10/0x10
[ 75.594909][ T5322] ? check_path+0x21/0x40
[ 75.594923][ T5322] _ext4_get_block+0x200/0x4c0
[ 75.594935][ T5322] ? __pfx__ext4_get_block+0x10/0x10
[ 75.594948][ T5322] ext4_get_block_unwritten+0x2e/0x100
[ 75.594960][ T5322] ext4_block_write_begin+0x993/0x1710
[ 75.594977][ T5322] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 75.594989][ T5322] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 75.595003][ T5322] ? folio_mapping+0x16f/0x1f0
[ 75.595013][ T5322] ? ext4_inode_journal_mode+0x18c/0x480
[ 75.595029][ T5322] ext4_write_begin+0xc04/0x19a0
[ 75.595046][ T5322] ? __pfx_ext4_write_begin+0x10/0x10
[ 75.595058][ T5322] ext4_da_write_begin+0x445/0xda0
[ 75.595071][ T5322] ? __pfx___might_resched+0x10/0x10
[ 75.595083][ T5322] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 75.595095][ T5322] generic_perform_write+0x2c5/0x900
[ 75.595109][ T5322] ? __pfx_generic_perform_write+0x10/0x10
[ 75.595118][ T5322] ? file_modified_flags+0x4bb/0x560
[ 75.595129][ T5322] ? ext4_write_checks+0x24b/0x2c0
[ 75.595142][ T5322] ext4_buffered_write_iter+0xce/0x3a0
[ 75.595156][ T5322] ext4_file_write_iter+0x298/0x1bc0
[ 75.595174][ T5322] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.595190][ T5322] vfs_write+0x5c9/0xb30
[ 75.595203][ T5322] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.595217][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 75.595231][ T5322] ? __fget_files+0x2a/0x420
[ 75.595246][ T5322] ksys_write+0x145/0x250
[ 75.595258][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 75.595271][ T5322] ? do_syscall_64+0xbe/0xfa0
[ 75.595284][ T5322] do_syscall_64+0xfa/0xfa0
[ 75.595296][ T5322] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.595308][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.595319][ T5322] ? clear_bhb_loop+0x60/0xb0
[ 75.595329][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.595340][ T5322] RIP: 0033:0x7f51b2d8efc9
[ 75.595352][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 75.595361][ T5322] RSP: 002b:00007f51b3b50038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 75.595373][ T5322] RAX: ffffffffffffffda RBX: 00007f51b2fe5fa0 RCX: 00007f51b2d8efc9
[ 75.595380][ T5322] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000008
[ 75.595387][ T5322] RBP: 00007f51b2e11f91 R08: 0000000000000000 R09: 0000000000000000
[ 75.595394][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.595400][ T5322] R13: 00007f51b2fe6038 R14: 00007f51b2fe5fa0 R15: 00007ffd5fe215f8
[ 75.595412][ T5322]
[ 75.595416][ T5322]
[ 75.755183][ T5322] The buggy address belongs to the physical page:
[ 75.757897][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5223f
[ 75.761528][ T5322] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 75.764828][ T5322] raw: 04fff00000000000 ffffea0001489008 ffffea0001488f88 0000000000000000
[ 75.768544][ T5322] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 75.772224][ T5322] page dumped because: kasan: bad access detected
[ 75.774970][ T5322] page_owner info is not present (never set?)
[ 75.777579][ T5322]
[ 75.778631][ T5322] Memory state around the buggy address:
[ 75.780897][ T5322] ffff88805223f400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.784008][ T5322] ffff88805223f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.787177][ T5322] >ffff88805223f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.790508][ T5322] ^
[ 75.792865][ T5322] ffff88805223f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.796355][ T5322] ffff88805223f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.799733][ T5322] ==================================================================
[ 75.812859][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.816005][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.819863][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.824880][ T5322] Call Trace:
[ 75.826752][ T5322]
[ 75.828329][ T5322] dump_stack_lvl+0x99/0x250
[ 75.830426][ T5322] ? __asan_memcpy+0x40/0x70
[ 75.832846][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.835176][ T5322] ? __pfx__printk+0x10/0x10
[ 75.837185][ T5322] vpanic+0x237/0x6d0
[ 75.838943][ T5322] ? __pfx_vpanic+0x10/0x10
[ 75.840906][ T5322] ? preempt_schedule+0xae/0xc0
[ 75.843063][ T5322] ? __pfx_preempt_schedule+0x10/0x10
[ 75.845391][ T5322] panic+0xb9/0xc0
[ 75.847044][ T5322] ? __pfx_panic+0x10/0x10
[ 75.849070][ T5322] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 75.851747][ T5322] ? is_module_address+0x17/0xf0
[ 75.854041][ T5322] ? ext4_find_extent+0xae6/0xcc0
[ 75.856290][ T5322] check_panic_on_warn+0x89/0xb0
[ 75.858501][ T5322] ? ext4_find_extent+0xae6/0xcc0
[ 75.860692][ T5322] end_report+0x78/0x160
[ 75.862578][ T5322] kasan_report+0x129/0x150
[ 75.864419][ T5322] ? ext4_find_extent+0xae6/0xcc0
[ 75.866389][ T5322] ext4_find_extent+0xae6/0xcc0
[ 75.868326][ T5322] ext4_ext_map_blocks+0x288/0x6ac0
[ 75.870476][ T5322] ? __lock_acquire+0xab9/0xd20
[ 75.872532][ T5322] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 75.874717][ T5322] ? ext4_es_lookup_extent+0x622/0xa70
[ 75.876981][ T5322] ext4_map_blocks+0x860/0x1740
[ 75.879022][ T5322] ? __pfx_ext4_map_blocks+0x10/0x10
[ 75.881247][ T5322] ? __pfx_hlock_conflict+0x10/0x10
[ 75.883476][ T5322] ? check_path+0x21/0x40
[ 75.885461][ T5322] _ext4_get_block+0x200/0x4c0
[ 75.887551][ T5322] ? __pfx__ext4_get_block+0x10/0x10
[ 75.890058][ T5322] ext4_get_block_unwritten+0x2e/0x100
[ 75.892707][ T5322] ext4_block_write_begin+0x993/0x1710
[ 75.895079][ T5322] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 75.897691][ T5322] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 75.900305][ T5322] ? folio_mapping+0x16f/0x1f0
[ 75.902404][ T5322] ? ext4_inode_journal_mode+0x18c/0x480
[ 75.904870][ T5322] ext4_write_begin+0xc04/0x19a0
[ 75.907105][ T5322] ? __pfx_ext4_write_begin+0x10/0x10
[ 75.909462][ T5322] ext4_da_write_begin+0x445/0xda0
[ 75.912003][ T5322] ? __pfx___might_resched+0x10/0x10
[ 75.914575][ T5322] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 75.917081][ T5322] generic_perform_write+0x2c5/0x900
[ 75.919541][ T5322] ? __pfx_generic_perform_write+0x10/0x10
[ 75.922089][ T5322] ? file_modified_flags+0x4bb/0x560
[ 75.924464][ T5322] ? ext4_write_checks+0x24b/0x2c0
[ 75.926762][ T5322] ext4_buffered_write_iter+0xce/0x3a0
[ 75.929094][ T5322] ext4_file_write_iter+0x298/0x1bc0
[ 75.931918][ T5322] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.934425][ T5322] vfs_write+0x5c9/0xb30
[ 75.936310][ T5322] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.938904][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 75.941072][ T5322] ? __fget_files+0x2a/0x420
[ 75.943145][ T5322] ksys_write+0x145/0x250
[ 75.945112][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 75.947021][ T5322] ? do_syscall_64+0xbe/0xfa0
[ 75.949149][ T5322] do_syscall_64+0xfa/0xfa0
[ 75.951152][ T5322] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.953548][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.956232][ T5322] ? clear_bhb_loop+0x60/0xb0
[ 75.958336][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.960981][ T5322] RIP: 0033:0x7f51b2d8efc9
[ 75.963074][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 75.971160][ T5322] RSP: 002b:00007f51b3b50038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 75.974767][ T5322] RAX: ffffffffffffffda RBX: 00007f51b2fe5fa0 RCX: 00007f51b2d8efc9
[ 75.978202][ T5322] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000008
[ 75.981617][ T5322] RBP: 00007f51b2e11f91 R08: 0000000000000000 R09: 0000000000000000
[ 75.985195][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.988702][ T5322] R13: 00007f51b2fe6038 R14: 00007f51b2fe5fa0 R15: 00007ffd5fe215f8
[ 75.992264][ T5322]
[ 75.993954][ T5322] Kernel Offset: disabled
[ 75.995920][ T5322] Rebooting in 86400 seconds..