program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x12, r1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc) (async)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000001040)=ANY=[], 0x841, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
write$FUSE_WRITE(r3, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 75.570295][ T5337] Bluetooth: hci0: command tx timeout
[ 75.659255][ T5360] loop0: detected capacity change from 0 to 1024
[ 75.669026][ T5360] =======================================================
[ 75.669026][ T5360] WARNING: The mand mount option has been deprecated and
[ 75.669026][ T5360] and is ignored by this kernel. Remove the mand
[ 75.669026][ T5360] option from the mount to silence this warning.
[ 75.669026][ T5360] =======================================================
[ 75.716097][ T5360] EXT4-fs: Ignoring removed oldalloc option
[ 75.718578][ T5360] EXT4-fs: Ignoring removed orlov option
[ 75.727871][ T5360] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[ 75.767155][ T5360] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 75.795398][ T5365] ==================================================================
[ 75.798441][ T5365] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[ 75.801507][ T5365] Read of size 4 at addr ffff88804ce53018 by task syz.0.0/5365
[ 75.804362][ T5365]
[ 75.805524][ T5365] CPU: 0 UID: 0 PID: 5365 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.805540][ T5365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.805547][ T5365] Call Trace:
[ 75.805554][ T5365]
[ 75.805561][ T5365] dump_stack_lvl+0x189/0x250
[ 75.805580][ T5365] ? __virt_addr_valid+0x1c8/0x5c0
[ 75.805596][ T5365] ? rcu_is_watching+0x15/0xb0
[ 75.805609][ T5365] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.805623][ T5365] ? rcu_is_watching+0x15/0xb0
[ 75.805634][ T5365] ? lock_release+0x4b/0x3e0
[ 75.805651][ T5365] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 75.805705][ T5365] ? __virt_addr_valid+0x1c8/0x5c0
[ 75.805720][ T5365] ? __virt_addr_valid+0x4a5/0x5c0
[ 75.805734][ T5365] print_report+0xca/0x240
[ 75.805747][ T5365] ? ext4_find_extent+0xae6/0xcc0
[ 75.805763][ T5365] kasan_report+0x118/0x150
[ 75.805779][ T5365] ? ext4_find_extent+0xae6/0xcc0
[ 75.805796][ T5365] ext4_find_extent+0xae6/0xcc0
[ 75.805815][ T5365] ext4_ext_map_blocks+0x288/0x6ac0
[ 75.805837][ T5365] ? __lock_acquire+0xab9/0xd20
[ 75.805856][ T5365] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 75.805878][ T5365] ? ext4_es_lookup_extent+0x622/0xa70
[ 75.805892][ T5365] ext4_map_blocks+0x860/0x1740
[ 75.805907][ T5365] ? __pfx_ext4_map_blocks+0x10/0x10
[ 75.805919][ T5365] ? __mutex_trylock_common+0x153/0x260
[ 75.805932][ T5365] ? __pfx___mutex_trylock_common+0x10/0x10
[ 75.805943][ T5365] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 75.805960][ T5365] ? rcu_is_watching+0x15/0xb0
[ 75.805973][ T5365] _ext4_get_block+0x200/0x4c0
[ 75.805986][ T5365] ? __pfx__ext4_get_block+0x10/0x10
[ 75.806002][ T5365] ext4_get_block_unwritten+0x2e/0x100
[ 75.806022][ T5365] ext4_block_write_begin+0x990/0x1710
[ 75.806040][ T5365] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 75.806052][ T5365] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 75.806066][ T5365] ? folio_mapping+0x16f/0x240
[ 75.806077][ T5365] ? ext4_inode_journal_mode+0x18c/0x480
[ 75.806092][ T5365] ext4_write_begin+0xc04/0x19a0
[ 75.806182][ T5365] ? __pfx_ext4_write_begin+0x10/0x10
[ 75.806226][ T5365] ext4_da_write_begin+0x445/0xda0
[ 75.806284][ T5365] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[ 75.806393][ T5365] ? file_remove_privs_flags+0x3b1/0x5f0
[ 75.806437][ T5365] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 75.806450][ T5365] generic_perform_write+0x2c5/0x900
[ 75.806466][ T5365] ? __pfx_generic_perform_write+0x10/0x10
[ 75.806476][ T5365] ? file_modified_flags+0x374/0x560
[ 75.806488][ T5365] ? ext4_write_checks+0x24b/0x2c0
[ 75.806528][ T5365] ext4_buffered_write_iter+0xce/0x3a0
[ 75.806543][ T5365] ext4_file_write_iter+0x298/0x1bc0
[ 75.806562][ T5365] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.806579][ T5365] vfs_write+0x5c6/0xb30
[ 75.806593][ T5365] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.806605][ T5365] ? __pfx_vfs_write+0x10/0x10
[ 75.806620][ T5365] ? __fget_files+0x2a/0x420
[ 75.806637][ T5365] ksys_write+0x145/0x250
[ 75.806650][ T5365] ? __pfx_ksys_write+0x10/0x10
[ 75.806661][ T5365] ? rcu_is_watching+0x15/0xb0
[ 75.806673][ T5365] ? do_syscall_64+0xbe/0x3b0
[ 75.806686][ T5365] do_syscall_64+0xfa/0x3b0
[ 75.806697][ T5365] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.806714][ T5365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.806725][ T5365] ? clear_bhb_loop+0x60/0xb0
[ 75.806738][ T5365] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.806750][ T5365] RIP: 0033:0x7f0ab118eba9
[ 75.806761][ T5365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 75.806771][ T5365] RSP: 002b:00007f0ab1f87038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 75.806785][ T5365] RAX: ffffffffffffffda RBX: 00007f0ab13d6180 RCX: 00007f0ab118eba9
[ 75.806793][ T5365] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[ 75.806801][ T5365] RBP: 00007f0ab1211e19 R08: 0000000000000000 R09: 0000000000000000
[ 75.806808][ T5365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.806815][ T5365] R13: 00007f0ab13d6218 R14: 00007f0ab13d6180 R15: 00007ffc7618cad8
[ 75.806828][ T5365]
[ 75.806832][ T5365]
[ 75.958924][ T5365] The buggy address belongs to the physical page:
[ 75.961394][ T5365] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ce53
[ 75.964689][ T5365] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 75.967382][ T5365] raw: 04fff00000000000 ffffea00013394c8 ffffea00013394c8 0000000000000000
[ 75.970865][ T5365] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 75.974214][ T5365] page dumped because: kasan: bad access detected
[ 75.976634][ T5365] page_owner info is not present (never set?)
[ 75.979004][ T5365]
[ 75.979945][ T5365] Memory state around the buggy address:
[ 75.982049][ T5365] ffff88804ce52f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.985024][ T5365] ffff88804ce52f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.988095][ T5365] >ffff88804ce53000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.991080][ T5365] ^
[ 75.993090][ T5365] ffff88804ce53080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.996175][ T5365] ffff88804ce53100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.999449][ T5365] ==================================================================
[ 76.009812][ T5365] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 76.012846][ T5365] CPU: 0 UID: 0 PID: 5365 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 76.016524][ T5365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.021098][ T5365] Call Trace:
[ 76.022570][ T5365]
[ 76.023884][ T5365] dump_stack_lvl+0x99/0x250
[ 76.025905][ T5365] ? __asan_memcpy+0x40/0x70
[ 76.027891][ T5365] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.030135][ T5365] ? __pfx__printk+0x10/0x10
[ 76.032063][ T5365] vpanic+0x281/0x750
[ 76.033715][ T5365] ? preempt_schedule+0xae/0xc0
[ 76.035781][ T5365] ? __pfx_vpanic+0x10/0x10
[ 76.037684][ T5365] ? preempt_schedule_common+0x83/0xd0
[ 76.039918][ T5365] ? preempt_schedule+0xae/0xc0
[ 76.041899][ T5365] ? __pfx_preempt_schedule+0x10/0x10
[ 76.044211][ T5365] panic+0xb9/0xc0
[ 76.045856][ T5365] ? __pfx_panic+0x10/0x10
[ 76.047819][ T5365] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 76.050362][ T5365] ? is_module_address+0x17/0xf0
[ 76.052540][ T5365] ? ext4_find_extent+0xae6/0xcc0
[ 76.054726][ T5365] check_panic_on_warn+0x89/0xb0
[ 76.056835][ T5365] ? ext4_find_extent+0xae6/0xcc0
[ 76.058905][ T5365] end_report+0x78/0x160
[ 76.060753][ T5365] kasan_report+0x129/0x150
[ 76.062716][ T5365] ? ext4_find_extent+0xae6/0xcc0
[ 76.064913][ T5365] ext4_find_extent+0xae6/0xcc0
[ 76.067019][ T5365] ext4_ext_map_blocks+0x288/0x6ac0
[ 76.069211][ T5365] ? __lock_acquire+0xab9/0xd20
[ 76.071315][ T5365] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 76.073685][ T5365] ? ext4_es_lookup_extent+0x622/0xa70
[ 76.076056][ T5365] ext4_map_blocks+0x860/0x1740
[ 76.078098][ T5365] ? __pfx_ext4_map_blocks+0x10/0x10
[ 76.080366][ T5365] ? __mutex_trylock_common+0x153/0x260
[ 76.082762][ T5365] ? __pfx___mutex_trylock_common+0x10/0x10
[ 76.085327][ T5365] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 76.087751][ T5365] ? rcu_is_watching+0x15/0xb0
[ 76.089838][ T5365] _ext4_get_block+0x200/0x4c0
[ 76.091978][ T5365] ? __pfx__ext4_get_block+0x10/0x10
[ 76.094309][ T5365] ext4_get_block_unwritten+0x2e/0x100
[ 76.096640][ T5365] ext4_block_write_begin+0x990/0x1710
[ 76.098985][ T5365] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 76.101557][ T5365] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 76.104053][ T5365] ? folio_mapping+0x16f/0x240
[ 76.106107][ T5365] ? ext4_inode_journal_mode+0x18c/0x480
[ 76.108538][ T5365] ext4_write_begin+0xc04/0x19a0
[ 76.110725][ T5365] ? __pfx_ext4_write_begin+0x10/0x10
[ 76.113030][ T5365] ext4_da_write_begin+0x445/0xda0
[ 76.115289][ T5365] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[ 76.118085][ T5365] ? file_remove_privs_flags+0x3b1/0x5f0
[ 76.120469][ T5365] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 76.122859][ T5365] generic_perform_write+0x2c5/0x900
[ 76.125188][ T5365] ? __pfx_generic_perform_write+0x10/0x10
[ 76.127783][ T5365] ? file_modified_flags+0x374/0x560
[ 76.130106][ T5365] ? ext4_write_checks+0x24b/0x2c0
[ 76.132377][ T5365] ext4_buffered_write_iter+0xce/0x3a0
[ 76.134760][ T5365] ext4_file_write_iter+0x298/0x1bc0
[ 76.137056][ T5365] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 76.139557][ T5365] vfs_write+0x5c6/0xb30
[ 76.141433][ T5365] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 76.143988][ T5365] ? __pfx_vfs_write+0x10/0x10
[ 76.146045][ T5365] ? __fget_files+0x2a/0x420
[ 76.148133][ T5365] ksys_write+0x145/0x250
[ 76.150052][ T5365] ? __pfx_ksys_write+0x10/0x10
[ 76.151980][ T5365] ? rcu_is_watching+0x15/0xb0
[ 76.153862][ T5365] ? do_syscall_64+0xbe/0x3b0
[ 76.155891][ T5365] do_syscall_64+0xfa/0x3b0
[ 76.157881][ T5365] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.160140][ T5365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.162717][ T5365] ? clear_bhb_loop+0x60/0xb0
[ 76.164806][ T5365] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.167312][ T5365] RIP: 0033:0x7f0ab118eba9
[ 76.169281][ T5365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 76.177531][ T5365] RSP: 002b:00007f0ab1f87038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 76.181202][ T5365] RAX: ffffffffffffffda RBX: 00007f0ab13d6180 RCX: 00007f0ab118eba9
[ 76.184632][ T5365] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[ 76.188213][ T5365] RBP: 00007f0ab1211e19 R08: 0000000000000000 R09: 0000000000000000
[ 76.191691][ T5365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.195180][ T5365] R13: 00007f0ab13d6218 R14: 00007f0ab13d6180 R15: 00007ffc7618cad8
[ 76.198617][ T5365]
[ 76.200309][ T5365] Kernel Offset: disabled
[ 76.202228][ T5365] Rebooting in 86400 seconds..