EXT4-fs: Ignoring removed orlov option
EXT4-fs (loop5): stripe (1570) is not aligned with cluster size (16), stripe is disabled
EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
==================================================================
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
Read of size 4 at addr ffff888053a92c18 by task syz.5.609/8094

CPU: 1 UID: 0 PID: 8094 Comm: syz.5.609 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
 ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00014ea448 ffffea00014ea4c8 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
Read of size 2 at addr ffff888053a92c1c by task syz.5.609/8094

CPU: 0 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
 ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
Read of size 4 at addr ffff888053a92c18 by task syz.5.609/8094

CPU: 1 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
 ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
Read of size 2 at addr ffff888053a92c1c by task syz.5.609/8094

CPU: 1 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
 ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
Read of size 4 at addr ffff888053a92c18 by task syz.5.609/8094

CPU: 0 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_rm_leaf fs/ext4/extents.c:2623 [inline]
 ext4_ext_remove_space+0x4129/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
BUG: KASAN: use-after-free in ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
BUG: KASAN: use-after-free in ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
Read of size 2 at addr ffff888053a92c1c by task syz.5.609/8094

CPU: 0 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_get_actual_len fs/ext4/ext4_extents.h:212 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2624 [inline]
 ext4_ext_remove_space+0x42f6/0x4530 fs/ext4/extents.c:2961
 ext4_ext_truncate+0x246/0x300 fs/ext4/extents.c:4466
 ext4_truncate+0xde8/0x11e0 fs/ext4/inode.c:4243
 ext4_truncate_failed_write fs/ext4/truncate.h:22 [inline]
 ext4_write_end+0x9df/0xe40 fs/ext4/inode.c:1344
 ext4_da_write_end+0x507/0xdf0 fs/ext4/inode.c:3076
 generic_perform_write+0x271/0x930 mm/filemap.c:4135
 ext4_buffered_write_iter+0x119/0x440 fs/ext4/file.c:299
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ext4_ext_insert_extent+0x45d0/0x4610 fs/ext4/extents.c:2084
Read of size 4 at addr ffff888053a92c18 by task syz.5.609/8094

CPU: 1 UID: 0 PID: 8094 Comm: syz.5.609 Tainted: G    B               6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 ext4_ext_insert_extent+0x45d0/0x4610 fs/ext4/extents.c:2084
 ext4_split_extent_at+0x53d/0xfc0 fs/ext4/extents.c:3252
 ext4_split_extent+0x20b/0x660 fs/ext4/extents.c:3374
 ext4_split_convert_extents+0x2ff/0x3a0 fs/ext4/extents.c:3740
 ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3912 [inline]
 ext4_ext_map_blocks+0x2b77/0x5d60 fs/ext4/extents.c:4271
 ext4_map_create_blocks fs/ext4/inode.c:517 [inline]
 ext4_map_blocks+0x45b/0x1390 fs/ext4/inode.c:703
 mpage_map_one_extent fs/ext4/inode.c:2221 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2274 [inline]
 ext4_do_writepages+0x1a2c/0x3490 fs/ext4/inode.c:2736
 ext4_writepages+0x37a/0x7d0 fs/ext4/inode.c:2826
 do_writepages+0x1b5/0x820 mm/page-writeback.c:2687
 filemap_fdatawrite_wbc mm/filemap.c:389 [inline]
 filemap_fdatawrite_wbc+0x104/0x160 mm/filemap.c:379
 __filemap_fdatawrite_range+0xb2/0xf0 mm/filemap.c:422
 file_write_and_wait_range+0xca/0x140 mm/filemap.c:797
 generic_buffers_fsync_noflush+0x76/0x310 fs/buffer.c:600
 ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
 ext4_sync_file+0x896/0xf10 fs/ext4/fsync.c:147
 vfs_fsync_range+0x139/0x220 fs/sync.c:187
 generic_write_sync include/linux/fs.h:2976 [inline]
 ext4_buffered_write_iter+0x2e0/0x440 fs/ext4/file.c:305
 ext4_file_write_iter+0xa4c/0x1d10 fs/ext4/file.c:718
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x5bd/0x1180 fs/read_write.c:684
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f676b38d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f676c29f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f676b5a5fa0 RCX: 00007f676b38d169
RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f676b40e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f676b5a5fa0 R15: 00007fff6a3c6c98
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x63b pfn:0x53a92
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000063b 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 8101, tgid 8100 (syz.2.611), ts 374410304901, free_ts 375445017861
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1585
 prep_new_page mm/page_alloc.c:1593 [inline]
 get_page_from_freelist+0x10fc/0x35c0 mm/page_alloc.c:3538
 __alloc_frozen_pages_noprof+0x223/0x2370 mm/page_alloc.c:4806
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1863
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1902
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2545
 shmem_fault+0x204/0xb10 mm/shmem.c:2746
 __do_fault+0x10d/0x490 mm/memory.c:4994
 do_read_fault mm/memory.c:5414 [inline]
 do_fault mm/memory.c:5548 [inline]
 do_pte_missing+0xed5/0x3ea0 mm/memory.c:4059
 handle_pte_fault mm/memory.c:5893 [inline]
 __handle_mm_fault+0x1043/0x2a50 mm/memory.c:6036
 handle_mm_fault+0x404/0xae0 mm/memory.c:6205
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
page last free pid 8108 tgid 8100 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1130 [inline]
 free_unref_folios+0x999/0x15e0 mm/page_alloc.c:2764
 folios_put_refs+0x5af/0x800 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x58f/0x1150 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1352
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafe/0x2d90 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1103
 get_signal+0x2673/0x26d0 kernel/signal.c:3035
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337

Memory state around the buggy address:
 ffff888053a92b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888053a92c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff888053a92c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888053a92d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device loop5): ext4_ext_split:1078: inode #18: comm syz.5.609: p_ext > EXT_MAX_EXTENT!
EXT4-fs (loop5): Remounting filesystem read-only