==================================================================
BUG: KASAN: use-after-free in ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
Read of size 4 at addr ffff88812e352c94 by task kworker/u4:3/321

CPU: 1 PID: 321 Comm: kworker/u4:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: writeback wb_workfn (flush-7:2)
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
 ext4_ext_binsearch fs/ext4/extents.c:837 [inline]
 ext4_find_extent+0xbeb/0xe20 fs/ext4/extents.c:953
 ext4_ext_map_blocks+0x1da/0x6080 fs/ext4/extents.c:4166
 ext4_map_blocks+0x9cb/0x1b60 fs/ext4/inode.c:679
 mpage_map_one_extent fs/ext4/inode.c:2435 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2488 [inline]
 ext4_writepages+0x1260/0x3020 fs/ext4/inode.c:2856
 do_writepages+0x3a9/0x5e0 mm/page-writeback.c:2494
 __writeback_single_inode+0xc6/0xad0 fs/fs-writeback.c:1612
 writeback_sb_inodes+0x9b8/0x1550 fs/fs-writeback.c:1903
 wb_writeback+0x3f1/0x980 fs/fs-writeback.c:2079
 wb_do_writeback fs/fs-writeback.c:2226 [inline]
 wb_workfn+0x350/0xda0 fs/fs-writeback.c:2266
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 487:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:379 [inline]
 __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:388
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc+0xb1/0x1e0 mm/slab_common.c:951
 kmalloc_array include/linux/slab.h:615 [inline]
 kcalloc include/linux/slab.h:646 [inline]
 ext4_find_extent+0x36b/0xe20 fs/ext4/extents.c:914
 ext4_ext_map_blocks+0x1da/0x6080 fs/ext4/extents.c:4166
 ext4_map_blocks+0x9cb/0x1b60 fs/ext4/inode.c:679
 _ext4_get_block+0x1da/0x4e0 fs/ext4/inode.c:822
 ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:855
 ext4_block_write_begin+0x56e/0x1270 fs/ext4/inode.c:1124
 ext4_write_begin+0x5ee/0xf70 fs/ext4/ext4_jbd2.h:-1
 ext4_da_write_begin+0x3e1/0x8b0 fs/ext4/inode.c:3001
 generic_perform_write+0x2f6/0x6d0 mm/filemap.c:3882
 ext4_buffered_write_iter+0x36f/0x660 fs/ext4/file.c:285
 ext4_file_write_iter+0x18f/0x13d0 fs/ext4/file.c:-1
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5db/0xca0 fs/read_write.c:584
 ksys_pwrite64 fs/read_write.c:699 [inline]
 __do_sys_pwrite64 fs/read_write.c:709 [inline]
 __se_sys_pwrite64 fs/read_write.c:706 [inline]
 __x64_sys_pwrite64+0x191/0x220 fs/read_write.c:706
 x64_sys_call+0x36/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 487:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x31/0x50 mm/kasan/generic.c:516
 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:241
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
 kfree+0x6f/0xf0 mm/slab_common.c:990
 ext4_free_ext_path fs/ext4/extents.c:125 [inline]
 ext4_ext_map_blocks+0x2024/0x6080 fs/ext4/extents.c:4433
 ext4_map_blocks+0x9cb/0x1b60 fs/ext4/inode.c:679
 _ext4_get_block+0x1da/0x4e0 fs/ext4/inode.c:822
 ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:855
 ext4_block_write_begin+0x56e/0x1270 fs/ext4/inode.c:1124
 ext4_write_begin+0x5ee/0xf70 fs/ext4/ext4_jbd2.h:-1
 ext4_da_write_begin+0x3e1/0x8b0 fs/ext4/inode.c:3001
 generic_perform_write+0x2f6/0x6d0 mm/filemap.c:3882
 ext4_buffered_write_iter+0x36f/0x660 fs/ext4/file.c:285
 ext4_file_write_iter+0x18f/0x13d0 fs/ext4/file.c:-1
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5db/0xca0 fs/read_write.c:584
 ksys_pwrite64 fs/read_write.c:699 [inline]
 __do_sys_pwrite64 fs/read_write.c:709 [inline]
 __se_sys_pwrite64 fs/read_write.c:706 [inline]
 __x64_sys_pwrite64+0x191/0x220 fs/read_write.c:706
 x64_sys_call+0x36/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff88812e352c00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 148 bytes inside of
 192-byte region [ffff88812e352c00, ffff88812e352cc0)

The buggy address belongs to the physical page:
page:ffffea0004b8d480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e352
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042c00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 487, tgid 486 (syz.2.18), ts 51672636107, free_ts 50333159378
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2643
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2650
 get_page_from_freelist+0x2c7b/0x2cf0 mm/page_alloc.c:4554
 __alloc_pages+0x1c3/0x450 mm/page_alloc.c:5868
 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
 allocate_slab mm/slub.c:1967 [inline]
 new_slab+0x98/0x3d0 mm/slub.c:2020
 ___slab_alloc+0x6bd/0xb20 mm/slub.c:3177
 __slab_alloc+0x5e/0xa0 mm/slub.c:3263
 slab_alloc_node mm/slub.c:3348 [inline]
 __kmem_cache_alloc_node+0x203/0x2c0 mm/slub.c:3423
 __do_kmalloc_node mm/slab_common.c:937 [inline]
 __kmalloc+0xa1/0x1e0 mm/slab_common.c:951
 kmalloc_array include/linux/slab.h:615 [inline]
 kcalloc include/linux/slab.h:646 [inline]
 ext4_find_extent+0x36b/0xe20 fs/ext4/extents.c:914
 ext4_ext_map_blocks+0x1da/0x6080 fs/ext4/extents.c:4166
 ext4_map_blocks+0x9cb/0x1b60 fs/ext4/inode.c:679
 _ext4_get_block+0x1da/0x4e0 fs/ext4/inode.c:822
 ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:855
 ext4_block_write_begin+0x56e/0x1270 fs/ext4/inode.c:1124
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1551 [inline]
 free_pcp_prepare mm/page_alloc.c:1625 [inline]
 free_unref_page_prepare+0x742/0x750 mm/page_alloc.c:3589
 free_unref_page+0x8f/0x530 mm/page_alloc.c:3687
 free_the_page mm/page_alloc.c:836 [inline]
 __free_pages+0x67/0x100 mm/page_alloc.c:5957
 __vunmap+0x9af/0xb70 mm/vmalloc.c:2739
 __vfree mm/vmalloc.c:2788 [inline]
 vfree+0x61/0x90 mm/vmalloc.c:2819
 kcov_put kernel/kcov.c:437 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:533
 __fput+0x1fc/0x8f0 fs/file_table.c:320
 ____fput+0x15/0x20 fs/file_table.c:348
 task_work_run+0x1db/0x240 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0xa25/0x2650 kernel/exit.c:886
 do_group_exit+0x210/0x2d0 kernel/exit.c:1028
 get_signal+0x13b5/0x1520 kernel/signal.c:2889
 arch_do_signal_or_restart+0xb0/0x1030 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303

Memory state around the buggy address:
 ffff88812e352b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88812e352c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88812e352c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                         ^
 ffff88812e352d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88812e352d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 36 with max blocks 1 with error 117
EXT4-fs (loop2): This should not happen!! Data will be lost