program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x30000c6, &(0x7f0000000080), 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0)
ftruncate(r0, 0x2007ffc)
sendfile(r0, r0, 0x0, 0x800000009)
truncate(&(0x7f00000001c0)='./file1\x00', 0x401)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0), &(0x7f0000000080)=ANY=[], 0x841, 0x0)
unlink(&(0x7f0000000180)='./file1\x00')
creat(&(0x7f0000000340)='./file1\x00', 0x104)

[   84.451173][   T45] Bluetooth: hci0: command tx timeout
[   84.562151][ T5325] loop0: detected capacity change from 0 to 1024
[   84.588481][ T5325] =======================================================
[   84.588481][ T5325] WARNING: The mand mount option has been deprecated and
[   84.588481][ T5325]          and is ignored by this kernel. Remove the mand
[   84.588481][ T5325]          option from the mount to silence this warning.
[   84.588481][ T5325] =======================================================
[   84.663755][ T5325] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   84.701414][   T24] audit: type=1800 audit(1773783989.168:2): pid=5325 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=15 res=0 errno=0
[   84.777125][ T5324] ==================================================================
[   84.780644][ T5324] BUG: KASAN: use-after-free in ext4_ext_remove_space+0x3170/0x4280
[   84.785258][ T5324] Read of size 4 at addr ffff88801fcf9c18 by task syz.0.0/5324
[   84.789891][ T5324] 
[   84.791271][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   84.791291][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   84.791300][ T5324] Call Trace:
[   84.791309][ T5324]  <TASK>
[   84.791316][ T5324]  dump_stack_lvl+0xe8/0x150
[   84.791341][ T5324]  print_report+0xba/0x230
[   84.791356][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   84.791371][ T5324]  kasan_report+0x117/0x150
[   84.791387][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   84.791401][ T5324]  ext4_ext_remove_space+0x3170/0x4280
[   84.791417][ T5324]  ? __es_remove_extent+0x13d3/0x1da0
[   84.791437][ T5324]  ? __pfx_ext4_ext_remove_space+0x10/0x10
[   84.791451][ T5324]  ? ext4_es_remove_extent+0x2a7/0x4c0
[   84.791468][ T5324]  ext4_ext_truncate+0x17e/0x2f0
[   84.791482][ T5324]  ext4_truncate+0xb63/0x13b0
[   84.791500][ T5324]  ? __pfx_ext4_truncate+0x10/0x10
[   84.791516][ T5324]  ext4_evict_inode+0x863/0xeb0
[   84.791533][ T5324]  ? __pfx_ext4_evict_inode+0x10/0x10
[   84.791549][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[   84.791562][ T5324]  ? __pfx_ext4_evict_inode+0x10/0x10
[   84.791577][ T5324]  evict+0x61e/0xb10
[   84.791590][ T5324]  ? __pfx_evict+0x10/0x10
[   84.791600][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[   84.791628][ T5324]  ? _raw_spin_unlock+0x28/0x50
[   84.791709][ T5324]  ? iput+0xb25/0xe80
[   84.791725][ T5324]  __dentry_kill+0x1a2/0x5e0
[   84.791738][ T5324]  ? finish_dput+0xad/0x480
[   84.791752][ T5324]  finish_dput+0xc9/0x480
[   84.791767][ T5324]  __fput+0x691/0xa70
[   84.791786][ T5324]  task_work_run+0x1d9/0x270
[   84.791800][ T5324]  ? __pfx_task_work_run+0x10/0x10
[   84.791813][ T5324]  exit_to_user_mode_loop+0xed/0x480
[   84.791828][ T5324]  ? rcu_is_watching+0x15/0xb0
[   84.791845][ T5324]  do_syscall_64+0x32d/0xf80
[   84.791857][ T5324]  ? trace_irq_disable+0x3b/0x150
[   84.791873][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.791887][ T5324]  ? clear_bhb_loop+0x40/0x90
[   84.791899][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.791912][ T5324] RIP: 0033:0x7f493999c799
[   84.791948][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   84.791958][ T5324] RSP: 002b:00007ffe07ab8698 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[   84.791974][ T5324] RAX: 0000000000000000 RBX: 00007ffe07ab8780 RCX: 00007f493999c799
[   84.791982][ T5324] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[   84.791987][ T5324] RBP: 0000000000014973 R08: 0000000000000001 R09: 0000000000000000
[   84.791994][ T5324] R10: 00007f49397ff03c R11: 0000000000000246 R12: 00007ffe07ab87c0
[   84.792001][ T5324] R13: 00007f4939c15fac R14: 0000000000014ab0 R15: 00007f4939c15fa0
[   84.792011][ T5324]  </TASK>
[   84.792016][ T5324] 
[   84.922551][ T5324] The buggy address belongs to the physical page:
[   84.926394][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1e pfn:0x1fcf9
[   84.930632][ T5324] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   84.933765][ T5324] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
[   84.937413][ T5324] raw: 000000000000001e 0000000000000000 00000000ffffffff 0000000000000000
[   84.941900][ T5324] page dumped because: kasan: bad access detected
[   84.945705][ T5324] page_owner tracks the page as freed
[   84.948390][ T5324] page last allocated via order 0, migratetype Movable, gfp_mask 0x152c4a(GFP_NOFS|__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 1, tgid 1 (init), ts 30912906097, free_ts 81303817116
[   84.957971][ T5324]  post_alloc_hook+0x231/0x280
[   84.960565][ T5324]  get_page_from_freelist+0x24dc/0x2580
[   84.963880][ T5324]  __alloc_frozen_pages_noprof+0x18d/0x380
[   84.966692][ T5324]  alloc_pages_mpol+0x232/0x4a0
[   84.968868][ T5324]  alloc_pages_noprof+0xa8/0x190
[   84.971081][ T5324]  folio_alloc_noprof+0x1e/0x30
[   84.973349][ T5324]  filemap_alloc_folio_noprof+0x111/0x470
[   84.976039][ T5324]  page_cache_ra_unbounded+0x39b/0xa50
[   84.978707][ T5324]  page_cache_ra_order+0xaf2/0xeb0
[   84.981395][ T5324]  filemap_get_pages+0x897/0x1f10
[   84.983858][ T5324]  filemap_read+0x447/0x1230
[   84.986034][ T5324]  __kernel_read+0x504/0x9b0
[   84.988215][ T5324]  integrity_kernel_read+0x89/0xd0
[   84.990883][ T5324]  ima_calc_file_hash+0x12c3/0x17f0
[   84.993821][ T5324]  ima_collect_measurement+0x48b/0x930
[   84.996547][ T5324]  process_measurement+0x12cd/0x1c80
[   84.998942][ T5324] page last free pid 77 tgid 77 stack trace:
[   85.001638][ T5324]  free_unref_folios+0xed5/0x16d0
[   85.004022][ T5324]  shrink_folio_list+0x4a6b/0x5290
[   85.006776][ T5324]  evict_folios+0x4795/0x5880
[   85.009089][ T5324]  try_to_shrink_lruvec+0xb62/0xfa0
[   85.011406][ T5324]  shrink_one+0x25c/0x710
[   85.013311][ T5324]  shrink_node+0x3197/0x3a90
[   85.015340][ T5324]  kswapd+0x1742/0x2e10
[   85.017202][ T5324]  kthread+0x388/0x470
[   85.019640][ T5324]  ret_from_fork+0x51e/0xb90
[   85.022840][ T5324]  ret_from_fork_asm+0x1a/0x30
[   85.025240][ T5324] 
[   85.026357][ T5324] Memory state around the buggy address:
[   85.028600][ T5324]  ffff88801fcf9b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   85.031871][ T5324]  ffff88801fcf9b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   85.035072][ T5324] >ffff88801fcf9c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   85.038842][ T5324]                             ^
[   85.041556][ T5324]  ffff88801fcf9c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   85.045057][ T5324]  ffff88801fcf9d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   85.048421][ T5324] ==================================================================
[   85.067760][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   85.071281][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   85.075840][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   85.080442][ T5324] Call Trace:
[   85.081989][ T5324]  <TASK>
[   85.083357][ T5324]  vpanic+0x56c/0xa60
[   85.085192][ T5324]  ? __pfx_vpanic+0x10/0x10
[   85.087526][ T5324]  panic+0xc5/0xd0
[   85.089731][ T5324]  ? __pfx_panic+0x10/0x10
[   85.092301][ T5324]  ? preempt_schedule_thunk+0x16/0x30
[   85.094915][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   85.097489][ T5324]  ? preempt_schedule_thunk+0x16/0x30
[   85.099728][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   85.101943][ T5324]  check_panic_on_warn+0x89/0xb0
[   85.104099][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   85.106649][ T5324]  end_report+0x73/0x180
[   85.108699][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   85.111452][ T5324]  kasan_report+0x128/0x150
[   85.113750][ T5324]  ? ext4_ext_remove_space+0x3170/0x4280
[   85.116314][ T5324]  ext4_ext_remove_space+0x3170/0x4280
[   85.118708][ T5324]  ? __es_remove_extent+0x13d3/0x1da0
[   85.121275][ T5324]  ? __pfx_ext4_ext_remove_space+0x10/0x10
[   85.124071][ T5324]  ? ext4_es_remove_extent+0x2a7/0x4c0
[   85.126809][ T5324]  ext4_ext_truncate+0x17e/0x2f0
[   85.129322][ T5324]  ext4_truncate+0xb63/0x13b0
[   85.131575][ T5324]  ? __pfx_ext4_truncate+0x10/0x10
[   85.133788][ T5324]  ext4_evict_inode+0x863/0xeb0
[   85.135908][ T5324]  ? __pfx_ext4_evict_inode+0x10/0x10
[   85.138283][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[   85.140793][ T5324]  ? __pfx_ext4_evict_inode+0x10/0x10
[   85.143471][ T5324]  evict+0x61e/0xb10
[   85.145291][ T5324]  ? __pfx_evict+0x10/0x10
[   85.147287][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[   85.149615][ T5324]  ? _raw_spin_unlock+0x28/0x50
[   85.151985][ T5324]  ? iput+0xb25/0xe80
[   85.154021][ T5324]  __dentry_kill+0x1a2/0x5e0
[   85.156406][ T5324]  ? finish_dput+0xad/0x480
[   85.158581][ T5324]  finish_dput+0xc9/0x480
[   85.160589][ T5324]  __fput+0x691/0xa70
[   85.162362][ T5324]  task_work_run+0x1d9/0x270
[   85.164413][ T5324]  ? __pfx_task_work_run+0x10/0x10
[   85.166835][ T5324]  exit_to_user_mode_loop+0xed/0x480
[   85.169622][ T5324]  ? rcu_is_watching+0x15/0xb0
[   85.172106][ T5324]  do_syscall_64+0x32d/0xf80
[   85.174264][ T5324]  ? trace_irq_disable+0x3b/0x150
[   85.176441][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.179108][ T5324]  ? clear_bhb_loop+0x40/0x90
[   85.181229][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.184122][ T5324] RIP: 0033:0x7f493999c799
[   85.186338][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   85.195032][ T5324] RSP: 002b:00007ffe07ab8698 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[   85.198912][ T5324] RAX: 0000000000000000 RBX: 00007ffe07ab8780 RCX: 00007f493999c799
[   85.203024][ T5324] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[   85.206728][ T5324] RBP: 0000000000014973 R08: 0000000000000001 R09: 0000000000000000
[   85.209824][ T5324] R10: 00007f49397ff03c R11: 0000000000000246 R12: 00007ffe07ab87c0
[   85.213413][ T5324] R13: 00007f4939c15fac R14: 0000000000014ab0 R15: 00007f4939c15fa0
[   85.217880][ T5324]  </TASK>
[   85.219679][ T5324] Kernel Offset: disabled
[   85.221765][ T5324] Rebooting in 86400 seconds..