program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000240)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noauto_da_alloc}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007180)=[{{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001040)="3c56a9", 0x3}], 0x1}}], 0x1, 0x4800)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002080), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x34, r3, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8}]}, 0x34}}, 0x0)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000100), &(0x7f0000000180)=ANY=[@ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0], 0x841, 0x0)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0xfaeb)
[ 74.370579][ T4663] Bluetooth: hci0: command tx timeout
[ 74.486216][ T5314] loop0: detected capacity change from 0 to 1024
[ 74.492496][ T5314] =======================================================
[ 74.492496][ T5314] WARNING: The mand mount option has been deprecated and
[ 74.492496][ T5314] and is ignored by this kernel. Remove the mand
[ 74.492496][ T5314] option from the mount to silence this warning.
[ 74.492496][ T5314] =======================================================
[ 74.536179][ T5314] EXT4-fs: Ignoring removed oldalloc option
[ 74.538778][ T5314] EXT4-fs: Ignoring removed orlov option
[ 74.550578][ T5314] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[ 74.578617][ T5314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 74.619410][ T5314] ==================================================================
[ 74.622884][ T5314] BUG: KASAN: use-after-free in ext4_find_extent+0xaea/0xcc0
[ 74.626311][ T5314] Read of size 4 at addr ffff888050b1552c by task syz.0.0/5314
[ 74.629313][ T5314]
[ 74.630443][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 74.630458][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 74.630466][ T5314] Call Trace:
[ 74.630472][ T5314]
[ 74.630478][ T5314] dump_stack_lvl+0xe8/0x150
[ 74.630500][ T5314] print_report+0xba/0x230
[ 74.630514][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.630527][ T5314] kasan_report+0x117/0x150
[ 74.630539][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.630553][ T5314] ext4_find_extent+0xaea/0xcc0
[ 74.630566][ T5314] ext4_ext_map_blocks+0x283/0x58b0
[ 74.630578][ T5314] ? kernel_text_address+0xa5/0xe0
[ 74.630592][ T5314] ? check_path+0x21/0x40
[ 74.630610][ T5314] ? lockdep_unlock+0x5d/0xd0
[ 74.630621][ T5314] ? __lock_acquire+0x146e/0x2cf0
[ 74.630638][ T5314] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 74.630657][ T5314] ext4_map_create_blocks+0x11d/0x540
[ 74.630674][ T5314] ext4_map_blocks+0x7cd/0x11d0
[ 74.630690][ T5314] ? __pfx_ext4_map_blocks+0x10/0x10
[ 74.630707][ T5314] ? ext4_inode_journal_mode+0x193/0x470
[ 74.630725][ T5314] ext4_do_writepages+0x22c0/0x46e0
[ 74.630743][ T5314] ? unwind_get_return_address+0x4d/0x90
[ 74.630766][ T5314] ? __pfx_ext4_do_writepages+0x10/0x10
[ 74.630781][ T5314] ? add_lock_to_list+0xc7/0x100
[ 74.630802][ T5314] ? lockdep_unlock+0x5d/0xd0
[ 74.630814][ T5314] ? __lock_acquire+0x146e/0x2cf0
[ 74.630837][ T5314] ext4_writepages+0x241/0x3b0
[ 74.630851][ T5314] ? __pfx_ext4_writepages+0x10/0x10
[ 74.630867][ T5314] ? __pfx_ext4_writepages+0x10/0x10
[ 74.630879][ T5314] do_writepages+0x32e/0x550
[ 74.630895][ T5314] ? do_raw_spin_unlock+0x4d/0x210
[ 74.630907][ T5314] filemap_write_and_wait_range+0x335/0x3f0
[ 74.630923][ T5314] ? __pfx_filemap_write_and_wait_range+0x10/0x10
[ 74.630949][ T5314] ? down_read+0x272/0x2e0
[ 74.631015][ T5314] ext4_bmap+0x1ce/0x260
[ 74.631029][ T5314] ? __pfx_ext4_bmap+0x10/0x10
[ 74.631041][ T5314] bmap+0xac/0xe0
[ 74.631058][ T5314] file_ioctl+0x4ac/0x860
[ 74.631077][ T5314] ? __pfx_file_ioctl+0x10/0x10
[ 74.631095][ T5314] ? kasan_quarantine_put+0xbb/0x1f0
[ 74.631113][ T5314] ? tomoyo_path_number_perm+0x219/0x630
[ 74.631183][ T5314] ? tomoyo_path_number_perm+0x219/0x630
[ 74.631201][ T5314] do_vfs_ioctl+0xc26/0x1530
[ 74.631219][ T5314] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 74.631236][ T5314] ? do_futex+0x395/0x420
[ 74.631262][ T5314] ? __fget_files+0x2a/0x420
[ 74.631274][ T5314] ? __fget_files+0x2a/0x420
[ 74.631287][ T5314] ? __fget_files+0x3a0/0x420
[ 74.631307][ T5314] ? __fget_files+0x2a/0x420
[ 74.631322][ T5314] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.631336][ T5314] __se_sys_ioctl+0x82/0x170
[ 74.631354][ T5314] do_syscall_64+0x14d/0xf80
[ 74.631371][ T5314] ? trace_irq_disable+0x3b/0x150
[ 74.631386][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.631398][ T5314] ? clear_bhb_loop+0x40/0x90
[ 74.631412][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.631423][ T5314] RIP: 0033:0x7f296339c799
[ 74.631451][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 74.631462][ T5314] RSP: 002b:00007f29642b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.631476][ T5314] RAX: ffffffffffffffda RBX: 00007f2963615fa0 RCX: 00007f296339c799
[ 74.631485][ T5314] RDX: 0000200000000080 RSI: 0000000000000001 RDI: 0000000000000004
[ 74.631492][ T5314] RBP: 00007f2963432bd9 R08: 0000000000000000 R09: 0000000000000000
[ 74.631499][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.631506][ T5314] R13: 00007f2963616038 R14: 00007f2963615fa0 R15: 00007fff7f0436d8
[ 74.631518][ T5314]
[ 74.631522][ T5314]
[ 74.789525][ T5314] The buggy address belongs to the physical page:
[ 74.792200][ T5314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50b15
[ 74.795884][ T5314] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 74.799024][ T5314] raw: 04fff00000000000 ffffea000142c588 ffff88801fc40d70 0000000000000000
[ 74.802647][ T5314] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 74.806341][ T5314] page dumped because: kasan: bad access detected
[ 74.809091][ T5314] page_owner info is not present (never set?)
[ 74.811640][ T5314]
[ 74.812746][ T5314] Memory state around the buggy address:
[ 74.815254][ T5314] ffff888050b15400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.818728][ T5314] ffff888050b15480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.821991][ T5314] >ffff888050b15500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.825525][ T5314] ^
[ 74.827883][ T5314] ffff888050b15580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.831330][ T5314] ffff888050b15600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.834734][ T5314] ==================================================================
[ 74.851645][ T5314] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 74.854594][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 74.858285][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 74.862798][ T5314] Call Trace:
[ 74.864198][ T5314]
[ 74.865544][ T5314] vpanic+0x56c/0xa60
[ 74.867354][ T5314] ? __pfx_vpanic+0x10/0x10
[ 74.869435][ T5314] panic+0xc5/0xd0
[ 74.871067][ T5314] ? __pfx_panic+0x10/0x10
[ 74.873092][ T5314] ? preempt_schedule_thunk+0x16/0x30
[ 74.875424][ T5314] ? preempt_schedule_thunk+0x16/0x30
[ 74.877772][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.879907][ T5314] check_panic_on_warn+0x89/0xb0
[ 74.882083][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.884203][ T5314] end_report+0x73/0x180
[ 74.886099][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.888218][ T5314] kasan_report+0x128/0x150
[ 74.890279][ T5314] ? ext4_find_extent+0xaea/0xcc0
[ 74.892435][ T5314] ext4_find_extent+0xaea/0xcc0
[ 74.894792][ T5314] ext4_ext_map_blocks+0x283/0x58b0
[ 74.897010][ T5314] ? kernel_text_address+0xa5/0xe0
[ 74.899298][ T5314] ? check_path+0x21/0x40
[ 74.901183][ T5314] ? lockdep_unlock+0x5d/0xd0
[ 74.903265][ T5314] ? __lock_acquire+0x146e/0x2cf0
[ 74.905539][ T5314] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 74.907913][ T5314] ext4_map_create_blocks+0x11d/0x540
[ 74.910315][ T5314] ext4_map_blocks+0x7cd/0x11d0
[ 74.912434][ T5314] ? __pfx_ext4_map_blocks+0x10/0x10
[ 74.914600][ T5314] ? ext4_inode_journal_mode+0x193/0x470
[ 74.916776][ T5314] ext4_do_writepages+0x22c0/0x46e0
[ 74.918942][ T5314] ? unwind_get_return_address+0x4d/0x90
[ 74.921088][ T5314] ? __pfx_ext4_do_writepages+0x10/0x10
[ 74.923262][ T5314] ? add_lock_to_list+0xc7/0x100
[ 74.925176][ T5314] ? lockdep_unlock+0x5d/0xd0
[ 74.927006][ T5314] ? __lock_acquire+0x146e/0x2cf0
[ 74.929144][ T5314] ext4_writepages+0x241/0x3b0
[ 74.931187][ T5314] ? __pfx_ext4_writepages+0x10/0x10
[ 74.933505][ T5314] ? __pfx_ext4_writepages+0x10/0x10
[ 74.935759][ T5314] do_writepages+0x32e/0x550
[ 74.937766][ T5314] ? do_raw_spin_unlock+0x4d/0x210
[ 74.939899][ T5314] filemap_write_and_wait_range+0x335/0x3f0
[ 74.942374][ T5314] ? __pfx_filemap_write_and_wait_range+0x10/0x10
[ 74.945113][ T5314] ? down_read+0x272/0x2e0
[ 74.947089][ T5314] ext4_bmap+0x1ce/0x260
[ 74.949018][ T5314] ? __pfx_ext4_bmap+0x10/0x10
[ 74.951094][ T5314] bmap+0xac/0xe0
[ 74.952729][ T5314] file_ioctl+0x4ac/0x860
[ 74.954640][ T5314] ? __pfx_file_ioctl+0x10/0x10
[ 74.956811][ T5314] ? kasan_quarantine_put+0xbb/0x1f0
[ 74.959173][ T5314] ? tomoyo_path_number_perm+0x219/0x630
[ 74.961618][ T5314] ? tomoyo_path_number_perm+0x219/0x630
[ 74.963976][ T5314] do_vfs_ioctl+0xc26/0x1530
[ 74.966114][ T5314] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 74.968404][ T5314] ? do_futex+0x395/0x420
[ 74.970330][ T5314] ? __fget_files+0x2a/0x420
[ 74.972507][ T5314] ? __fget_files+0x2a/0x420
[ 74.974749][ T5314] ? __fget_files+0x3a0/0x420
[ 74.976867][ T5314] ? __fget_files+0x2a/0x420
[ 74.978922][ T5314] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.981100][ T5314] __se_sys_ioctl+0x82/0x170
[ 74.983079][ T5314] do_syscall_64+0x14d/0xf80
[ 74.985163][ T5314] ? trace_irq_disable+0x3b/0x150
[ 74.987363][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.990071][ T5314] ? clear_bhb_loop+0x40/0x90
[ 74.992115][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.994654][ T5314] RIP: 0033:0x7f296339c799
[ 74.996626][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 75.004775][ T5314] RSP: 002b:00007f29642b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 75.008339][ T5314] RAX: ffffffffffffffda RBX: 00007f2963615fa0 RCX: 00007f296339c799
[ 75.011652][ T5314] RDX: 0000200000000080 RSI: 0000000000000001 RDI: 0000000000000004
[ 75.015016][ T5314] RBP: 00007f2963432bd9 R08: 0000000000000000 R09: 0000000000000000
[ 75.018418][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.021921][ T5314] R13: 00007f2963616038 R14: 00007f2963615fa0 R15: 00007fff7f0436d8
[ 75.025619][ T5314]
[ 75.027323][ T5314] Kernel Offset: disabled
[ 75.029105][ T5314] Rebooting in 86400 seconds..