program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='signal_generate\x00', r2}, 0x10)
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x2000000e, 0x0)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r1)
sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x18, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r4, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000001040)=ANY=[], 0x841, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
write$FUSE_WRITE(r5, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 74.874463][ T4667] Bluetooth: hci0: command tx timeout
[ 74.959535][ T5319] loop0: detected capacity change from 0 to 1024
[ 74.980792][ T5319] =======================================================
[ 74.980792][ T5319] WARNING: The mand mount option has been deprecated and
[ 74.980792][ T5319] and is ignored by this kernel. Remove the mand
[ 74.980792][ T5319] option from the mount to silence this warning.
[ 74.980792][ T5319] =======================================================
[ 75.032870][ T5319] EXT4-fs: Ignoring removed oldalloc option
[ 75.042216][ T5319] EXT4-fs: Ignoring removed orlov option
[ 75.047394][ T5319] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[ 75.064539][ T5319] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 75.236669][ T5319] ==================================================================
[ 75.240104][ T5319] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[ 75.243289][ T5319] Read of size 4 at addr ffff8880558fa018 by task syz.0.0/5319
[ 75.246430][ T5319]
[ 75.247480][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.247494][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 75.247501][ T5319] Call Trace:
[ 75.247508][ T5319]
[ 75.247515][ T5319] dump_stack_lvl+0xe8/0x150
[ 75.247537][ T5319] print_report+0xba/0x230
[ 75.247551][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.247563][ T5319] kasan_report+0x117/0x150
[ 75.247574][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.247588][ T5319] ext4_find_extent+0xae6/0xcc0
[ 75.247601][ T5319] ext4_ext_map_blocks+0x283/0x58b0
[ 75.247615][ T5319] ? check_path+0x21/0x40
[ 75.247633][ T5319] ? lockdep_unlock+0x5d/0xd0
[ 75.247644][ T5319] ? __lock_acquire+0x146e/0x2cf0
[ 75.247661][ T5319] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 75.247679][ T5319] ext4_map_create_blocks+0x11d/0x540
[ 75.247696][ T5319] ext4_map_blocks+0x7cd/0x11d0
[ 75.247707][ T5319] ? kasan_save_track+0x4f/0x80
[ 75.247721][ T5319] ? kasan_save_track+0x3e/0x80
[ 75.247737][ T5319] ? __pfx_ext4_map_blocks+0x10/0x10
[ 75.247752][ T5319] ? __bfs+0x153/0x290
[ 75.247765][ T5319] ? __pfx_hlock_conflict+0x10/0x10
[ 75.247784][ T5319] _ext4_get_block+0x1e3/0x470
[ 75.247799][ T5319] ? __pfx__ext4_get_block+0x10/0x10
[ 75.247817][ T5319] ext4_get_block_unwritten+0x2e/0x100
[ 75.247832][ T5319] ext4_block_write_begin+0xb14/0x1950
[ 75.247852][ T5319] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 75.247867][ T5319] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 75.247883][ T5319] ? folio_mapping+0x16f/0x1f0
[ 75.247895][ T5319] ? ext4_inode_journal_mode+0x193/0x470
[ 75.247911][ T5319] ext4_write_begin+0xb40/0x18c0
[ 75.247931][ T5319] ? __pfx_ext4_write_begin+0x10/0x10
[ 75.247943][ T5319] ? block_commit_write+0x23f/0x270
[ 75.247955][ T5319] ext4_da_write_begin+0x355/0xd80
[ 75.247968][ T5319] ? ext4_write_end+0x7ae/0xa10
[ 75.247982][ T5319] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 75.247997][ T5319] generic_perform_write+0x2e2/0x8f0
[ 75.248012][ T5319] ? __pfx_generic_perform_write+0x10/0x10
[ 75.248022][ T5319] ? file_update_time_flags+0x400/0x4a0
[ 75.248039][ T5319] ? ext4_write_checks+0x24b/0x2c0
[ 75.248054][ T5319] ext4_buffered_write_iter+0xce/0x3a0
[ 75.248069][ T5319] ext4_file_write_iter+0x298/0x1bf0
[ 75.248087][ T5319] ? __pfx___mutex_trylock_common+0x10/0x10
[ 75.248106][ T5319] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.248122][ T5319] vfs_write+0x61d/0xb90
[ 75.248139][ T5319] ? __pfx_vfs_write+0x10/0x10
[ 75.248164][ T5319] ? __fget_files+0x2a/0x420
[ 75.248180][ T5319] ksys_write+0x150/0x270
[ 75.248197][ T5319] ? __pfx_ksys_write+0x10/0x10
[ 75.248217][ T5319] do_syscall_64+0x14d/0xf80
[ 75.248289][ T5319] ? trace_irq_disable+0x3b/0x150
[ 75.248306][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.248317][ T5319] ? clear_bhb_loop+0x40/0x90
[ 75.248331][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.248341][ T5319] RIP: 0033:0x7f3da419c629
[ 75.248353][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 75.248361][ T5319] RSP: 002b:00007f3da05f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 75.248375][ T5319] RAX: ffffffffffffffda RBX: 00007f3da4415fa0 RCX: 00007f3da419c629
[ 75.248383][ T5319] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000009
[ 75.248390][ T5319] RBP: 00007f3da4232b39 R08: 0000000000000000 R09: 0000000000000000
[ 75.248397][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.248404][ T5319] R13: 00007f3da4416038 R14: 00007f3da4415fa0 R15: 00007ffeb092db38
[ 75.248416][ T5319]
[ 75.248420][ T5319]
[ 75.403751][ T5319] The buggy address belongs to the physical page:
[ 75.406593][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x558fa
[ 75.410466][ T5319] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 75.413691][ T5319] raw: 04fff00000000000 ffffea0001563ec8 ffffea0001563e48 0000000000000000
[ 75.417475][ T5319] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 75.421188][ T5319] page dumped because: kasan: bad access detected
[ 75.423924][ T5319] page_owner info is not present (never set?)
[ 75.426696][ T5319]
[ 75.427809][ T5319] Memory state around the buggy address:
[ 75.430190][ T5319] ffff8880558f9f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.433690][ T5319] ffff8880558f9f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.437202][ T5319] >ffff8880558fa000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.440539][ T5319] ^
[ 75.442727][ T5319] ffff8880558fa080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.446303][ T5319] ffff8880558fa100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 75.449933][ T5319] ==================================================================
[ 75.467476][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.470468][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.474521][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 75.478614][ T5319] Call Trace:
[ 75.480037][ T5319]
[ 75.481262][ T5319] vpanic+0x56c/0xa60
[ 75.484127][ T5319] ? __pfx_vpanic+0x10/0x10
[ 75.486128][ T5319] panic+0xc5/0xd0
[ 75.487780][ T5319] ? __pfx_panic+0x10/0x10
[ 75.489756][ T5319] ? preempt_schedule_thunk+0x16/0x30
[ 75.492165][ T5319] ? preempt_schedule_thunk+0x16/0x30
[ 75.494509][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.496719][ T5319] check_panic_on_warn+0x89/0xb0
[ 75.498982][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.501179][ T5319] end_report+0x73/0x180
[ 75.502977][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.505204][ T5319] kasan_report+0x128/0x150
[ 75.507157][ T5319] ? ext4_find_extent+0xae6/0xcc0
[ 75.509360][ T5319] ext4_find_extent+0xae6/0xcc0
[ 75.511552][ T5319] ext4_ext_map_blocks+0x283/0x58b0
[ 75.513867][ T5319] ? check_path+0x21/0x40
[ 75.515812][ T5319] ? lockdep_unlock+0x5d/0xd0
[ 75.517939][ T5319] ? __lock_acquire+0x146e/0x2cf0
[ 75.520258][ T5319] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 75.522626][ T5319] ext4_map_create_blocks+0x11d/0x540
[ 75.524910][ T5319] ext4_map_blocks+0x7cd/0x11d0
[ 75.527010][ T5319] ? kasan_save_track+0x4f/0x80
[ 75.529030][ T5319] ? kasan_save_track+0x3e/0x80
[ 75.531308][ T5319] ? __pfx_ext4_map_blocks+0x10/0x10
[ 75.533595][ T5319] ? __bfs+0x153/0x290
[ 75.535395][ T5319] ? __pfx_hlock_conflict+0x10/0x10
[ 75.537690][ T5319] _ext4_get_block+0x1e3/0x470
[ 75.539763][ T5319] ? __pfx__ext4_get_block+0x10/0x10
[ 75.542040][ T5319] ext4_get_block_unwritten+0x2e/0x100
[ 75.544336][ T5319] ext4_block_write_begin+0xb14/0x1950
[ 75.546719][ T5319] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 75.549358][ T5319] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 75.551933][ T5319] ? folio_mapping+0x16f/0x1f0
[ 75.553998][ T5319] ? ext4_inode_journal_mode+0x193/0x470
[ 75.556537][ T5319] ext4_write_begin+0xb40/0x18c0
[ 75.559316][ T5319] ? __pfx_ext4_write_begin+0x10/0x10
[ 75.562074][ T5319] ? block_commit_write+0x23f/0x270
[ 75.564295][ T5319] ext4_da_write_begin+0x355/0xd80
[ 75.566545][ T5319] ? ext4_write_end+0x7ae/0xa10
[ 75.568656][ T5319] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 75.571207][ T5319] generic_perform_write+0x2e2/0x8f0
[ 75.573457][ T5319] ? __pfx_generic_perform_write+0x10/0x10
[ 75.575994][ T5319] ? file_update_time_flags+0x400/0x4a0
[ 75.578322][ T5319] ? ext4_write_checks+0x24b/0x2c0
[ 75.580542][ T5319] ext4_buffered_write_iter+0xce/0x3a0
[ 75.582960][ T5319] ext4_file_write_iter+0x298/0x1bf0
[ 75.584956][ T5319] ? __pfx___mutex_trylock_common+0x10/0x10
[ 75.587501][ T5319] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 75.589954][ T5319] vfs_write+0x61d/0xb90
[ 75.591703][ T5319] ? __pfx_vfs_write+0x10/0x10
[ 75.593744][ T5319] ? __fget_files+0x2a/0x420
[ 75.595796][ T5319] ksys_write+0x150/0x270
[ 75.597714][ T5319] ? __pfx_ksys_write+0x10/0x10
[ 75.599833][ T5319] do_syscall_64+0x14d/0xf80
[ 75.601811][ T5319] ? trace_irq_disable+0x3b/0x150
[ 75.604028][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.606725][ T5319] ? clear_bhb_loop+0x40/0x90
[ 75.608803][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.611345][ T5319] RIP: 0033:0x7f3da419c629
[ 75.613229][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 75.622541][ T5319] RSP: 002b:00007f3da05f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 75.626855][ T5319] RAX: ffffffffffffffda RBX: 00007f3da4415fa0 RCX: 00007f3da419c629
[ 75.630922][ T5319] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000009
[ 75.634754][ T5319] RBP: 00007f3da4232b39 R08: 0000000000000000 R09: 0000000000000000
[ 75.638914][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.643028][ T5319] R13: 00007f3da4416038 R14: 00007f3da4415fa0 R15: 00007ffeb092db38
[ 75.646794][ T5319]
[ 75.648451][ T5319] Kernel Offset: disabled
[ 75.650285][ T5319] Rebooting in 86400 seconds..