program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080), 0x3, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
setxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000500), &(0x7f00000001c0)=ANY=[], 0x841, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
write$FUSE_WRITE(r3, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 76.473060][ T5313] Bluetooth: hci0: command tx timeout
[ 76.477294][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.479966][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 76.574077][ T5333] loop0: detected capacity change from 0 to 1024
[ 76.618302][ T5333] =======================================================
[ 76.618302][ T5333] WARNING: The mand mount option has been deprecated and
[ 76.618302][ T5333] and is ignored by this kernel. Remove the mand
[ 76.618302][ T5333] option from the mount to silence this warning.
[ 76.618302][ T5333] =======================================================
[ 76.732034][ T5333] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 76.835533][ T5333] ==================================================================
[ 76.838557][ T5333] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[ 76.841431][ T5333] Read of size 4 at addr ffff888051bb8c70 by task syz.0.0/5333
[ 76.843940][ T5333]
[ 76.844985][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 76.844997][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.845007][ T5333] Call Trace:
[ 76.845014][ T5333]
[ 76.845020][ T5333] dump_stack_lvl+0x189/0x250
[ 76.845040][ T5333] ? __virt_addr_valid+0x1c8/0x5c0
[ 76.845057][ T5333] ? rcu_is_watching+0x15/0xb0
[ 76.845073][ T5333] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.845088][ T5333] ? rcu_is_watching+0x15/0xb0
[ 76.845102][ T5333] ? lock_release+0x4b/0x3e0
[ 76.845115][ T5333] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 76.845165][ T5333] ? __virt_addr_valid+0x1c8/0x5c0
[ 76.845182][ T5333] ? __virt_addr_valid+0x4a5/0x5c0
[ 76.845198][ T5333] print_report+0xca/0x240
[ 76.845212][ T5333] ? ext4_find_extent+0xae6/0xcc0
[ 76.845227][ T5333] kasan_report+0x118/0x150
[ 76.845244][ T5333] ? ext4_find_extent+0xae6/0xcc0
[ 76.845263][ T5333] ext4_find_extent+0xae6/0xcc0
[ 76.845280][ T5333] ext4_ext_map_blocks+0x288/0x6ac0
[ 76.845296][ T5333] ? __lock_acquire+0xab9/0xd20
[ 76.845308][ T5333] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 76.845323][ T5333] ? ext4_es_lookup_extent+0x622/0xa70
[ 76.845336][ T5333] ext4_map_blocks+0x860/0x1740
[ 76.845352][ T5333] ? __pfx_ext4_map_blocks+0x10/0x10
[ 76.845363][ T5333] ? __pfx_hlock_conflict+0x10/0x10
[ 76.845385][ T5333] ? check_path+0x21/0x40
[ 76.845404][ T5333] _ext4_get_block+0x200/0x4c0
[ 76.845419][ T5333] ? __pfx__ext4_get_block+0x10/0x10
[ 76.845435][ T5333] ext4_get_block_unwritten+0x2e/0x100
[ 76.845449][ T5333] ext4_block_write_begin+0x993/0x1710
[ 76.845468][ T5333] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 76.845481][ T5333] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 76.845495][ T5333] ? folio_mapping+0x16f/0x1f0
[ 76.845503][ T5333] ? ext4_inode_journal_mode+0x18c/0x480
[ 76.845513][ T5333] ext4_write_begin+0xc04/0x19a0
[ 76.845525][ T5333] ? __pfx_ext4_write_begin+0x10/0x10
[ 76.845533][ T5333] ext4_da_write_begin+0x445/0xda0
[ 76.845541][ T5333] ? __pfx___might_resched+0x10/0x10
[ 76.845551][ T5333] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 76.845559][ T5333] generic_perform_write+0x2c2/0x900
[ 76.845572][ T5333] ? __pfx_generic_perform_write+0x10/0x10
[ 76.845585][ T5333] ? file_modified_flags+0x4bb/0x560
[ 76.845602][ T5333] ? ext4_write_checks+0x24b/0x2c0
[ 76.845617][ T5333] ext4_buffered_write_iter+0xce/0x3a0
[ 76.845632][ T5333] ext4_file_write_iter+0x298/0x1bc0
[ 76.845649][ T5333] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 76.845666][ T5333] vfs_write+0x5c9/0xb30
[ 76.845679][ T5333] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 76.845692][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 76.845708][ T5333] ? __fget_files+0x2a/0x420
[ 76.845726][ T5333] ksys_write+0x145/0x250
[ 76.845739][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 76.845750][ T5333] ? rcu_is_watching+0x15/0xb0
[ 76.845764][ T5333] ? do_syscall_64+0xbe/0x3b0
[ 76.845781][ T5333] do_syscall_64+0xfa/0x3b0
[ 76.845795][ T5333] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.845812][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.845825][ T5333] ? clear_bhb_loop+0x60/0xb0
[ 76.845837][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.845848][ T5333] RIP: 0033:0x7f173e98eec9
[ 76.845860][ T5333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 76.845870][ T5333] RSP: 002b:00007f173f763038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 76.845883][ T5333] RAX: ffffffffffffffda RBX: 00007f173ebe5fa0 RCX: 00007f173e98eec9
[ 76.845892][ T5333] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[ 76.845901][ T5333] RBP: 00007f173ea11f91 R08: 0000000000000000 R09: 0000000000000000
[ 76.845909][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.845917][ T5333] R13: 00007f173ebe6038 R14: 00007f173ebe5fa0 R15: 00007ffd0f0dbc58
[ 76.845930][ T5333]
[ 76.845936][ T5333]
[ 77.010791][ T5333] The buggy address belongs to the physical page:
[ 77.013546][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51bb8
[ 77.017225][ T5333] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 77.020345][ T5333] raw: 04fff00000000000 ffffea000146ee48 ffffea000146edc8 0000000000000000
[ 77.024054][ T5333] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 77.027797][ T5333] page dumped because: kasan: bad access detected
[ 77.030576][ T5333] page_owner info is not present (never set?)
[ 77.033340][ T5333]
[ 77.034619][ T5333] Memory state around the buggy address:
[ 77.037026][ T5333] ffff888051bb8b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.040485][ T5333] ffff888051bb8b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.043875][ T5333] >ffff888051bb8c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.047353][ T5333] ^
[ 77.050776][ T5333] ffff888051bb8c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.054158][ T5333] ffff888051bb8d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.057497][ T5333] ==================================================================
[ 77.071273][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.074252][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 77.078142][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 77.082702][ T5333] Call Trace:
[ 77.084239][ T5333]
[ 77.085579][ T5333] dump_stack_lvl+0x99/0x250
[ 77.087770][ T5333] ? __asan_memcpy+0x40/0x70
[ 77.089870][ T5333] ? __pfx_dump_stack_lvl+0x10/0x10
[ 77.092153][ T5333] ? __pfx__printk+0x10/0x10
[ 77.094207][ T5333] vpanic+0x237/0x6d0
[ 77.095953][ T5333] ? __pfx_vpanic+0x10/0x10
[ 77.098189][ T5333] ? preempt_schedule+0xae/0xc0
[ 77.100546][ T5333] ? __pfx_preempt_schedule+0x10/0x10
[ 77.103047][ T5333] panic+0xb9/0xc0
[ 77.104791][ T5333] ? __pfx_panic+0x10/0x10
[ 77.106838][ T5333] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 77.109481][ T5333] ? is_module_address+0x17/0xf0
[ 77.111732][ T5333] ? ext4_find_extent+0xae6/0xcc0
[ 77.114015][ T5333] check_panic_on_warn+0x89/0xb0
[ 77.116288][ T5333] ? ext4_find_extent+0xae6/0xcc0
[ 77.118553][ T5333] end_report+0x78/0x160
[ 77.120349][ T5333] kasan_report+0x129/0x150
[ 77.122310][ T5333] ? ext4_find_extent+0xae6/0xcc0
[ 77.124657][ T5333] ext4_find_extent+0xae6/0xcc0
[ 77.126732][ T5333] ext4_ext_map_blocks+0x288/0x6ac0
[ 77.128979][ T5333] ? __lock_acquire+0xab9/0xd20
[ 77.131090][ T5333] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 77.133562][ T5333] ? ext4_es_lookup_extent+0x622/0xa70
[ 77.135941][ T5333] ext4_map_blocks+0x860/0x1740
[ 77.138091][ T5333] ? __pfx_ext4_map_blocks+0x10/0x10
[ 77.140478][ T5333] ? __pfx_hlock_conflict+0x10/0x10
[ 77.142987][ T5333] ? check_path+0x21/0x40
[ 77.144787][ T5333] _ext4_get_block+0x200/0x4c0
[ 77.146723][ T5333] ? __pfx__ext4_get_block+0x10/0x10
[ 77.148918][ T5333] ext4_get_block_unwritten+0x2e/0x100
[ 77.151193][ T5333] ext4_block_write_begin+0x993/0x1710
[ 77.153553][ T5333] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 77.156172][ T5333] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 77.158715][ T5333] ? folio_mapping+0x16f/0x1f0
[ 77.160836][ T5333] ? ext4_inode_journal_mode+0x18c/0x480
[ 77.163236][ T5333] ext4_write_begin+0xc04/0x19a0
[ 77.165393][ T5333] ? __pfx_ext4_write_begin+0x10/0x10
[ 77.167717][ T5333] ext4_da_write_begin+0x445/0xda0
[ 77.170155][ T5333] ? __pfx___might_resched+0x10/0x10
[ 77.172536][ T5333] ? __pfx_ext4_da_write_begin+0x10/0x10
[ 77.174995][ T5333] generic_perform_write+0x2c2/0x900
[ 77.177296][ T5333] ? __pfx_generic_perform_write+0x10/0x10
[ 77.179787][ T5333] ? file_modified_flags+0x4bb/0x560
[ 77.182064][ T5333] ? ext4_write_checks+0x24b/0x2c0
[ 77.184334][ T5333] ext4_buffered_write_iter+0xce/0x3a0
[ 77.186715][ T5333] ext4_file_write_iter+0x298/0x1bc0
[ 77.189041][ T5333] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 77.191452][ T5333] vfs_write+0x5c9/0xb30
[ 77.193312][ T5333] ? __pfx_ext4_file_write_iter+0x10/0x10
[ 77.195722][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 77.197793][ T5333] ? __fget_files+0x2a/0x420
[ 77.199760][ T5333] ksys_write+0x145/0x250
[ 77.201570][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 77.203717][ T5333] ? rcu_is_watching+0x15/0xb0
[ 77.205796][ T5333] ? do_syscall_64+0xbe/0x3b0
[ 77.207844][ T5333] do_syscall_64+0xfa/0x3b0
[ 77.209911][ T5333] ? lockdep_hardirqs_on+0x9c/0x150
[ 77.212242][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.214911][ T5333] ? clear_bhb_loop+0x60/0xb0
[ 77.217007][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.219563][ T5333] RIP: 0033:0x7f173e98eec9
[ 77.221390][ T5333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 77.229652][ T5333] RSP: 002b:00007f173f763038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 77.233243][ T5333] RAX: ffffffffffffffda RBX: 00007f173ebe5fa0 RCX: 00007f173e98eec9
[ 77.236568][ T5333] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[ 77.239940][ T5333] RBP: 00007f173ea11f91 R08: 0000000000000000 R09: 0000000000000000
[ 77.243342][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 77.246675][ T5333] R13: 00007f173ebe6038 R14: 00007f173ebe5fa0 R15: 00007ffd0f0dbc58
[ 77.250348][ T5333]
[ 77.252036][ T5333] Kernel Offset: disabled
[ 77.253906][ T5333] Rebooting in 86400 seconds..