program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f00000001c0)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@quota}, {@block_validity}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000180)=ANY=[@ANYRESDEC=r2, @ANYRES64=r2, @ANYRES8], 0x841, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
write$FUSE_WRITE(r3, &(0x7f00000000c0)={0x18}, 0xfffffdef)

[  127.152766][ T5330] Bluetooth: hci0: command tx timeout
[  127.230204][ T5351] loop0: detected capacity change from 0 to 1024
[  127.260789][ T5351] =======================================================
[  127.260789][ T5351] WARNING: The mand mount option has been deprecated and
[  127.260789][ T5351]          and is ignored by this kernel. Remove the mand
[  127.260789][ T5351]          option from the mount to silence this warning.
[  127.260789][ T5351] =======================================================
[  127.328741][ T5351] EXT4-fs: Ignoring removed oldalloc option
[  127.341093][ T5351] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[  127.368489][ T5351] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  127.469346][ T5351] ==================================================================
[  127.472965][ T5351] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[  127.476534][ T5351] Read of size 4 at addr ffff8880555ae52c by task syz.0.0/5351
[  127.479995][ T5351] 
[  127.481139][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[  127.481154][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[  127.481161][ T5351] Call Trace:
[  127.481168][ T5351]  <TASK>
[  127.481176][ T5351]  dump_stack_lvl+0xe8/0x150
[  127.481195][ T5351]  print_report+0xca/0x240
[  127.481208][ T5351]  ? ext4_find_extent+0xae6/0xcc0
[  127.481224][ T5351]  kasan_report+0x118/0x150
[  127.481236][ T5351]  ? ext4_find_extent+0xae6/0xcc0
[  127.481252][ T5351]  ext4_find_extent+0xae6/0xcc0
[  127.481270][ T5351]  ext4_ext_map_blocks+0x278/0x69c0
[  127.481296][ T5351]  ? ext4_map_blocks+0x73f/0x16f0
[  127.481308][ T5351]  ? __pfx_ext4_ext_map_blocks+0x10/0x10
[  127.481330][ T5351]  ? ext4_es_lookup_extent+0x6cd/0xb00
[  127.481346][ T5351]  ext4_map_blocks+0x82c/0x16f0
[  127.481360][ T5351]  ? kasan_save_track+0x4f/0x80
[  127.481378][ T5351]  ? __pfx_ext4_map_blocks+0x10/0x10
[  127.481389][ T5351]  ? ext4_da_write_begin+0x352/0xd30
[  127.481405][ T5351]  ? obj_cgroup_charge_account+0x13b/0x650
[  127.481424][ T5351]  _ext4_get_block+0x1fa/0x4c0
[  127.481436][ T5351]  ? __pfx__ext4_get_block+0x10/0x10
[  127.481450][ T5351]  ext4_get_block_unwritten+0x2e/0x100
[  127.481461][ T5351]  ext4_block_write_begin+0xb03/0x1940
[  127.481477][ T5351]  ? __pfx_ext4_get_block_unwritten+0x10/0x10
[  127.481495][ T5351]  ? __pfx_ext4_block_write_begin+0x10/0x10
[  127.481507][ T5351]  ? folio_mapping+0x16f/0x1f0
[  127.481517][ T5351]  ? ext4_inode_journal_mode+0x193/0x470
[  127.481528][ T5351]  ext4_write_begin+0xb3a/0x1860
[  127.481545][ T5351]  ? __pfx_ext4_write_begin+0x10/0x10
[  127.481562][ T5351]  ext4_da_write_begin+0x352/0xd30
[  127.481582][ T5351]  ? __pfx_ext4_da_write_begin+0x10/0x10
[  127.481601][ T5351]  generic_perform_write+0x2c5/0x900
[  127.481614][ T5351]  ? __pfx_generic_perform_write+0x10/0x10
[  127.481624][ T5351]  ? file_update_time_flags+0x448/0x4e0
[  127.481639][ T5351]  ? ext4_write_checks+0x24b/0x2c0
[  127.481651][ T5351]  ext4_buffered_write_iter+0xce/0x3a0
[  127.481664][ T5351]  ext4_file_write_iter+0x292/0x1bc0
[  127.481680][ T5351]  ? vfs_write+0x211/0xb30
[  127.481694][ T5351]  ? vfs_write+0x211/0xb30
[  127.481708][ T5351]  ? __pfx_ext4_file_write_iter+0x10/0x10
[  127.481723][ T5351]  vfs_write+0x5c9/0xb30
[  127.481737][ T5351]  ? __pfx_ext4_file_write_iter+0x10/0x10
[  127.481749][ T5351]  ? __pfx_vfs_write+0x10/0x10
[  127.481765][ T5351]  ? __fget_files+0x2a/0x420
[  127.481778][ T5351]  ksys_write+0x145/0x250
[  127.481793][ T5351]  ? __pfx_ksys_write+0x10/0x10
[  127.481810][ T5351]  do_syscall_64+0xec/0xf80
[  127.481864][ T5351]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.481877][ T5351]  ? trace_irq_disable+0x37/0x100
[  127.481893][ T5351]  ? clear_bhb_loop+0x60/0xb0
[  127.481907][ T5351]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.481919][ T5351] RIP: 0033:0x7f72b938f7c9
[  127.481932][ T5351] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  127.481943][ T5351] RSP: 002b:00007f72ba189038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  127.481957][ T5351] RAX: ffffffffffffffda RBX: 00007f72b95e5fa0 RCX: 00007f72b938f7c9
[  127.481965][ T5351] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[  127.481971][ T5351] RBP: 00007f72b9413f91 R08: 0000000000000000 R09: 0000000000000000
[  127.481978][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  127.481984][ T5351] R13: 00007f72b95e6038 R14: 00007f72b95e5fa0 R15: 00007ffc694c73e8
[  127.481996][ T5351]  </TASK>
[  127.482000][ T5351] 
[  127.631154][ T5351] The buggy address belongs to the physical page:
[  127.634066][ T5351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x555ae
[  127.637742][ T5351] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[  127.640877][ T5351] raw: 04fff00000000000 ffffea0001556bc8 ffffea0001556b48 0000000000000000
[  127.644663][ T5351] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[  127.648502][ T5351] page dumped because: kasan: bad access detected
[  127.651246][ T5351] page_owner info is not present (never set?)
[  127.653887][ T5351] 
[  127.655079][ T5351] Memory state around the buggy address:
[  127.657772][ T5351]  ffff8880555ae400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  127.661244][ T5351]  ffff8880555ae480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  127.664349][ T5351] >ffff8880555ae500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  127.667701][ T5351]                                   ^
[  127.670106][ T5351]  ffff8880555ae580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  127.673540][ T5351]  ffff8880555ae600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  127.677086][ T5351] ==================================================================
[  127.761563][ T5351] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  127.764394][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[  127.768111][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[  127.773256][ T5351] Call Trace:
[  127.774917][ T5351]  <TASK>
[  127.776286][ T5351]  vpanic+0x1e0/0x670
[  127.777995][ T5351]  panic+0xb9/0xc0
[  127.779429][ T5351]  ? __pfx_panic+0x10/0x10
[  127.781312][ T5351]  ? preempt_schedule_common+0x83/0xd0
[  127.783622][ T5351]  ? ext4_find_extent+0xae6/0xcc0
[  127.785878][ T5351]  check_panic_on_warn+0x89/0xb0
[  127.787915][ T5351]  ? ext4_find_extent+0xae6/0xcc0
[  127.789786][ T5351]  end_report+0x6f/0x140
[  127.791638][ T5351]  kasan_report+0x129/0x150
[  127.793566][ T5351]  ? ext4_find_extent+0xae6/0xcc0
[  127.795930][ T5351]  ext4_find_extent+0xae6/0xcc0
[  127.798183][ T5351]  ext4_ext_map_blocks+0x278/0x69c0
[  127.800557][ T5351]  ? ext4_map_blocks+0x73f/0x16f0
[  127.802834][ T5351]  ? __pfx_ext4_ext_map_blocks+0x10/0x10
[  127.805316][ T5351]  ? ext4_es_lookup_extent+0x6cd/0xb00
[  127.807664][ T5351]  ext4_map_blocks+0x82c/0x16f0
[  127.809785][ T5351]  ? kasan_save_track+0x4f/0x80
[  127.811951][ T5351]  ? __pfx_ext4_map_blocks+0x10/0x10
[  127.814414][ T5351]  ? ext4_da_write_begin+0x352/0xd30
[  127.816658][ T5351]  ? obj_cgroup_charge_account+0x13b/0x650
[  127.819176][ T5351]  _ext4_get_block+0x1fa/0x4c0
[  127.821331][ T5351]  ? __pfx__ext4_get_block+0x10/0x10
[  127.823724][ T5351]  ext4_get_block_unwritten+0x2e/0x100
[  127.826197][ T5351]  ext4_block_write_begin+0xb03/0x1940
[  127.828367][ T5351]  ? __pfx_ext4_get_block_unwritten+0x10/0x10
[  127.830945][ T5351]  ? __pfx_ext4_block_write_begin+0x10/0x10
[  127.833612][ T5351]  ? folio_mapping+0x16f/0x1f0
[  127.835759][ T5351]  ? ext4_inode_journal_mode+0x193/0x470
[  127.838168][ T5351]  ext4_write_begin+0xb3a/0x1860
[  127.840560][ T5351]  ? __pfx_ext4_write_begin+0x10/0x10
[  127.842718][ T5351]  ext4_da_write_begin+0x352/0xd30
[  127.845020][ T5351]  ? __pfx_ext4_da_write_begin+0x10/0x10
[  127.847338][ T5351]  generic_perform_write+0x2c5/0x900
[  127.849629][ T5351]  ? __pfx_generic_perform_write+0x10/0x10
[  127.851918][ T5351]  ? file_update_time_flags+0x448/0x4e0
[  127.854191][ T5351]  ? ext4_write_checks+0x24b/0x2c0
[  127.856276][ T5351]  ext4_buffered_write_iter+0xce/0x3a0
[  127.858632][ T5351]  ext4_file_write_iter+0x292/0x1bc0
[  127.860859][ T5351]  ? vfs_write+0x211/0xb30
[  127.862736][ T5351]  ? vfs_write+0x211/0xb30
[  127.864685][ T5351]  ? __pfx_ext4_file_write_iter+0x10/0x10
[  127.867340][ T5351]  vfs_write+0x5c9/0xb30
[  127.869305][ T5351]  ? __pfx_ext4_file_write_iter+0x10/0x10
[  127.871690][ T5351]  ? __pfx_vfs_write+0x10/0x10
[  127.873748][ T5351]  ? __fget_files+0x2a/0x420
[  127.875773][ T5351]  ksys_write+0x145/0x250
[  127.877633][ T5351]  ? __pfx_ksys_write+0x10/0x10
[  127.879925][ T5351]  do_syscall_64+0xec/0xf80
[  127.881982][ T5351]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.884591][ T5351]  ? trace_irq_disable+0x37/0x100
[  127.886787][ T5351]  ? clear_bhb_loop+0x60/0xb0
[  127.889015][ T5351]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.891566][ T5351] RIP: 0033:0x7f72b938f7c9
[  127.893563][ T5351] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  127.902451][ T5351] RSP: 002b:00007f72ba189038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  127.906152][ T5351] RAX: ffffffffffffffda RBX: 00007f72b95e5fa0 RCX: 00007f72b938f7c9
[  127.909638][ T5351] RDX: 00000000fffffdef RSI: 00002000000000c0 RDI: 0000000000000007
[  127.913169][ T5351] RBP: 00007f72b9413f91 R08: 0000000000000000 R09: 0000000000000000
[  127.916403][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  127.919803][ T5351] R13: 00007f72b95e6038 R14: 00007f72b95e5fa0 R15: 00007ffc694c73e8
[  127.923232][ T5351]  </TASK>
[  127.924996][ T5351] Kernel Offset: disabled
[  127.926796][ T5351] Rebooting in 86400 seconds..