program:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000240)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noauto_da_alloc}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007180)=[{{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001040)="3c56a9", 0x3}], 0x1}}], 0x1, 0x4800)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000100)=ANY=[@ANYRESOCT=r0], 0x841, 0x0)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0xfaeb)

[  109.520897][ T4667] Bluetooth: hci0: command tx timeout
[  109.684906][ T5324] loop0: detected capacity change from 0 to 1024
[  109.714197][ T5324] =======================================================
[  109.714197][ T5324] WARNING: The mand mount option has been deprecated and
[  109.714197][ T5324]          and is ignored by this kernel. Remove the mand
[  109.714197][ T5324]          option from the mount to silence this warning.
[  109.714197][ T5324] =======================================================
[  109.764606][ T5324] EXT4-fs: Ignoring removed oldalloc option
[  109.770278][ T5324] EXT4-fs: Ignoring removed orlov option
[  109.775469][ T5324] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[  109.795041][ T5324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  109.826772][ T5324] ==================================================================
[  109.830799][ T5324] BUG: KASAN: use-after-free in ext4_find_extent+0xaea/0xcc0
[  109.834146][ T5324] Read of size 4 at addr ffff888055cc852c by task syz.0.0/5324
[  109.837512][ T5324] 
[  109.838571][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[  109.838592][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  109.838601][ T5324] Call Trace:
[  109.838611][ T5324]  <TASK>
[  109.838619][ T5324]  dump_stack_lvl+0xe8/0x150
[  109.838645][ T5324]  print_report+0xba/0x230
[  109.838663][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  109.838680][ T5324]  kasan_report+0x117/0x150
[  109.838691][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  109.838703][ T5324]  ext4_find_extent+0xaea/0xcc0
[  109.838715][ T5324]  ext4_ext_map_blocks+0x283/0x58b0
[  109.838728][ T5324]  ? kernel_text_address+0xa5/0xe0
[  109.838744][ T5324]  ? check_path+0x21/0x40
[  109.838766][ T5324]  ? lockdep_unlock+0x5d/0xd0
[  109.838779][ T5324]  ? __lock_acquire+0x146e/0x2cf0
[  109.838797][ T5324]  ? __pfx_ext4_ext_map_blocks+0x10/0x10
[  109.838816][ T5324]  ext4_map_create_blocks+0x11d/0x540
[  109.838832][ T5324]  ext4_map_blocks+0x7cd/0x11d0
[  109.838845][ T5324]  ? __pfx_ext4_map_blocks+0x10/0x10
[  109.838856][ T5324]  ? ext4_inode_journal_mode+0x193/0x470
[  109.838867][ T5324]  ext4_do_writepages+0x22c0/0x46e0
[  109.838880][ T5324]  ? unwind_get_return_address+0x4d/0x90
[  109.838895][ T5324]  ? __pfx_ext4_do_writepages+0x10/0x10
[  109.838906][ T5324]  ? add_lock_to_list+0xc7/0x100
[  109.838919][ T5324]  ? lockdep_unlock+0x5d/0xd0
[  109.838930][ T5324]  ? __lock_acquire+0x146e/0x2cf0
[  109.838957][ T5324]  ext4_writepages+0x241/0x3b0
[  109.838974][ T5324]  ? __pfx_ext4_writepages+0x10/0x10
[  109.838993][ T5324]  ? __pfx_ext4_writepages+0x10/0x10
[  109.839009][ T5324]  do_writepages+0x32e/0x550
[  109.839023][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[  109.839033][ T5324]  filemap_write_and_wait_range+0x335/0x3f0
[  109.839048][ T5324]  ? __pfx_filemap_write_and_wait_range+0x10/0x10
[  109.839066][ T5324]  ? down_read+0x272/0x2e0
[  109.839131][ T5324]  ext4_bmap+0x1ce/0x260
[  109.839144][ T5324]  ? __pfx_ext4_bmap+0x10/0x10
[  109.839154][ T5324]  bmap+0xac/0xe0
[  109.839168][ T5324]  file_ioctl+0x4ac/0x860
[  109.839181][ T5324]  ? __pfx_file_ioctl+0x10/0x10
[  109.839195][ T5324]  ? kasan_quarantine_put+0xbb/0x1f0
[  109.839216][ T5324]  ? tomoyo_path_number_perm+0x219/0x630
[  109.839279][ T5324]  ? tomoyo_path_number_perm+0x219/0x630
[  109.839294][ T5324]  do_vfs_ioctl+0xc26/0x1530
[  109.839309][ T5324]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  109.839320][ T5324]  ? do_futex+0x395/0x420
[  109.839335][ T5324]  ? __fget_files+0x2a/0x420
[  109.839346][ T5324]  ? __fget_files+0x2a/0x420
[  109.839356][ T5324]  ? __fget_files+0x3a0/0x420
[  109.839366][ T5324]  ? __fget_files+0x2a/0x420
[  109.839375][ T5324]  ? bpf_lsm_file_ioctl+0x9/0x20
[  109.839386][ T5324]  __se_sys_ioctl+0x82/0x170
[  109.839394][ T5324]  do_syscall_64+0x14d/0xf80
[  109.839403][ T5324]  ? trace_irq_disable+0x3b/0x150
[  109.839416][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.839428][ T5324]  ? clear_bhb_loop+0x40/0x90
[  109.839442][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.839454][ T5324] RIP: 0033:0x7f1cdc99c799
[  109.839468][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  109.839479][ T5324] RSP: 002b:00007f1cdd8c6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  109.839495][ T5324] RAX: ffffffffffffffda RBX: 00007f1cdcc15fa0 RCX: 00007f1cdc99c799
[  109.839504][ T5324] RDX: 0000200000000080 RSI: 0000000000000001 RDI: 0000000000000004
[  109.839530][ T5324] RBP: 00007f1cdca32c99 R08: 0000000000000000 R09: 0000000000000000
[  109.839539][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  109.839543][ T5324] R13: 00007f1cdcc16038 R14: 00007f1cdcc15fa0 R15: 00007ffcedf13298
[  109.839550][ T5324]  </TASK>
[  109.839553][ T5324] 
[  110.003329][ T5324] The buggy address belongs to the physical page:
[  110.006117][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55cc8
[  110.010085][ T5324] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[  110.013600][ T5324] raw: 04fff00000000000 ffffea0001573248 ffffea00015731c8 0000000000000000
[  110.017420][ T5324] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[  110.020942][ T5324] page dumped because: kasan: bad access detected
[  110.024078][ T5324] page_owner info is not present (never set?)
[  110.027775][ T5324] 
[  110.028911][ T5324] Memory state around the buggy address:
[  110.031291][ T5324]  ffff888055cc8400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  110.034674][ T5324]  ffff888055cc8480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  110.038112][ T5324] >ffff888055cc8500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  110.041685][ T5324]                                   ^
[  110.044536][ T5324]  ffff888055cc8580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  110.048749][ T5324]  ffff888055cc8600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  110.051966][ T5324] ==================================================================
[  110.063714][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  110.067190][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[  110.071481][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  110.075978][ T5324] Call Trace:
[  110.077689][ T5324]  <TASK>
[  110.079187][ T5324]  vpanic+0x56c/0xa60
[  110.081205][ T5324]  ? __pfx_vpanic+0x10/0x10
[  110.083392][ T5324]  panic+0xc5/0xd0
[  110.085099][ T5324]  ? __pfx_panic+0x10/0x10
[  110.086927][ T5324]  ? preempt_schedule_thunk+0x16/0x30
[  110.089189][ T5324]  ? preempt_schedule_thunk+0x16/0x30
[  110.091515][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  110.094149][ T5324]  check_panic_on_warn+0x89/0xb0
[  110.097051][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  110.099618][ T5324]  end_report+0x73/0x180
[  110.101468][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  110.103668][ T5324]  kasan_report+0x128/0x150
[  110.105770][ T5324]  ? ext4_find_extent+0xaea/0xcc0
[  110.108083][ T5324]  ext4_find_extent+0xaea/0xcc0
[  110.110697][ T5324]  ext4_ext_map_blocks+0x283/0x58b0
[  110.113767][ T5324]  ? kernel_text_address+0xa5/0xe0
[  110.116506][ T5324]  ? check_path+0x21/0x40
[  110.118326][ T5324]  ? lockdep_unlock+0x5d/0xd0
[  110.120451][ T5324]  ? __lock_acquire+0x146e/0x2cf0
[  110.122646][ T5324]  ? __pfx_ext4_ext_map_blocks+0x10/0x10
[  110.125065][ T5324]  ext4_map_create_blocks+0x11d/0x540
[  110.127413][ T5324]  ext4_map_blocks+0x7cd/0x11d0
[  110.129761][ T5324]  ? __pfx_ext4_map_blocks+0x10/0x10
[  110.132438][ T5324]  ? ext4_inode_journal_mode+0x193/0x470
[  110.135228][ T5324]  ext4_do_writepages+0x22c0/0x46e0
[  110.137682][ T5324]  ? unwind_get_return_address+0x4d/0x90
[  110.140207][ T5324]  ? __pfx_ext4_do_writepages+0x10/0x10
[  110.142661][ T5324]  ? add_lock_to_list+0xc7/0x100
[  110.144830][ T5324]  ? lockdep_unlock+0x5d/0xd0
[  110.147467][ T5324]  ? __lock_acquire+0x146e/0x2cf0
[  110.150619][ T5324]  ext4_writepages+0x241/0x3b0
[  110.153055][ T5324]  ? __pfx_ext4_writepages+0x10/0x10
[  110.155680][ T5324]  ? __pfx_ext4_writepages+0x10/0x10
[  110.157393][ T5324]  do_writepages+0x32e/0x550
[  110.158918][ T5324]  ? do_raw_spin_unlock+0x4d/0x210
[  110.160543][ T5324]  filemap_write_and_wait_range+0x335/0x3f0
[  110.162817][ T5324]  ? __pfx_filemap_write_and_wait_range+0x10/0x10
[  110.165377][ T5324]  ? down_read+0x272/0x2e0
[  110.167414][ T5324]  ext4_bmap+0x1ce/0x260
[  110.169416][ T5324]  ? __pfx_ext4_bmap+0x10/0x10
[  110.171631][ T5324]  bmap+0xac/0xe0
[  110.173941][ T5324]  file_ioctl+0x4ac/0x860
[  110.176329][ T5324]  ? __pfx_file_ioctl+0x10/0x10
[  110.178592][ T5324]  ? kasan_quarantine_put+0xbb/0x1f0
[  110.180818][ T5324]  ? tomoyo_path_number_perm+0x219/0x630
[  110.183104][ T5324]  ? tomoyo_path_number_perm+0x219/0x630
[  110.185615][ T5324]  do_vfs_ioctl+0xc26/0x1530
[  110.187749][ T5324]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  110.189676][ T5324]  ? do_futex+0x395/0x420
[  110.191222][ T5324]  ? __fget_files+0x2a/0x420
[  110.192920][ T5324]  ? __fget_files+0x2a/0x420
[  110.194991][ T5324]  ? __fget_files+0x3a0/0x420
[  110.197552][ T5324]  ? __fget_files+0x2a/0x420
[  110.199528][ T5324]  ? bpf_lsm_file_ioctl+0x9/0x20
[  110.201809][ T5324]  __se_sys_ioctl+0x82/0x170
[  110.204085][ T5324]  do_syscall_64+0x14d/0xf80
[  110.206528][ T5324]  ? trace_irq_disable+0x3b/0x150
[  110.208885][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.211501][ T5324]  ? clear_bhb_loop+0x40/0x90
[  110.213991][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.216907][ T5324] RIP: 0033:0x7f1cdc99c799
[  110.218965][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  110.227219][ T5324] RSP: 002b:00007f1cdd8c6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  110.231511][ T5324] RAX: ffffffffffffffda RBX: 00007f1cdcc15fa0 RCX: 00007f1cdc99c799
[  110.234940][ T5324] RDX: 0000200000000080 RSI: 0000000000000001 RDI: 0000000000000004
[  110.238530][ T5324] RBP: 00007f1cdca32c99 R08: 0000000000000000 R09: 0000000000000000
[  110.241853][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  110.245122][ T5324] R13: 00007f1cdcc16038 R14: 00007f1cdcc15fa0 R15: 00007ffcedf13298
[  110.249310][ T5324]  </TASK>
[  110.251591][ T5324] Kernel Offset: disabled
[  110.253798][ T5324] Rebooting in 86400 seconds..