program:
r0 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
pwrite64(r1, &(0x7f0000000140)='2', 0x1, 0x8000c61)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35)
ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f0000000240)=0x401)
pwrite64(r3, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000000280)=ANY=[@ANYBLOB="7f2eb7c0a1a34f95118289354584a4f9f81bdc4dc74b4baf03ef995437ff4bf0fe19ca1f255c590c2d7f9b1efe2bfe8743d2291100a0d2f9a7fff080e33f3ccc53a3cd6cd3743392b8bfed4ce6ea69", @ANYRES16=r1, @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRES32=r0, @ANYRESHEX=r3, @ANYRES8=0x0, @ANYRESOCT=r3], 0x841, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r5, &(0x7f000000bbc0)={0x0, 0x0, &(0x7f000000bb80)={&(0x7f000000bac0)={0x24, 0x4, 0x8, 0x101, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2004c0f0}, 0x4000042)
setxattr$security_capability(&(0x7f0000000180)='./file1\x00', &(0x7f00000001c0), &(0x7f0000000200)=@v2={0x2000000, [{0x8, 0x9}, {0x6, 0x9}]}, 0x14, 0x1)
setrlimit(0x2, &(0x7f0000000040)={0x4000051, 0xfffffffa})
prctl$PR_SET_MM(0x23, 0x1, &(0x7f00007d8000/0x1000)=nil)
write$FUSE_WRITE(r4, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 77.394862][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 77.406615][ T5301] Bluetooth: hci0: command tx timeout
[ 77.409616][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 77.477550][ T5322] loop0: detected capacity change from 0 to 1024
[ 77.489065][ T5322] =======================================================
[ 77.489065][ T5322] WARNING: The mand mount option has been deprecated and
[ 77.489065][ T5322] and is ignored by this kernel. Remove the mand
[ 77.489065][ T5322] option from the mount to silence this warning.
[ 77.489065][ T5322] =======================================================
[ 77.554690][ T5322] EXT4-fs: Ignoring removed oldalloc option
[ 77.568460][ T5322] EXT4-fs: Ignoring removed orlov option
[ 77.588499][ T5322] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled
[ 77.620149][ T5322] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 77.773249][ T5321] ==================================================================
[ 77.776437][ T5321] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0
[ 77.779477][ T5321] Read of size 4 at addr ffff88804b30a850 by task syz.0.0/5321
[ 77.782569][ T5321]
[ 77.783528][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 77.783541][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 77.783547][ T5321] Call Trace:
[ 77.783554][ T5321]
[ 77.783559][ T5321] dump_stack_lvl+0x189/0x250
[ 77.783573][ T5321] ? __virt_addr_valid+0x1c8/0x5c0
[ 77.783585][ T5321] ? rcu_is_watching+0x15/0xb0
[ 77.783599][ T5321] ? __pfx_dump_stack_lvl+0x10/0x10
[ 77.783608][ T5321] ? rcu_is_watching+0x15/0xb0
[ 77.783621][ T5321] ? lock_release+0x4b/0x3e0
[ 77.783634][ T5321] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 77.783688][ T5321] ? __virt_addr_valid+0x1c8/0x5c0
[ 77.783698][ T5321] ? __virt_addr_valid+0x4a5/0x5c0
[ 77.783709][ T5321] print_report+0xca/0x240
[ 77.783721][ T5321] ? ext4_find_extent+0xae6/0xcc0
[ 77.783733][ T5321] kasan_report+0x118/0x150
[ 77.783741][ T5321] ? ext4_find_extent+0xae6/0xcc0
[ 77.783751][ T5321] ext4_find_extent+0xae6/0xcc0
[ 77.783764][ T5321] ext4_ext_map_blocks+0x288/0x6ac0
[ 77.783779][ T5321] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 77.783789][ T5321] ? arch_stack_walk+0xfc/0x150
[ 77.783805][ T5321] ? __lock_acquire+0xab9/0xd20
[ 77.783820][ T5321] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 77.783837][ T5321] ? ext4_es_lookup_extent+0x622/0xa70
[ 77.783854][ T5321] ext4_map_blocks+0x860/0x1740
[ 77.783870][ T5321] ? __pfx_ext4_map_blocks+0x10/0x10
[ 77.783880][ T5321] ? __lock_acquire+0xab9/0xd20
[ 77.783888][ T5321] _ext4_get_block+0x200/0x4c0
[ 77.783895][ T5321] ? __pfx__ext4_get_block+0x10/0x10
[ 77.783901][ T5321] ? do_raw_spin_unlock+0x4d/0x240
[ 77.783908][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 77.783917][ T5321] ext4_get_block_unwritten+0x2e/0x100
[ 77.783925][ T5321] ext4_block_write_begin+0x993/0x1710
[ 77.783938][ T5321] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 77.783947][ T5321] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 77.783957][ T5321] ? __ext4_journal_start_sb+0x27e/0x5c0
[ 77.783970][ T5321] ext4_page_mkwrite+0x760/0x1190
[ 77.783984][ T5321] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 77.783995][ T5321] ? __pfx_ext4_page_mkwrite+0x10/0x10
[ 77.784007][ T5321] do_page_mkwrite+0x14d/0x310
[ 77.784015][ T5321] do_wp_page+0x268d/0x5800
[ 77.784027][ T5321] ? __pfx_do_wp_page+0x10/0x10
[ 77.784035][ T5321] ? do_raw_spin_lock+0x121/0x290
[ 77.784041][ T5321] ? __handle_mm_fault+0xf87/0x5400
[ 77.784054][ T5321] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.784065][ T5321] __handle_mm_fault+0x1033/0x5400
[ 77.784082][ T5321] ? lock_vma_under_rcu+0x1a3/0x450
[ 77.784091][ T5321] ? __pfx___handle_mm_fault+0x10/0x10
[ 77.784108][ T5321] ? lock_vma_under_rcu+0x3d2/0x450
[ 77.784118][ T5321] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 77.784127][ T5321] ? __rseq_handle_notify_resume+0x384/0x1220
[ 77.784139][ T5321] handle_mm_fault+0x40a/0x8e0
[ 77.784155][ T5321] do_user_addr_fault+0xa7c/0x1380
[ 77.784169][ T5321] ? rcu_is_watching+0x15/0xb0
[ 77.784183][ T5321] ? trace_page_fault_user+0x84/0x1e0
[ 77.784196][ T5321] exc_page_fault+0x82/0x100
[ 77.784205][ T5321] asm_exc_page_fault+0x26/0x30
[ 77.784212][ T5321] RIP: 0033:0x7fef0ea654b9
[ 77.784221][ T5321] Code: ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 c8 fe ff ff e8 68 59 0c 00 85 c0 75 10 48 8b 44 24 68 48 8b b4 24 98 00 00 00 <48> 89 30 64 f0 83 2c 25 90 ff ff ff 01 48 8b 84 24 80 00 00 00 48
[ 77.784226][ T5321] RSP: 002b:00007ffc122b7fc0 EFLAGS: 00010246
[ 77.784234][ T5321] RAX: 000020000000bbc0 RBX: 0000000000000002 RCX: ffffe00000000000
[ 77.784239][ T5321] RDX: 45b2888dd37007af RSI: 0000000000000000 RDI: 000055556ba283c8
[ 77.784243][ T5321] RBP: 00007fef0ede7da0 R08: 00007fef0e9ff03c R09: 000000000000000f
[ 77.784248][ T5321] R10: 0000000000000001 R11: 0000000000000006 R12: 00007fef0ede5fac
[ 77.784252][ T5321] R13: 00007fef0ede5fa0 R14: fffffffffffffffe R15: 00007ffc122b80d0
[ 77.784259][ T5321]
[ 77.784262][ T5321]
[ 77.938100][ T5321] The buggy address belongs to the physical page:
[ 77.940581][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4b30a
[ 77.944269][ T5321] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 77.947227][ T5321] raw: 04fff00000000000 ffffea00012cc2c8 ffffea00012cc248 0000000000000000
[ 77.950807][ T5321] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 77.954345][ T5321] page dumped because: kasan: bad access detected
[ 77.957009][ T5321] page_owner info is not present (never set?)
[ 77.959292][ T5321]
[ 77.960231][ T5321] Memory state around the buggy address:
[ 77.962467][ T5321] ffff88804b30a700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.965645][ T5321] ffff88804b30a780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.968929][ T5321] >ffff88804b30a800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.972071][ T5321] ^
[ 77.974757][ T5321] ffff88804b30a880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.977770][ T5321] ffff88804b30a900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.981030][ T5321] ==================================================================
[ 78.111888][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.115036][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 78.119001][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 78.123621][ T5321] Call Trace:
[ 78.125167][ T5321]
[ 78.126457][ T5321] dump_stack_lvl+0x99/0x250
[ 78.128671][ T5321] ? __asan_memcpy+0x40/0x70
[ 78.130584][ T5321] ? __pfx_dump_stack_lvl+0x10/0x10
[ 78.132634][ T5321] ? __pfx__printk+0x10/0x10
[ 78.134483][ T5321] vpanic+0x237/0x6d0
[ 78.136058][ T5321] ? __pfx_vpanic+0x10/0x10
[ 78.138006][ T5321] ? preempt_schedule+0xae/0xc0
[ 78.140046][ T5321] ? __pfx_preempt_schedule+0x10/0x10
[ 78.142151][ T5321] panic+0xb9/0xc0
[ 78.144118][ T5321] ? __pfx_panic+0x10/0x10
[ 78.145960][ T5321] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 78.148583][ T5321] ? is_module_address+0x17/0xf0
[ 78.150717][ T5321] ? ext4_find_extent+0xae6/0xcc0
[ 78.152929][ T5321] check_panic_on_warn+0x89/0xb0
[ 78.155037][ T5321] ? ext4_find_extent+0xae6/0xcc0
[ 78.157248][ T5321] end_report+0x78/0x160
[ 78.158972][ T5321] kasan_report+0x129/0x150
[ 78.160881][ T5321] ? ext4_find_extent+0xae6/0xcc0
[ 78.163048][ T5321] ext4_find_extent+0xae6/0xcc0
[ 78.165177][ T5321] ext4_ext_map_blocks+0x288/0x6ac0
[ 78.167390][ T5321] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 78.169995][ T5321] ? arch_stack_walk+0xfc/0x150
[ 78.171938][ T5321] ? __lock_acquire+0xab9/0xd20
[ 78.173964][ T5321] ? __pfx_ext4_ext_map_blocks+0x10/0x10
[ 78.176483][ T5321] ? ext4_es_lookup_extent+0x622/0xa70
[ 78.178954][ T5321] ext4_map_blocks+0x860/0x1740
[ 78.181204][ T5321] ? __pfx_ext4_map_blocks+0x10/0x10
[ 78.183536][ T5321] ? __lock_acquire+0xab9/0xd20
[ 78.185502][ T5321] _ext4_get_block+0x200/0x4c0
[ 78.187509][ T5321] ? __pfx__ext4_get_block+0x10/0x10
[ 78.189788][ T5321] ? do_raw_spin_unlock+0x4d/0x240
[ 78.191963][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 78.194016][ T5321] ext4_get_block_unwritten+0x2e/0x100
[ 78.196233][ T5321] ext4_block_write_begin+0x993/0x1710
[ 78.198530][ T5321] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 78.201229][ T5321] ? __pfx_ext4_block_write_begin+0x10/0x10
[ 78.203491][ T5321] ? __ext4_journal_start_sb+0x27e/0x5c0
[ 78.205915][ T5321] ext4_page_mkwrite+0x760/0x1190
[ 78.207730][ T5321] ? __pfx_ext4_get_block_unwritten+0x10/0x10
[ 78.210034][ T5321] ? __pfx_ext4_page_mkwrite+0x10/0x10
[ 78.212147][ T5321] do_page_mkwrite+0x14d/0x310
[ 78.214057][ T5321] do_wp_page+0x268d/0x5800
[ 78.215855][ T5321] ? __pfx_do_wp_page+0x10/0x10
[ 78.217937][ T5321] ? do_raw_spin_lock+0x121/0x290
[ 78.220154][ T5321] ? __handle_mm_fault+0xf87/0x5400
[ 78.222497][ T5321] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 78.224862][ T5321] __handle_mm_fault+0x1033/0x5400
[ 78.227156][ T5321] ? lock_vma_under_rcu+0x1a3/0x450
[ 78.229435][ T5321] ? __pfx___handle_mm_fault+0x10/0x10
[ 78.231612][ T5321] ? lock_vma_under_rcu+0x3d2/0x450
[ 78.233625][ T5321] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 78.235817][ T5321] ? __rseq_handle_notify_resume+0x384/0x1220
[ 78.238015][ T5321] handle_mm_fault+0x40a/0x8e0
[ 78.239698][ T5321] do_user_addr_fault+0xa7c/0x1380
[ 78.241548][ T5321] ? rcu_is_watching+0x15/0xb0
[ 78.243382][ T5321] ? trace_page_fault_user+0x84/0x1e0
[ 78.245389][ T5321] exc_page_fault+0x82/0x100
[ 78.247051][ T5321] asm_exc_page_fault+0x26/0x30
[ 78.249025][ T5321] RIP: 0033:0x7fef0ea654b9
[ 78.250971][ T5321] Code: ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 c8 fe ff ff e8 68 59 0c 00 85 c0 75 10 48 8b 44 24 68 48 8b b4 24 98 00 00 00 <48> 89 30 64 f0 83 2c 25 90 ff ff ff 01 48 8b 84 24 80 00 00 00 48
[ 78.259325][ T5321] RSP: 002b:00007ffc122b7fc0 EFLAGS: 00010246
[ 78.262026][ T5321] RAX: 000020000000bbc0 RBX: 0000000000000002 RCX: ffffe00000000000
[ 78.265360][ T5321] RDX: 45b2888dd37007af RSI: 0000000000000000 RDI: 000055556ba283c8
[ 78.268698][ T5321] RBP: 00007fef0ede7da0 R08: 00007fef0e9ff03c R09: 000000000000000f
[ 78.271778][ T5321] R10: 0000000000000001 R11: 0000000000000006 R12: 00007fef0ede5fac
[ 78.275035][ T5321] R13: 00007fef0ede5fa0 R14: fffffffffffffffe R15: 00007ffc122b80d0
[ 78.278154][ T5321]
[ 78.279730][ T5321] Kernel Offset: disabled
[ 78.281439][ T5321] Rebooting in 86400 seconds..