program: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000080)={[{@stripe={'stripe', 0x3d, 0x2}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@oldalloc}, {@noquota}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@delalloc}, {@nojournal_checksum}, {@orlov}, {@user_xattr}, {@quota}, {@delalloc}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x35) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000001000)={'syztnl2\x00', 0x0, 0x0, 0xa000, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @rand_addr=0x3}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000780)={'syztnl2\x00', &(0x7f0000000340)={'syztnl2\x00', r4, 0x700, 0x1, 0x8, 0x6, {{0x5, 0x4, 0x1, 0x3b, 0x14, 0x65, 0x0, 0x3, 0x29, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0xd}}}}}) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xfecc) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000500), &(0x7f0000001040)=ANY=[], 0x841, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r5, &(0x7f00000000c0)={0x18}, 0xfffffdef) fallocate(r5, 0x43, 0x80000000, 0x8) [ 76.157575][ T5317] Bluetooth: hci0: command tx timeout [ 76.236389][ T5340] loop0: detected capacity change from 0 to 1024 [ 76.271306][ T5340] ======================================================= [ 76.271306][ T5340] WARNING: The mand mount option has been deprecated and [ 76.271306][ T5340] and is ignored by this kernel. Remove the mand [ 76.271306][ T5340] option from the mount to silence this warning. [ 76.271306][ T5340] ======================================================= [ 76.344567][ T5340] EXT4-fs: Ignoring removed oldalloc option [ 76.347198][ T5340] EXT4-fs: Ignoring removed orlov option [ 76.356764][ T5340] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 76.410092][ T5340] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.607343][ T3950] ================================================================== [ 76.610953][ T3950] BUG: KASAN: use-after-free in ext4_find_extent+0xae6/0xcc0 [ 76.614271][ T3950] Read of size 4 at addr ffff888055bfd02c by task kworker/u4:24/3950 [ 76.617936][ T3950] [ 76.619030][ T3950] CPU: 0 UID: 0 PID: 3950 Comm: kworker/u4:24 Not tainted syzkaller #0 PREEMPT(full) [ 76.619045][ T3950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.619053][ T3950] Workqueue: writeback wb_workfn (flush-7:0) [ 76.619077][ T3950] Call Trace: [ 76.619085][ T3950] [ 76.619092][ T3950] dump_stack_lvl+0xe8/0x150 [ 76.619108][ T3950] print_report+0xca/0x240 [ 76.619121][ T3950] ? ext4_find_extent+0xae6/0xcc0 [ 76.619136][ T3950] kasan_report+0x118/0x150 [ 76.619149][ T3950] ? ext4_find_extent+0xae6/0xcc0 [ 76.619166][ T3950] ext4_find_extent+0xae6/0xcc0 [ 76.619184][ T3950] ext4_ext_map_blocks+0x278/0x69c0 [ 76.619209][ T3950] ? ext4_map_blocks+0x73f/0x16f0 [ 76.619222][ T3950] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 76.619241][ T3950] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 76.619256][ T3950] ext4_map_blocks+0x82c/0x16f0 [ 76.619270][ T3950] ? __pfx_ext4_map_blocks+0x10/0x10 [ 76.619282][ T3950] ? rcu_is_watching+0x15/0xb0 [ 76.619296][ T3950] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 76.619310][ T3950] ? kmem_cache_alloc_noprof+0x3ce/0x710 [ 76.619326][ T3950] ? ext4_inode_journal_mode+0x193/0x470 [ 76.619341][ T3950] ext4_do_writepages+0x222f/0x4500 [ 76.619366][ T3950] ? __pfx_ext4_do_writepages+0x10/0x10 [ 76.619378][ T3950] ? __lock_acquire+0x6b6/0x2cf0 [ 76.619390][ T3950] ? filemap_get_folios_tag+0xed/0x630 [ 76.619407][ T3950] ? filemap_get_folios_tag+0x53b/0x630 [ 76.619421][ T3950] ? filemap_get_folios_tag+0xed/0x630 [ 76.619437][ T3950] ? ext4_writepages+0x1ca/0x350 [ 76.619452][ T3950] ? ext4_writepages+0x1ca/0x350 [ 76.619470][ T3950] ext4_writepages+0x203/0x350 [ 76.619485][ T3950] ? __pfx_ext4_writepages+0x10/0x10 [ 76.619504][ T3950] ? filemap_get_entry+0xad/0x2f0 [ 76.619517][ T3950] ? __pfx_ext4_writepages+0x10/0x10 [ 76.619532][ T3950] do_writepages+0x32e/0x550 [ 76.619546][ T3950] ? reacquire_held_locks+0x104/0x190 [ 76.619559][ T3950] ? writeback_sb_inodes+0x3bd/0x1870 [ 76.619571][ T3950] __writeback_single_inode+0x133/0x1240 [ 76.619582][ T3950] ? do_raw_spin_unlock+0x4d/0x240 [ 76.619598][ T3950] writeback_sb_inodes+0x93a/0x1870 [ 76.619614][ T3950] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 76.619630][ T3950] ? __pfx_down_read_trylock+0x10/0x10 [ 76.619645][ T3950] ? __pfx___up_read+0x10/0x10 [ 76.619660][ T3950] __writeback_inodes_wb+0x111/0x240 [ 76.619672][ T3950] wb_writeback+0x43f/0xaa0 [ 76.619683][ T3950] ? queue_io+0x2c1/0x450 [ 76.619693][ T3950] ? __pfx_wb_writeback+0x10/0x10 [ 76.619701][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 76.619718][ T3950] wb_workfn+0x8ee/0xed0 [ 76.619735][ T3950] ? __pfx_wb_workfn+0x10/0x10 [ 76.619747][ T3950] ? finish_task_switch+0x162/0x940 [ 76.619764][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 76.619777][ T3950] ? lock_acquire+0x107/0x340 [ 76.619788][ T3950] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 76.619801][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 76.619814][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 76.619824][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 76.619834][ T3950] process_scheduled_works+0xad1/0x1770 [ 76.619849][ T3950] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.619859][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 76.619876][ T3950] worker_thread+0x8a0/0xda0 [ 76.619891][ T3950] ? __kthread_parkme+0x7b/0x200 [ 76.619911][ T3950] kthread+0x711/0x8a0 [ 76.619926][ T3950] ? __pfx_worker_thread+0x10/0x10 [ 76.619937][ T3950] ? __pfx_kthread+0x10/0x10 [ 76.619950][ T3950] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.620006][ T3950] ? __pfx_kthread+0x10/0x10 [ 76.620019][ T3950] ret_from_fork+0x510/0xa50 [ 76.620031][ T3950] ? __pfx_ret_from_fork+0x10/0x10 [ 76.620040][ T3950] ? __switch_to+0xc9e/0x1480 [ 76.620055][ T3950] ? __pfx_kthread+0x10/0x10 [ 76.620068][ T3950] ret_from_fork_asm+0x1a/0x30 [ 76.620088][ T3950] [ 76.620113][ T3950] [ 76.784891][ T3950] The buggy address belongs to the physical page: [ 76.787513][ T3950] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55bfd [ 76.791329][ T3950] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 76.794637][ T3950] raw: 04fff00000000000 ffffea000156ff88 ffffea000156ff08 0000000000000000 [ 76.798382][ T3950] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 76.802344][ T3950] page dumped because: kasan: bad access detected [ 76.805330][ T3950] page_owner info is not present (never set?) [ 76.808022][ T3950] [ 76.809040][ T3950] Memory state around the buggy address: [ 76.811409][ T3950] ffff888055bfcf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.814767][ T3950] ffff888055bfcf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.818145][ T3950] >ffff888055bfd000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.821555][ T3950] ^ [ 76.823763][ T3950] ffff888055bfd080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.827286][ T3950] ffff888055bfd100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.830840][ T3950] ================================================================== [ 76.903915][ T3950] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.907073][ T3950] CPU: 0 UID: 0 PID: 3950 Comm: kworker/u4:24 Not tainted syzkaller #0 PREEMPT(full) [ 76.911029][ T3950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.915846][ T3950] Workqueue: writeback wb_workfn (flush-7:0) [ 76.918471][ T3950] Call Trace: [ 76.919917][ T3950] [ 76.921636][ T3950] vpanic+0x1e0/0x670 [ 76.923883][ T3950] panic+0xb9/0xc0 [ 76.926088][ T3950] ? __pfx_panic+0x10/0x10 [ 76.928543][ T3950] ? preempt_schedule_common+0x83/0xd0 [ 76.931537][ T3950] ? ext4_find_extent+0xae6/0xcc0 [ 76.934404][ T3950] check_panic_on_warn+0x89/0xb0 [ 76.936884][ T3950] ? ext4_find_extent+0xae6/0xcc0 [ 76.938857][ T3950] end_report+0x6f/0x140 [ 76.940785][ T3950] kasan_report+0x129/0x150 [ 76.942851][ T3950] ? ext4_find_extent+0xae6/0xcc0 [ 76.945071][ T3950] ext4_find_extent+0xae6/0xcc0 [ 76.947136][ T3950] ext4_ext_map_blocks+0x278/0x69c0 [ 76.949437][ T3950] ? ext4_map_blocks+0x73f/0x16f0 [ 76.951606][ T3950] ? __pfx_ext4_ext_map_blocks+0x10/0x10 [ 76.953990][ T3950] ? ext4_es_lookup_extent+0x6cd/0xb00 [ 76.956276][ T3950] ext4_map_blocks+0x82c/0x16f0 [ 76.958319][ T3950] ? __pfx_ext4_map_blocks+0x10/0x10 [ 76.960714][ T3950] ? rcu_is_watching+0x15/0xb0 [ 76.962896][ T3950] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 76.965320][ T3950] ? kmem_cache_alloc_noprof+0x3ce/0x710 [ 76.967748][ T3950] ? ext4_inode_journal_mode+0x193/0x470 [ 76.970129][ T3950] ext4_do_writepages+0x222f/0x4500 [ 76.972257][ T3950] ? __pfx_ext4_do_writepages+0x10/0x10 [ 76.974613][ T3950] ? __lock_acquire+0x6b6/0x2cf0 [ 76.976673][ T3950] ? filemap_get_folios_tag+0xed/0x630 [ 76.978719][ T3950] ? filemap_get_folios_tag+0x53b/0x630 [ 76.980809][ T3950] ? filemap_get_folios_tag+0xed/0x630 [ 76.983084][ T3950] ? ext4_writepages+0x1ca/0x350 [ 76.985283][ T3950] ? ext4_writepages+0x1ca/0x350 [ 76.987572][ T3950] ext4_writepages+0x203/0x350 [ 76.989650][ T3950] ? __pfx_ext4_writepages+0x10/0x10 [ 76.991887][ T3950] ? filemap_get_entry+0xad/0x2f0 [ 76.994179][ T3950] ? __pfx_ext4_writepages+0x10/0x10 [ 76.996338][ T3950] do_writepages+0x32e/0x550 [ 76.998410][ T3950] ? reacquire_held_locks+0x104/0x190 [ 77.000741][ T3950] ? writeback_sb_inodes+0x3bd/0x1870 [ 77.002995][ T3950] __writeback_single_inode+0x133/0x1240 [ 77.005536][ T3950] ? do_raw_spin_unlock+0x4d/0x240 [ 77.007814][ T3950] writeback_sb_inodes+0x93a/0x1870 [ 77.010051][ T3950] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 77.012427][ T3950] ? __pfx_down_read_trylock+0x10/0x10 [ 77.014784][ T3950] ? __pfx___up_read+0x10/0x10 [ 77.016824][ T3950] __writeback_inodes_wb+0x111/0x240 [ 77.019108][ T3950] wb_writeback+0x43f/0xaa0 [ 77.021160][ T3950] ? queue_io+0x2c1/0x450 [ 77.023044][ T3950] ? __pfx_wb_writeback+0x10/0x10 [ 77.025256][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 77.027408][ T3950] wb_workfn+0x8ee/0xed0 [ 77.029269][ T3950] ? __pfx_wb_workfn+0x10/0x10 [ 77.031346][ T3950] ? finish_task_switch+0x162/0x940 [ 77.033530][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 77.035659][ T3950] ? lock_acquire+0x107/0x340 [ 77.037693][ T3950] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 77.039955][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 77.042399][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 77.044919][ T3950] ? process_scheduled_works+0x9ef/0x1770 [ 77.047406][ T3950] process_scheduled_works+0xad1/0x1770 [ 77.049750][ T3950] ? __pfx_process_scheduled_works+0x10/0x10 [ 77.052349][ T3950] ? do_raw_spin_lock+0x121/0x290 [ 77.054693][ T3950] worker_thread+0x8a0/0xda0 [ 77.056728][ T3950] ? __kthread_parkme+0x7b/0x200 [ 77.058770][ T3950] kthread+0x711/0x8a0 [ 77.060497][ T3950] ? __pfx_worker_thread+0x10/0x10 [ 77.062634][ T3950] ? __pfx_kthread+0x10/0x10 [ 77.064682][ T3950] ? _raw_spin_unlock_irq+0x23/0x50 [ 77.066786][ T3950] ? __pfx_kthread+0x10/0x10 [ 77.068588][ T3950] ret_from_fork+0x510/0xa50 [ 77.070552][ T3950] ? __pfx_ret_from_fork+0x10/0x10 [ 77.072672][ T3950] ? __switch_to+0xc9e/0x1480 [ 77.074541][ T3950] ? __pfx_kthread+0x10/0x10 [ 77.076536][ T3950] ret_from_fork_asm+0x1a/0x30 [ 77.078618][ T3950] [ 77.080569][ T3950] Kernel Offset: disabled [ 77.082937][ T3950] Rebooting in 86400 seconds..