satic int read_one_chunk { ... map = kmalloc(...); em->map_lookup = map; ... free_extent_map(em); return PTR_ERR(map->stripes[i].dev); ... } map is assigned to em at https://elixir.bootlin.com/linux/latest/source/fs/btrfs/volumes.c#L7094 map used at https://elixir.bootlin.com/linux/latest/source/fs/btrfs/volumes.c#L7132 but it is freed at https://elixir.bootlin.com/linux/latest/source/fs/btrfs/volumes.c#L7131 https://elixir.bootlin.com/linux/latest/source/fs/btrfs/extent_map.c#L81 so it exists a UAF here.
Thanks for the report. It's a conditional use-after-free because the structure is reference counted but in this case it's freshly allocated with ref 1 so it's also the last reference when free_extent_map is called. Somebody sent a fix for that so I'll add this bug for reference.
Fixed by https://git.kernel.org/linus/1742e1c90c3da344f3bb9b1f1309b3f47482756a