program: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) ioctl(r1, 0x40186f40, &(0x7f00000000c0)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt\x00', 0x1ff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) kexec_load(0x0, 0x2, &(0x7f0000001400)=[{0x0, 0x2}, {0x0}], 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) r3 = perf_event_open(&(0x7f0000001bc0)={0x5, 0x80, 0xa, 0x0, 0x0, 0xd, 0x0, 0x2, 0x144, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x4880, 0xa7, 0x2, 0x5, 0xa2, 0x9b9b, 0x7000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) (async) read(r3, &(0x7f0000001c40)=""/231, 0xe7) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r2) syz_mount_image$hfs(&(0x7f0000001440), &(0x7f0000001480)='./file0\x00', 0x0, &(0x7f00000014c0)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b348a7fba46e286378a15ee516bac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d55141063d8de2d50a4fa0e73ff2913a9fe8e954a4e4ca99ce24dba4e0812c2ccf8ab5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca1051ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0ace21dc04bd9c3248b598267822670a02be81f017e946a7e3359ce433ae42aae07518c3850cff4cf415bdb29ab165216a12899868d6857b732eafbab59fba36fca0b5cab2e717cd6ffef31a24add5f56b30c27b9e616892b60f4cde07eb9cb090ca25e5b8c6858a27e7e4d5cac6ed29218fcd35804fe2a5cb1ca503991051eb9c04a88bf02e8e240ee4c8b0ae80396aff9f8a913e8dc6b15e15b0a7c82953a87ef02b1e7abea95a7ae79eca2a536a59abfa3cccc1a6664d20344fedc524f3867f1dd8ba04bcd90aa43e024891f779210ec076e0b13ebf2bef2ac1a30f7a396a508b00000000000000", @ANYRESOCT=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES16=0x0, @ANYRES8], 0x1, 0x32a, &(0x7f0000001740)="$eJzs3U1rE08cB/DvTJJm+2/+dfsggsdqQS+i9SJeIpK3IIgH0bYRiqGiVlAvJuJJRO/efQu+CC+Kb0BPHsSr0F4cmdnZTXZ39iFt2jX6/YC42d3J/CYzk/1NUAZE9M+62vny7uI3/UcANdSAl5cBCcAD6gCO44T3aHtna6fX3cx7o5opgT0FgaCkSN2zsd01fw/ip3U5U8Ly9as6WqPn6HAopa58TZz7LisKhipjZr+DBJp2dprr3pFHlm9Q5ibHeO4fQizTROxiF48xX3UcRERULf38HwRPSv2cb9n8XUpgFRh4f+rzv5z/U2d+VhLHUVK5V0ee/2aVpYTu32Pm0nC9Z5Zw+roMV4llam4kXs8gyMFiCaZwryqHSz4Ti5y9s9Xrntu419uUeI62NVJgOarB0iO0INoVx9o0R4m2C2dGGYQlG7oNaxnxL+2zxhypdDfWIeKD+CRuCh9vsRnlf3UldLQmYD/RU0H857PrmzOl9F2wXxvtdluaNwotmEpOxnsqu5VmFHjuFQnCD3YB8R8I/KI4TanFRKmgdRecBZpRqSVnqbXwVUZdy7FSujXRaM6OcjLUs6wr4rW4LlbwA+/RGcn/pY5vFemZOdIJw1kjVoOJZj7xoD0z7urq5j391JOjjxut+JnoU2xmhb6nBH8SOqCwD19hHZcw//DJ07u1Xq/7QB/cdhzcb0VnGi8A5z0VH6A/PNOEMlI3h9+BseKz9uQYldbGCOzsRFuqJ2LhzXqWJS+FrZzoJz86EsIJO7E+hax+aOWNjc7HxEAqPFC1cnNHNZ0j3C/u94xLv9Q+2p7Ol+nvNOz0qiOhiui8SwTrP5PJ23zf5Gs6W7jWzF6NhItMV8pmEkf7jkrn2NEKyIuVXzRH/8XT6IIV0JzNYxzruD5Say797E+tuU6dAU6Xr9G3cU6H7PTfEh18xi3+/k9ERERERERERERERERERERERERENG3G/98Rs2OWavBflhMRERERERERERERERERERERERERERERHVC0/y/C/X9Rbv/f5PZSdv9fDwX7/66nY0jt//tmG6IPcP9fosP1OwAA//+1UnIe") prlimit64(0x0, 0xe, &(0x7f0000001a80)={0x8, 0x20000008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000001ac0)=0x7) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000001b00)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r5, &(0x7f0000001b40)={0x18}, 0xfffffdef) (async, rerun: 32) ioctl$FIBMAP(r5, 0x1, &(0x7f0000001b80)=0x101) (async, rerun: 32) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01fffff0000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004"], 0x38}}, 0x0) (async) ioctl$BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000400)={{r2}, "0e9e37e82886cfd7099be0cafb4598061ab1bc7821d9b9e4c2a3d1b7a8787a3b4c756948a57031f585810e1d363fb6528d5eb4bbc499b310674f269869a8a3031700f832c3dd053663b655b3c2cd000b4600503a597dc7b510d97da0b77a7da8eaa53e2ee772f3be5e555080d5d01a02f52bc790486fadb855ff53fab224693737a8223cec906668db056498796baef3f4eecd593b519dd14471b54014dd111163d7bf64aea40c10d5268a688742941b945aab7e240a797bad8851021bc34ad72e633bd0161e2194c568245dfa8158dd0b9f54d0cff6d5947dbac7e0a17522e5501f59f85f281d96d9debac0fc87a61414dcc8da08b987a82584b40fe24f0efe58ac5fc374d5d6a23dea66f9e793831e2898dc60796be109aac74eb19726014a126314f9177334cb8e3d573e93a5d51cc4608917fadccfc5363cc4978d707d6f99b2aa03865754e98b5524934fdd463f6dffbf95db2970f3b3f17bda5cbd8042946603a7b24fc874aa9d75e227a8677ae65d6eac4d1e029c28bd55e28680b9caffe6f19cf377272ac1f90c1bc126c972a4b350d4f7d0e6906fb5390fcae1886b3a8742d7ceea293cdfebefc52d72330cf123a1668893dd5289500b8e00851604cad6be817d857732881d6d66fdcd4f633676a4eca41b1e54178ef92c552c655ab78791a59c51b0577910fc6da83442333093a795224fb83b59cc9b5cbdffac21cc90ed2a225f985087d70eff3810e43a10d383d10b1d78c103c16ca18330244a0f4e34ada4b8e62863c8104c74cbfbf00afbdb3788b985c53530a309f576f62b9aa3852083e5b8c24ac06e4f77b87d49d009a555fff729d4c37a9a315c9b7154dea4e8e71baa017a8e93bb771ff4c39af450de24816b348a187c541e5ba2e3b3f050a5141d7e13871d36db8c223cd24629b4a2b535a6878e79e89175c36429e1729de513b1fd074946c468fcddcbecce6c8ac19b55959f3a165c8ba63faa1b1db12f5189d97c513ca8dad1e05e1a880b30926607f02a3ecc32dc17208b6604870c58b2907c0a84fa5a7c2672980420594884e1ccf73923f4c82f50104bb946a50af0f7553a2f608d62e334239f511a417b780e12349bda46d8d9da29c383e7139e4ca499f02cb23e2a271f6723dc0d2fe9641f03a47a4c64e22aa8b2c296b04b0f63f33a5fa6505ea4eff1a0919b8b0a08627d8dd90b8edd46ffd0509e85b7d6f530cc1a2bd69967be2a7382c5dfba99ecbb056153fdb4ab41dc44539e213fd6fd084af698b536c2c86fbae8c330bea8147967a0f0ec434ac4e1ce68fd9fab6cf9d3b8280c8a9013e49e7be1530aa497e03232c03d21f1ba3ac29fc5b95d0e81356f3273ea1d0a49d78c3fb34fa725017b20dc9fa7dc187af9febd576017e488f2222e5a7e185400c63ef7d94654d9a83a5d2daa61629bf3af948cf154216f5ae08b5cafb6207602e0b7f47e837ec637c9ac5780e91782e9de6d7235a8b556e41739f98b97abce63634540d7f713e61e89423848b50f80c9cc235475948836c4b77b09bc5554d1c674de9851e704c9e1deb6f9158a17e1a92a404bae9f3ebc589af58da0ed725b16b455fe086183c0c8aa7901d738a4989d292bcbf7b2e929cae82168aa1a392517735229b91e99124ad1d93fd3af1d7b6bf26c79af5fb95b594b9a99eb86a9ae8e0b323145217be87c759f29b81f365e548e7ecfd77dc45f833cc9194d6b3e9c7f4df63abfba7df702d11494b3de1ea822c52caa9a55325a15522134f91dbb6335b1d48bdf94335e0e3c94d8630006a7cee857b4bb3d70364b462071dea868ace2b8189069bd40efdbe5a226b145565a8d5f6b5e34299f9c77661b3531fd3b532bc4af4ed04f31c187767e41eab6d678013f7b65cb3efb9af3763cd3b5533909da46f396ec79b4e27f49994701f578499af5c5efe30b2daad3d2d60c3345eaa4448d5f63ea00ba7f38d0a908c13bc8b834ef8e7fc28c49965f144e13f204eae2c2c44993efd3bf19132e08240c24669e08421c04ec4fcfe522aec4139f79ff7b205be40c0b4beac464bcc92873f61587f58ddb83d0cbd852deac42b9548eb99d1d7e020094b7385e4c3e412a6d4b1fe9de5c9249d9e1f953f50a1c0a2c6815e1709280146eca13da6f8eb9c225e5610527177f3c887e409f57e2f5bce5ed911a8b6c643908c5e108167e78e0ae009923e7a557de4ac6cbc1254a171511ce4f9f32199e1eaedb4ea0179743badc0d16b64c298107aee734b9b3a9a5d8c0030bd63e3f3654ac2017a4d550a3e73417ee2cb96ed2e5ea0de90ec20aa549fe216c7b2952ea447362d164737f2a57f64ac7d383b1ff940ca0569f9772ca349f6d0a2b1c7a2f6676d5726720a24d97c80184b4aee618be27770983d18e38c47961f62d12e7da6debf018b1c3d8a7da9db65ba8a660a792ac4908425e5a496915e5522b3c4a8ce4e5548ca0fc58ae1af1f92756c6494af9b27ee002476da7ec45a771375d30864b6872f34324cf4aefb949e481d4dc0b307327266d260a28a448cf94f0105a49c55e0367bc14f70caddc1b4ce5a8093c3cb6cd256444e097c64cec9d1971dddf1698c8becd9339decaf4307772655ec43973e03663f338cb3cd897704c6721b4609ce14542f5478108d9c6aad9bf96f4f1911c5663eaf5c1828f9dc4d1e4d1ff3ba22bfdc4f36531578e547cf9db94b11f6d12ff48cb8fb45c55329ef39833ffcfe43d61dd1615b3b4eb76e50b6a97e0fba5716f66de5c7502ea020b5ffaa27d0538db5989cd6ad639baf2aa9023d8d6be79199bec849ae5da1f885b9f3606c4929266c8401307620aa5dd9d871acbc94f702eeaebb54b6ba01edcdbea1b0fdd39cd7198f3304f92b410ab4579797a35729b385715f1e9e2e969b8c405ddb8e9167b5eeb8a29ef329b9b5e56897eebde1a903655466956b1613c95b96a64aa09d1f3ee2b71a3860a05116bd67b760327b9f8911bb4d8af430b330a11e704e673320487bba6f2acfbf1223a9d9864e75e3ddfdc819d25eb0466f66ae0354623cffcb773256de162d6708329c0ab763caf4a026dec220f0a7a4225def4ae137ab35ffbbbb316e00e4991696ce8eb1c193aaeb718f61487bbee73b7f64c234ba1eb8c1bbd1645b78143aa1ad92ec4cecd87681321ea1c9372b3d55b266ed4e20e1c49214a7d0f6baef2dc25e75cdf50369bd032e9055fb2dd3c0277b009b9014a313f24e3950b8d02e234a1a3908ad134ce04b1d6f56a8269130c1506d9586154e72163b3e91bee99c380a0c5616b65844a956084a14ae473584881ee8992d30bd0c36e1cd7529e1771a25a63ec80b4aea4bb4fd4f172de4b724fac83a333abfc4f902becd54083239ffd54188ce5c41016e65a2af5e2b01a5143c0b62aadf2aeacbc40469995953198e0824350893e825f86c9dcd8694d7929225c2042318956534712c13b7f5ceed56f729d515a0dd7b32740321ea64fab4b2229dab8500cd17ad690fd5bec5b08c4c73a62cf0bb940937da97120003b7804d348deaa1395cd09299311e5dd81c5ca4229d7204969942d895c2093499e200b470ec3daf41250057f0d93c71c75669227785dbb7451e245d7b1934973670305cd36ac028b2c4f3a07df0a60c2d458a2cdfec097fc303712613affa06db6d473e309fc6497712917ddfb28c4b452477efe251e75a45e9d5a40f159078c9d0ab78f7f364e079091e7712de8c821c271ff83fbf1fc1cade16feac88302c729660d09b5191d699eae27924546b51fd2e3b5eda21640a899d0c83cf3968d02ec4692d5763baeb43348535375f54e7cef587e3b8e329bb835b00f4bd92e76142fa0f90879848456408009b7affbd910524a9d6e5cc6731d376b0e59b3119b80d75f6fba321b97152e893c4bf1cede026311e988fc088a215045170c978034f5e8fc07ef201e8634c41df329450f377357e8b275b3f6aef70d4dfebd9804a74fd763da4a1dc48007153d6e6094c7d900f5abae1fa66570d058b3b74d28ca27f435882dfdf46d957a0a4d8133abb80e0c1ca8b099ca65dbb5cd0cfa49c7018877928e49f6ae2ed877ef90dd7e238764958f803e59320fc01f3c5e95994823524a8bd67d158ad5495d709502d29eb29ff060ede7aece178482eee9438716e6909a922b2b36db2ba914b369943659cae92b195ee9ed3962bc6263d704a32766682cc762a82abe316647b585403b37af6ef938cf9d4d20066a4966566764e2a5de892ba48e5d24867366cbe4274fa04ca730b27040f1fd83a4d5988e0f0528c9382b7c8c3445a83f3a1377a38c2acdd30090e3bd6b7a8c7178930b7844335c64b5861fa30bdb4f6c46bbc887248ebbf3f103579b2b14acecd03a47a9bb18d2b5c81479fa7ff6fe5178069e61dd4b5f0ea8a9b9ffca57d515b7fe0e38d7dd533f01ad2c27efbe5ca559ed06d38c08dc8f1dfede24b5c1536aa32a5934678e126dfacc99954e7406359aed6e766675a4a8e627a32da47cd621d17a9583f63dd13e1f55c5d4d0f0aa33aef6ac05c73fb0db9be2e11129515551d007b10daa858f61578736d0ed6823876a4cf44b49318cef882a9ec6e5a31cba4e1328247009be3976986045d852673d7008f78de9acaa98c4b06de0913074652f0d3794211ae62d4e94764545b62dac37d81eebe284fa76462783fbc7c37844f76fc386ee665843e83030dcc5e5ff11c7b814152ff42f357507d1bc1167a1c38a7e26d6e1d79f5674c962c7555d304302fec384f4ace6b0b82b2662827bff8872c84bb66d75cb930390a5c0efeb755b497b1b01621ced8ab25996df9ca3b40b9c673b0491240c84def562b86fd385d471b867c895fb56eb6ef07847b5f5d97705f3a026c48e40cb9c1cb0d12b98e96b9bdcc717b6a2f5e04a3cfd756d9a5585e87c03a64f8e4139532d712a07d7802ec8bf978e8bcd0cf4f7e708742a2078e3a7a6ab8ae49154de3a13001bdc6f796518bea92bf70fbb5d2ad68547f3a76aecc05ef23b1500933a3256db98176c5c1d79e376cbca7be5cf5967f25f327e18e90e9ab0228f09ea62a30d8a2b2685f4de8cacf504c22616c63d20ffcd2ae6eb695b2e0f7b7912990dbea0ab601936ee152955634e25812447872639a2b953e0d5199a8dd38a1c761edc34b85aa82bba399be96cd8e03b48cc23e64e113b7c5deeef55f36035be81a211d2fca1baec10fbc664ee5f934c18fe8736908dcd1bc0550eb96222e068b11effe7eaf73eb346527da3557e72239de875551c7b2801aea069aa159ff50ae2f78e7764ed34ca40af73ee508fae2b1d5e37315226eb5a41235922f4ff1d9e3b07c0907c56e9305513d0161d110088393b06dd41a497b2914ae0ae429f69c84ddbb3efab56389eda19e26c64b97ac5db2e1d146804e96dbd2c252af020505adc3c568f38e0c85506833502e6f9531bf9738d41d46fcf424042f1b4d0650e80608c5f9d66d82091235b7253bcf82824aa5dbd2b813d918e9b1d2260ea85690caf72dbfe6c7f59e6ff18ad37866f578592bc46602f801d2070b2a95f705a3f387f30fc53c314f63a8e24a6036b235464f3f6aae38e0d095baf9a7aed3bd03733a38cc7eafde6ebfd5fc254d23d57cfc718694a264a6d733d3cb81ac95ac3f33eb6a0791b150b669e5cf81c85ac77bbe295945024560191e9d5dc16aef3e2b4bbb0fc5499e9c1f9712fb3dcc0ea89fb7389a9f738d8314bc2a75a06713ce1a04054d557b6ae6d3d811e2d27a7c6f9425ea99818b16518f08e23c395e613"}) (async, rerun: 64) prctl$PR_SET_MM(0x46, 0x2, &(0x7f000030d000/0x3000)=nil) (async, rerun: 64) mount(0x0, &(0x7f0000000140)='./dev_mnt\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev_mnt/ubi0\x00', 0x2, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@private2, @in6=@remote, 0x4e23, 0xffc, 0x4e20, 0x5, 0x2, 0x20, 0x80, 0x2c}, {0x5, 0x9, 0x4, 0x5, 0x7, 0xaa86, 0x7, 0x4}, {0xc, 0x80000001, 0x401}, 0x9, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in=@remote, 0x4d3, 0x3c}, 0xa, @in6=@mcast2, 0x3506, 0x2, 0x2, 0xec, 0x8, 0xfffffffe, 0x7}}, 0xe8) (async) ioctl(r6, 0x40986f00, &(0x7f0000000300)) (async, rerun: 32) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async, rerun: 32) listen(r0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x49, &(0x7f0000000080)=0x4, 0x4) (async, rerun: 32) ioctl$XFS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000000c0)) (async, rerun: 32) syz_emit_ethernet(0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="aadd60101040001406fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="54c2000090780000"], 0x0) [ 102.255312][ T4665] Bluetooth: hci0: command tx timeout [ 102.376443][ T5352] ubi0: attaching mtd0 [ 102.392918][ T5352] ubi0: scanning is finished [ 102.392935][ T5352] ubi0: empty MTD device detected [ 102.599486][ T5352] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 102.599505][ T5352] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 102.599515][ T5352] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 102.599523][ T5352] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 102.599531][ T5352] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 102.599539][ T5352] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 102.599548][ T5352] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3323667991 [ 102.599557][ T5352] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 102.600902][ T5353] ubi0: background thread "ubi_bgt0d" started, PID 5353 [ 103.171459][ T5351] loop0: detected capacity change from 0 to 64 [ 104.177684][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177684][ T5350] loop0: rw=8388608, sector=25900, nr_sectors = 1 limit=64 [ 104.177794][ T5350] Buffer I/O error on dev loop0, logical block 25900, async page read [ 104.177824][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177824][ T5350] loop0: rw=8388608, sector=25901, nr_sectors = 1 limit=64 [ 104.177836][ T5350] Buffer I/O error on dev loop0, logical block 25901, async page read [ 104.177848][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177848][ T5350] loop0: rw=8388608, sector=26983, nr_sectors = 1 limit=64 [ 104.177861][ T5350] Buffer I/O error on dev loop0, logical block 26983, async page read [ 104.177874][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177874][ T5350] loop0: rw=8388608, sector=26984, nr_sectors = 1 limit=64 [ 104.177886][ T5350] Buffer I/O error on dev loop0, logical block 26984, async page read [ 104.177898][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177898][ T5350] loop0: rw=8388608, sector=26985, nr_sectors = 1 limit=64 [ 104.177911][ T5350] Buffer I/O error on dev loop0, logical block 26985, async page read [ 104.177921][ T5350] syz.0.0: attempt to access beyond end of device [ 104.177921][ T5350] loop0: rw=8388608, sector=26986, nr_sectors = 1 limit=64 [ 104.177928][ T5350] Buffer I/O error on dev loop0, logical block 26986, async page read [ 104.178570][ T5350] syz.0.0: attempt to access beyond end of device [ 104.178570][ T5350] loop0: rw=8388608, sector=25900, nr_sectors = 1 limit=64 [ 104.178582][ T5350] Buffer I/O error on dev loop0, logical block 25900, async page read [ 104.178592][ T5350] syz.0.0: attempt to access beyond end of device [ 104.178592][ T5350] loop0: rw=8388608, sector=25901, nr_sectors = 1 limit=64 [ 104.178611][ T5350] Buffer I/O error on dev loop0, logical block 25901, async page read [ 104.178622][ T5350] syz.0.0: attempt to access beyond end of device [ 104.178622][ T5350] loop0: rw=8388608, sector=26983, nr_sectors = 1 limit=64 [ 104.178634][ T5350] Buffer I/O error on dev loop0, logical block 26983, async page read [ 104.178645][ T5350] syz.0.0: attempt to access beyond end of device [ 104.178645][ T5350] loop0: rw=8388608, sector=26984, nr_sectors = 1 limit=64 [ 104.178657][ T5350] Buffer I/O error on dev loop0, logical block 26984, async page read [ 104.179660][ T5350] [ 104.270654][ T5350] ============================================ [ 104.273157][ T5350] WARNING: possible recursive locking detected [ 104.275694][ T5350] syzkaller #0 Not tainted [ 104.277673][ T5350] -------------------------------------------- [ 104.280253][ T5350] syz.0.0/5350 is trying to acquire lock: [ 104.282719][ T5350] ffff88803857a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.286749][ T5350] [ 104.286749][ T5350] but task is already holding lock: [ 104.289806][ T5350] ffff88803857a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.293669][ T5350] [ 104.293669][ T5350] other info that might help us debug this: [ 104.296916][ T5350] Possible unsafe locking scenario: [ 104.296916][ T5350] [ 104.299924][ T5350] CPU0 [ 104.301365][ T5350] ---- [ 104.302863][ T5350] lock(&tree->tree_lock/1); [ 104.304848][ T5350] lock(&tree->tree_lock/1); [ 104.306895][ T5350] [ 104.306895][ T5350] *** DEADLOCK *** [ 104.306895][ T5350] [ 104.310287][ T5350] May be due to missing lock nesting notation [ 104.310287][ T5350] [ 104.313938][ T5350] locks held by syz.0.0/5350: 6, last CPU#0: [ 104.317773][ T5350] #0: ffff8880138c60f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 104.321525][ T5350] #1: ffff888014a32460 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 104.325162][ T5350] #2: ffff888013eef040 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 104.329784][ T5350] #3: ffff888013eeeea0 (&HFS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.334036][ T5350] #4: ffff88803857a0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18d/0x300 [ 104.338136][ T5350] #5: ffff8880134180a0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf9/0x1680 [ 104.343265][ T5350] [ 104.343265][ T5350] stack backtrace: [ 104.345726][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.349343][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.353367][ T5350] Call Trace: [ 104.354859][ T5350] [ 104.356118][ T5350] dump_stack_lvl+0xe8/0x150 [ 104.358166][ T5350] print_deadlock_bug+0x27a/0x290 [ 104.360266][ T5350] __lock_acquire+0x25db/0x2de0 [ 104.362323][ T5350] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.365006][ T5350] ? stack_depot_save_flags+0x404/0x7f0 [ 104.367449][ T5350] ? kasan_save_track+0x4f/0x80 [ 104.369616][ T5350] ? kasan_save_track+0x3e/0x80 [ 104.371590][ T5350] ? __kasan_kmalloc+0x93/0xb0 [ 104.373666][ T5350] ? __kmalloc_noprof+0x366/0x710 [ 104.375807][ T5350] ? hfs_find_init+0x9d/0x300 [ 104.377826][ T5350] ? hfs_extend_file+0x367/0x1680 [ 104.379921][ T5350] ? hfs_bmap_reserve+0x108/0x430 [ 104.382152][ T5350] ? __hfs_ext_write_extent+0x200/0x620 [ 104.384523][ T5350] lock_acquire+0x115/0x350 [ 104.386425][ T5350] ? hfs_find_init+0x18d/0x300 [ 104.388485][ T5350] __mutex_lock+0x197/0x15a0 [ 104.390503][ T5350] ? hfs_find_init+0x18d/0x300 [ 104.392530][ T5350] ? hfs_find_init+0x18d/0x300 [ 104.394559][ T5350] ? __pfx___mutex_lock+0x10/0x10 [ 104.396607][ T5350] ? rcu_is_watching+0x16/0xb0 [ 104.398675][ T5350] ? trace_kmalloc+0x2a/0xf0 [ 104.400649][ T5350] ? __kmalloc_noprof+0x387/0x710 [ 104.402807][ T5350] ? __kmalloc_noprof+0x1a6/0x710 [ 104.404918][ T5350] ? hfs_find_init+0x9d/0x300 [ 104.406880][ T5350] hfs_find_init+0x18d/0x300 [ 104.408797][ T5350] hfs_extend_file+0x367/0x1680 [ 104.410957][ T5350] ? __asan_memcpy+0x40/0x70 [ 104.413275][ T5350] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.415509][ T5350] ? __hfs_brec_find+0x335/0x510 [ 104.418009][ T5350] ? do_raw_spin_unlock+0x4d/0x200 [ 104.420541][ T5350] ? hfs_brec_find+0x3cc/0x510 [ 104.422653][ T5350] hfs_bmap_reserve+0x108/0x430 [ 104.425221][ T5350] __hfs_ext_write_extent+0x200/0x620 [ 104.428099][ T5350] ? __kmalloc_noprof+0x1a6/0x710 [ 104.430795][ T5350] ? hfs_find_init+0x9d/0x300 [ 104.433282][ T5350] __hfs_ext_cache_extent+0x6e/0x9b0 [ 104.436116][ T5350] ? hfs_find_init+0x18d/0x300 [ 104.438325][ T5350] hfs_extend_file+0x3ad/0x1680 [ 104.440427][ T5350] ? __pfx_hfs_extend_file+0x10/0x10 [ 104.442677][ T5350] ? __lock_acquire+0x747/0x2de0 [ 104.444754][ T5350] ? __lock_acquire+0x747/0x2de0 [ 104.446891][ T5350] ? rcu_is_watching+0x16/0xb0 [ 104.448957][ T5350] ? trace_kmem_cache_alloc+0x29/0xe0 [ 104.451286][ T5350] hfs_get_block+0x401/0xbf0 [ 104.453044][ T5350] ? __pfx_hfs_get_block+0x10/0x10 [ 104.455264][ T5350] ? do_raw_spin_unlock+0x4d/0x200 [ 104.457437][ T5350] ? _raw_spin_unlock+0x28/0x50 [ 104.459529][ T5350] ? create_empty_buffers+0x41e/0x4d0 [ 104.461785][ T5350] __block_write_begin_int+0x6c1/0x1930 [ 104.464157][ T5350] ? __pfx_hfs_get_block+0x10/0x10 [ 104.466684][ T5350] ? __pfx___block_write_begin_int+0x10/0x10 [ 104.469256][ T5350] cont_write_begin+0x71b/0xac0 [ 104.471306][ T5350] ? __pfx_cont_write_begin+0x10/0x10 [ 104.473663][ T5350] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 104.476297][ T5350] hfs_write_begin+0x123/0x1c0 [ 104.478355][ T5350] ? __pfx_hfs_get_block+0x10/0x10 [ 104.480502][ T5350] generic_perform_write+0x2d5/0x8e0 [ 104.482723][ T5350] ? __pfx_generic_perform_write+0x10/0x10 [ 104.485197][ T5350] ? file_update_time_flags+0x1e0/0x440 [ 104.487625][ T5350] ? __generic_file_write_iter+0xf9/0x230 [ 104.490066][ T5350] ? generic_file_write_iter+0x9a/0x330 [ 104.492136][ T5350] generic_file_write_iter+0xae/0x330 [ 104.494414][ T5350] vfs_write+0x612/0xba0 [ 104.496230][ T5350] ? __pfx_vfs_write+0x10/0x10 [ 104.498249][ T5350] ? __fget_files+0x3a2/0x420 [ 104.500275][ T5350] ? __fget_files+0x2a/0x420 [ 104.502304][ T5350] ? fdget+0x1ac/0x250 [ 104.504076][ T5350] ksys_write+0x150/0x270 [ 104.505920][ T5350] ? __pfx_ksys_write+0x10/0x10 [ 104.507974][ T5350] do_syscall_64+0x166/0x520 [ 104.510108][ T5350] ? trace_irq_disable+0x3b/0x140 [ 104.512237][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.514917][ T5350] ? clear_bhb_loop+0x70/0xc0 [ 104.516951][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.519471][ T5350] RIP: 0033:0x7f8f9f39f559 [ 104.521459][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.529676][ T5350] RSP: 002b:00007f8fa029bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.533202][ T5350] RAX: ffffffffffffffda RBX: 00007f8f9f625fa0 RCX: 00007f8f9f39f559 [ 104.536484][ T5350] RDX: 00000000fffffdef RSI: 0000200000001b40 RDI: 0000000000000008 [ 104.539735][ T5350] RBP: 00007f8f9f436b20 R08: 0000000000000000 R09: 0000000000000000 [ 104.543245][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.546662][ T5350] R13: 00007f8f9f626038 R14: 00007f8f9f625fa0 R15: 00007ffcff30ac28 [ 104.550020][ T5350] [ 104.563906][ T4665] Bluetooth: hci0: command tx timeout [ 106.622982][ T4665] Bluetooth: hci0: command tx timeout