program: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0x24}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@private0, 0x1, 0x1, 0x2, 0x1a, 0xffff, 0x5}, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r4, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r3, 0x800452d3, &(0x7f0000000100)) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r5, &(0x7f00000006c0)={0x0, 0x17, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010000d042abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="29400000000000000004000280"], 0x34}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000e1fffffffffffbffffff0000000011d1dde7d11c281abd8f3b1cd6c431e5fe06fc88f9abdfea756329bdebb51e8bf5050041fc6572577f87cef94997f4887ec0912748db058d24fc16510267d9cb7960b3f698a8bcaf9fb35a85e189c00e4b133c58575f95f2d9516a6835246bd7042a5047b4b490acfc4b201468caed612a6f21cd63b94f5fd8b7133b1cce4936f6c5af44f8d2b4474ef687cfc3fffba90d353bf5c0c822edaa772d75693493a07df6f13889b7fad4b6800aa8794147cd592c42681100628eb95e45b97d26d11d6788ebe167272f888cba9085db0a6e469ea53c6aded01ee03564e01c61687d1e684d57924dc6d13c18a7e1ede3b67f40ea55", @ANYRES32=r10, @ANYBLOB="0000000001040000280012800e0001006970366772657461700000001400028006001100000000000600030067000000"], 0x48}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYRESDEC=r2, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r11], 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$hfs(&(0x7f0000002c80), &(0x7f0000000080)='./file1\x00', 0x4490, &(0x7f0000002cc0)=ANY=[], 0xfd, 0x289, &(0x7f0000000700)="$eJzs3U1rE0Ecx/HfbNIm2lK3DyKIp2rBk/ThIl4KknfgxZOoTYRiqKAV1FP1LL4A730LvgCPnsSz4K0nX0BvkZmdNJtkJ5uGxk3S7wcSNt35z85kZjvzTykRgEvrYe3P8c6JfRippJKkB1IkqSqVJV3Xjerbg8P9w2ajPqiikouwD6Mk0vSV2TtoZIXaOBfhxfZVWYvpn2E8qr91VHQbUDx392eIpIq/O9356n9v2Xhc9klvTnWqd1oquh0AgGL59T/y6/yi379HkbThl/3u9X/KF9BZ2ceEfM85n1r/XZbVMnZ8r7lTnXzPpXBlzfmg452TUdoyr2RmdW0wTV5W6doSXXmx32zc23vVrEf6pF1vrlNszT3Xk6nb1s5p7fHH/qrXfW46ZH6Zru18Flwf5mwfttPtTxVZvdgr5jM/zE/zxMT6qvrZ/q/cMnaY3EjFbqTM2S2etH8zXKPr5bxcqUAvl91FbvoreAN7WVIgI1F7Ri33DGCc104XtdITlfRuKydqNTNqOydqrTeqM5vDkeNmvpjHZl1/9U211P4/su/2hoa5M20ZV9LPjIH9KbuSsVtP/CdCR7cyS0aj9ggj+Kznuq+lN+8/vHzWbDZez+yBvRMnoBkTddCeBJPSnpk9sG9yIVdvrzuj1xP+1cHH8rOjM+jniQpuzDB97L7LJPlfKl/ZdJs1+xR379Mr6dhWXuWpGrcCucGKe74azuC6JHnJQsZfF/uvODDnun1XujPMFROxb+fk2R0lyNT0S0/5/B8AAAAAAAAAAAAAAAAAAGDaXNy/HFQVOlV0HwEAAAAAAAAAAAAAAAAAAAAAmHYZ3/9bKfT7fx8pecX3/wJj9y8AAP//KyFypg==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) [ 85.733543][ T4652] Bluetooth: hci0: command tx timeout [ 85.853309][ T5331] netlink: 20 bytes leftover after parsing attributes in process `syz.0.0'. [ 85.861461][ T5331] netlink: 40 bytes leftover after parsing attributes in process `syz.0.0'. [ 85.870039][ T5331] loop0: detected capacity change from 0 to 64 [ 85.911267][ T5331] hfs: new node 0 already hashed? [ 85.913957][ T5331] ------------[ cut here ]------------ [ 85.916177][ T5331] 1 [ 85.916187][ T5331] WARNING: fs/hfs/bnode.c:520 at hfs_bnode_create+0x45a/0x4e0, CPU#0: syz.0.0/5331 [ 85.921759][ T5331] Modules linked in: [ 85.923660][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.927532][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.931879][ T5331] RIP: 0010:hfs_bnode_create+0x45a/0x4e0 [ 85.934240][ T5331] Code: 08 8c 89 ee e8 27 b9 71 fe e9 d6 fc ff ff e8 4d 7b 10 ff 4c 89 ef e8 45 86 1e 09 48 c7 c7 20 c0 08 8c 89 ee e8 07 b9 71 fe 90 <0f> 0b 90 eb b0 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c dd fb ff ff [ 85.942324][ T5331] RSP: 0018:ffffc9000f127408 EFLAGS: 00010246 [ 85.945046][ T5331] RAX: 000000000000001f RBX: ffff88803fce6000 RCX: e601abda1bd20f00 [ 85.948468][ T5331] RDX: ffffc90020001000 RSI: 0000000000000e1e RDI: 0000000000000e1f [ 85.951734][ T5331] RBP: 0000000000000000 R08: ffffc9000f127187 R09: 1ffff92001e24e30 [ 85.955069][ T5331] R10: dffffc0000000000 R11: fffff52001e24e31 R12: 0000000000000000 [ 85.958804][ T5331] R13: ffff88803fce60d8 R14: ffff8880136e5f00 R15: dffffc0000000000 [ 85.962528][ T5331] FS: 00007f48af2f96c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 85.966161][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.969063][ T5331] CR2: 00007f48ae566f00 CR3: 000000001c382000 CR4: 0000000000352ef0 [ 85.972408][ T5331] Call Trace: [ 85.973916][ T5331] [ 85.975159][ T5331] ? do_raw_spin_unlock+0x4d/0x210 [ 85.977480][ T5331] hfs_bmap_alloc+0x5bd/0x650 [ 85.979645][ T5331] ? __pfx_hfs_bmap_alloc+0x10/0x10 [ 85.981910][ T5331] ? hfs_bnode_read+0x22d/0x800 [ 85.984040][ T5331] hfs_bnode_split+0xd4/0x1070 [ 85.986183][ T5331] ? hfs_bnode_read+0x22d/0x800 [ 85.988320][ T5331] ? __asan_memcpy+0x40/0x70 [ 85.990412][ T5331] ? hfs_bnode_read+0x3c0/0x800 [ 85.992604][ T5331] ? hfs_bnode_read_u16+0x8d/0xe0 [ 85.994766][ T5331] ? __pfx_hfs_bnode_split+0x10/0x10 [ 85.997267][ T5331] ? __hfs_brec_find+0x335/0x510 [ 85.999278][ T5331] hfs_brec_insert+0x3a4/0xc80 [ 86.001372][ T5331] ? __pfx_hfs_brec_insert+0x10/0x10 [ 86.003579][ T5331] ? __asan_memset+0x22/0x50 [ 86.005430][ T5331] ? hfs_cat_build_record+0x231/0x7f0 [ 86.008150][ T5331] hfs_cat_create+0x50c/0x810 [ 86.010303][ T5331] ? __pfx_hfs_cat_create+0x10/0x10 [ 86.012493][ T5331] ? _raw_spin_unlock+0x28/0x50 [ 86.014554][ T5331] ? hfs_new_inode+0x8b8/0xc10 [ 86.016434][ T5331] hfs_create+0x78/0xe0 [ 86.018230][ T5331] ? __pfx_hfs_create+0x10/0x10 [ 86.020275][ T5331] path_openat+0x133a/0x3830 [ 86.022338][ T5331] do_file_open+0x23e/0x4a0 [ 86.024277][ T5331] ? __pfx_do_file_open+0x10/0x10 [ 86.026412][ T5331] ? _raw_spin_unlock+0x28/0x50 [ 86.028629][ T5331] ? alloc_fd+0x651/0x6c0 [ 86.030625][ T5331] do_sys_openat2+0x115/0x200 [ 86.032608][ T5331] ? __se_sys_futex+0x3a8/0x450 [ 86.034736][ T5331] ? __pfx_do_sys_openat2+0x10/0x10 [ 86.036959][ T5331] ? rcu_is_watching+0x15/0xb0 [ 86.039022][ T5331] __x64_sys_openat+0x138/0x170 [ 86.041186][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.043757][ T5331] do_syscall_64+0x174/0x580 [ 86.045799][ T5331] ? trace_irq_disable+0x3b/0x140 [ 86.048045][ T5331] ? clear_bhb_loop+0x40/0x90 [ 86.050059][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.052567][ T5331] RIP: 0033:0x7f48ae39de99 [ 86.054479][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.062867][ T5331] RSP: 002b:00007f48af2f8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 86.066303][ T5331] RAX: ffffffffffffffda RBX: 00007f48ae625fa0 RCX: 00007f48ae39de99 [ 86.069973][ T5331] RDX: 000000000000275a RSI: 0000200000000280 RDI: ffffffffffffff9c [ 86.073229][ T5331] RBP: 00007f48ae433eaf R08: 0000000000000000 R09: 0000000000000000 [ 86.076679][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.080114][ T5331] R13: 00007f48ae626038 R14: 00007f48ae625fa0 R15: 00007ffd799b8cd8 [ 86.083506][ T5331] [ 86.084833][ T5331] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 86.087911][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.091654][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.095781][ T5331] Call Trace: [ 86.097259][ T5331] [ 86.098543][ T5331] vpanic+0x56c/0xa60 [ 86.100366][ T5331] ? __pfx__printk+0x10/0x10 [ 86.102435][ T5331] ? __pfx_vpanic+0x10/0x10 [ 86.104429][ T5331] ? is_bpf_text_address+0x292/0x2b0 [ 86.106783][ T5331] ? is_bpf_text_address+0x26/0x2b0 [ 86.108980][ T5331] panic+0xc5/0xd0 [ 86.110699][ T5331] ? __pfx_panic+0x10/0x10 [ 86.112620][ T5331] __warn+0x315/0x4c0 [ 86.114320][ T5331] ? hfs_bnode_create+0x45a/0x4e0 [ 86.116417][ T5331] ? hfs_bnode_create+0x45a/0x4e0 [ 86.118532][ T5331] __report_bug+0x276/0x570 [ 86.120484][ T5331] ? hfs_bnode_create+0x45a/0x4e0 [ 86.122669][ T5331] ? __pfx___report_bug+0x10/0x10 [ 86.124953][ T5331] ? __wake_up_klogd+0xe6/0x120 [ 86.127060][ T5331] ? vprintk_emit+0x4eb/0x560 [ 86.129121][ T5331] ? __pfx_vprintk_emit+0x10/0x10 [ 86.131246][ T5331] ? lockdep_hardirqs_on+0x7a/0x110 [ 86.133446][ T5331] ? hfs_bnode_create+0x45a/0x4e0 [ 86.135606][ T5331] report_bug+0x16a/0x220 [ 86.137435][ T5331] ? hfs_bnode_create+0x45a/0x4e0 [ 86.139591][ T5331] ? hfs_bnode_create+0x45c/0x4e0 [ 86.141781][ T5331] handle_bug+0x9c/0x200 [ 86.143600][ T5331] exc_invalid_op+0x1a/0x50 [ 86.145604][ T5331] asm_exc_invalid_op+0x1a/0x20 [ 86.147769][ T5331] RIP: 0010:hfs_bnode_create+0x45a/0x4e0 [ 86.150325][ T5331] Code: 08 8c 89 ee e8 27 b9 71 fe e9 d6 fc ff ff e8 4d 7b 10 ff 4c 89 ef e8 45 86 1e 09 48 c7 c7 20 c0 08 8c 89 ee e8 07 b9 71 fe 90 <0f> 0b 90 eb b0 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c dd fb ff ff [ 86.158410][ T5331] RSP: 0018:ffffc9000f127408 EFLAGS: 00010246 [ 86.161123][ T5331] RAX: 000000000000001f RBX: ffff88803fce6000 RCX: e601abda1bd20f00 [ 86.164651][ T5331] RDX: ffffc90020001000 RSI: 0000000000000e1e RDI: 0000000000000e1f [ 86.168119][ T5331] RBP: 0000000000000000 R08: ffffc9000f127187 R09: 1ffff92001e24e30 [ 86.171605][ T5331] R10: dffffc0000000000 R11: fffff52001e24e31 R12: 0000000000000000 [ 86.175057][ T5331] R13: ffff88803fce60d8 R14: ffff8880136e5f00 R15: dffffc0000000000 [ 86.178402][ T5331] ? hfs_bnode_create+0x459/0x4e0 [ 86.180586][ T5331] ? do_raw_spin_unlock+0x4d/0x210 [ 86.182883][ T5331] hfs_bmap_alloc+0x5bd/0x650 [ 86.184881][ T5331] ? __pfx_hfs_bmap_alloc+0x10/0x10 [ 86.187031][ T5331] ? hfs_bnode_read+0x22d/0x800 [ 86.189126][ T5331] hfs_bnode_split+0xd4/0x1070 [ 86.191185][ T5331] ? hfs_bnode_read+0x22d/0x800 [ 86.193219][ T5331] ? __asan_memcpy+0x40/0x70 [ 86.195181][ T5331] ? hfs_bnode_read+0x3c0/0x800 [ 86.197283][ T5331] ? hfs_bnode_read_u16+0x8d/0xe0 [ 86.199459][ T5331] ? __pfx_hfs_bnode_split+0x10/0x10 [ 86.201721][ T5331] ? __hfs_brec_find+0x335/0x510 [ 86.203887][ T5331] hfs_brec_insert+0x3a4/0xc80 [ 86.205957][ T5331] ? __pfx_hfs_brec_insert+0x10/0x10 [ 86.208228][ T5331] ? __asan_memset+0x22/0x50 [ 86.210277][ T5331] ? hfs_cat_build_record+0x231/0x7f0 [ 86.212521][ T5331] hfs_cat_create+0x50c/0x810 [ 86.214525][ T5331] ? __pfx_hfs_cat_create+0x10/0x10 [ 86.216701][ T5331] ? _raw_spin_unlock+0x28/0x50 [ 86.218733][ T5331] ? hfs_new_inode+0x8b8/0xc10 [ 86.220786][ T5331] hfs_create+0x78/0xe0 [ 86.222607][ T5331] ? __pfx_hfs_create+0x10/0x10 [ 86.224663][ T5331] path_openat+0x133a/0x3830 [ 86.226676][ T5331] do_file_open+0x23e/0x4a0 [ 86.228585][ T5331] ? __pfx_do_file_open+0x10/0x10 [ 86.230702][ T5331] ? _raw_spin_unlock+0x28/0x50 [ 86.232739][ T5331] ? alloc_fd+0x651/0x6c0 [ 86.234603][ T5331] do_sys_openat2+0x115/0x200 [ 86.236640][ T5331] ? __se_sys_futex+0x3a8/0x450 [ 86.238773][ T5331] ? __pfx_do_sys_openat2+0x10/0x10 [ 86.241036][ T5331] ? rcu_is_watching+0x15/0xb0 [ 86.243071][ T5331] __x64_sys_openat+0x138/0x170 [ 86.245139][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.247818][ T5331] do_syscall_64+0x174/0x580 [ 86.249906][ T5331] ? trace_irq_disable+0x3b/0x140 [ 86.251998][ T5331] ? clear_bhb_loop+0x40/0x90 [ 86.254086][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.256625][ T5331] RIP: 0033:0x7f48ae39de99 [ 86.258558][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.266601][ T5331] RSP: 002b:00007f48af2f8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 86.270194][ T5331] RAX: ffffffffffffffda RBX: 00007f48ae625fa0 RCX: 00007f48ae39de99 [ 86.273487][ T5331] RDX: 000000000000275a RSI: 0000200000000280 RDI: ffffffffffffff9c [ 86.276885][ T5331] RBP: 00007f48ae433eaf R08: 0000000000000000 R09: 0000000000000000 [ 86.280256][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.283608][ T5331] R13: 00007f48ae626038 R14: 00007f48ae625fa0 R15: 00007ffd799b8cd8 [ 86.286949][ T5331] [ 86.288695][ T5331] Kernel Offset: disabled [ 86.290574][ T5331] Rebooting in 86400 seconds..