program: syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x40, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file7\x00', 0x105042, 0x1ff) linkat(0xffffffffffffff9c, &(0x7f0000000000)='./file4\x00', 0xffffffffffffff9c, &(0x7f00000006c0)='./file5\x00', 0x0) syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000080)='./bus\x00', 0x1000000, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'], 0x2, 0x58a, &(0x7f0000000740)="$eJzs3c1rXWkZAPDnPc1NbzrtzJ22ttaOckHBMmJJ006qpjjWyQSE4oRp04UrY5N2wtwkJclIOgzahejG/8HVbBRkQN0ILnTrQnciA67ErVEGBhRHOSfnfiUZk5mbm4/m94PknnvOcz7eAwk872cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFff/nm8JW0308BAAAA9NM3b786PCL/BwAAgCfaHe3/AAAAAAAAAHDYpcjih5Fi9dRaOll8X1e9NbfwxurU+MTWpw2l4sxjRXz+U70ycvXaC6PXv9T8/P/n77YL8crtOzfrLy3OP1yaXV6enalPLczdW5yZ3fEVej1/o+eLF1Cff/2Nmfv3l+sjl692HV6t/e34U+dqY19++eytZuzU+MTE7Y6YgcrHvvsmengAAAAcbYORxbVIcefiz9OpiMii91x4m7qDfhuKWp5/F4WYGp8oCtKYm15YyQ9ONhPhWndOPNjMkfcgF+9JLeJ0/qyDMnoAAAB2rhJZfCZSXPhgLT0dEceaefAXiokBt79AbQ8ecgsDEXEmIi7FIcjZAQAAYJ8djyxejRS/adTimTKvLvL/r0WM7ffDAQAAALtiILK4HineG1tLtaI/QEQ8PzU+Ub91t/6NhfuLHbGTqWxRP+zjA/aSvgkAAAAcANXI4lTR4r+Wnv2QmIE9fiYAAABgdw1FFv+KFJ9/8bvFvHJRzEv/zNhXTt6Y6Jxh7vw218ljL0fExR2Oya+Ucw1OpsmUsk1Xe7wrhQMAAAAK1ZTFXyPF+3+uFt8vlbl50ugPAAAAT46UxQ8ixVcn11LasC79sY71/VsO+9j//j7/UPWlxYePluYevLay5fET1ZvfWV5Zmr639eH1tQu7ukNst44hAAAA7EAlZfHPSPH7xjutvLNcA6DsAdBONN++0c5Nq2nD0aLe4Omi3qA1huCpkZHO7S1T1o8wP16tvO+x3osNAAAAR0pKWQxGis/97pPl2v8nYlMbdBn3h0hxY/G5Mi4bzOOawwRqxe/q/bnG7HAeOx4pftloxkYRe7yMPdOOvZLH/ja/7nR3bLWMPduOHcljP4gUry1tHfuJduzVPHYpUvzsJ/Vm7Ik89mQZe64de/neYmOmby8YAAAADoBKyuJXkeLH/663hvx3t/+3W9vffqvd3r9pgr4PafPvtf2/1rHvcVkPcbysrxjYpr7ilUhx4dnnmuUp6gqa3QrW1zpo11f8I1Isfas7drCMPd2OvbLjFwsAAAAHSLP//x/v/rrV5b7MgcuvW+f/n9o4P2Cf8v/ONQnzey4/evP16UZjdmk/Nyof8azvR0TXnnQQSmHjv6WD8jx7ulH+UT0+KM/T60Zv/wcBAOAoyPP/u5Fi9b13W+3dZf5fdpVv5//vf6+d/49tvFCf8v/THfvGyvkGKgMR1ZX5h5XzEdXlR29+cW5++sHsg9mFq6MvjA6Pjl6/NlIZbDbut7d6flcAAABwWOX5/3Ck+PuPftoan7+T9v8TGy/Up/z/TMe+/J7tRr98z196LT4AAAAcCXn+/4tI8aeL77Tm0evO/zvm/3+rPc7+0mfXewu0agf6lP+f7dhXK+4bMbRLZQcAAAAAAAAAAAAAAAAAAICDopKy+E+keLc6kMoJ/3c0/9/Mxgv1afz/uY59M7E36//1/FIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgkMoii7lI8enza+nFfMe3I052fgIAAACH3v8CAAD//16XHzs=") write$binfmt_script(r0, &(0x7f00000008c0), 0xfecc) (async) open(&(0x7f0000000140)='./file1\x00', 0x64042, 0x178) (async) open(&(0x7f00000003c0)='./file3\x00', 0x14507e, 0x148) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000006ac0)='cpuacct.stat\x00', 0x275a, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000640)='.log\x00', 0xa5d, 0x1) (async) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.dequeue\x00', 0x275a, 0x0) (rerun: 32) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='freezer.state\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) [ 94.877210][ T4642] Bluetooth: hci0: command tx timeout [ 94.940575][ T5310] loop0: detected capacity change from 0 to 64 [ 95.240452][ T5321] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI [ 95.246089][ T5321] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 95.249656][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.253277][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.257426][ T5321] RIP: 0010:bfs_get_block+0x583/0xb50 [ 95.259776][ T5321] Code: 89 c5 49 8d 7e 20 48 89 f8 48 c1 e8 03 80 3c 18 00 49 89 df 74 05 e8 0c 7b 83 ff 49 8b 6e 20 49 8d 5d 28 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 ee 7a 83 ff 4c 89 f7 48 83 c7 28 [ 95.268189][ T5321] RSP: 0018:ffffc9000e3d6618 EFLAGS: 00010206 [ 95.270779][ T5321] RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff888031e10000 [ 95.273653][ T5321] RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff888037334020 [ 95.276436][ T5321] RBP: 0000000000000200 R08: ffffea00004e1c37 R09: 1ffffd400009c386 [ 95.279642][ T5321] R10: dffffc0000000000 R11: fffff9400009c387 R12: 0000000000000022 [ 95.283343][ T5321] R13: 0000000000000000 R14: ffff888037334000 R15: dffffc0000000000 [ 95.286755][ T5321] FS: 00007ff401bfc6c0(0000) GS:ffff88808c2c2000(0000) knlGS:0000000000000000 [ 95.290322][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.293075][ T5321] CR2: 00000000fffff580 CR3: 0000000032dd4000 CR4: 0000000000352ef0 [ 95.296623][ T5321] Call Trace: [ 95.298100][ T5321] [ 95.299421][ T5321] __block_write_begin_int+0x6c2/0x1900 [ 95.302006][ T5321] ? __pfx_bfs_get_block+0x10/0x10 [ 95.304713][ T5321] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.308308][ T5321] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 95.311275][ T5321] ? __pfx_bfs_get_block+0x10/0x10 [ 95.313667][ T5321] block_write_begin+0x8d/0x120 [ 95.315666][ T5321] ? bfs_write_begin+0x1e/0xd0 [ 95.317537][ T5321] bfs_write_begin+0x35/0xd0 [ 95.319154][ T5321] generic_perform_write+0x2d5/0x8f0 [ 95.321428][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 95.323978][ T5321] ? file_update_time_flags+0x1e0/0x440 [ 95.326445][ T5321] ? __generic_file_write_iter+0xf9/0x230 [ 95.328990][ T5321] ? generic_file_write_iter+0x9a/0x330 [ 95.331460][ T5321] generic_file_write_iter+0xae/0x330 [ 95.333836][ T5321] __kernel_write_iter+0x44a/0x8f0 [ 95.336154][ T5321] ? __pfx___kernel_write_iter+0x10/0x10 [ 95.338660][ T5321] ? __asan_memset+0x22/0x50 [ 95.340735][ T5321] ? iov_iter_kvec+0xb8/0x180 [ 95.342794][ T5321] __kernel_write+0x106/0x170 [ 95.344760][ T5321] ? __pfx___kernel_write+0x10/0x10 [ 95.346947][ T5321] ? do_raw_spin_unlock+0x4d/0x200 [ 95.349030][ T5321] ? _raw_spin_unlock+0x28/0x50 [ 95.351020][ T5321] ? generic_file_llseek_size+0x419/0x4a0 [ 95.353276][ T5321] dump_emit+0x920/0xb00 [ 95.355009][ T5321] ? __pfx_dump_emit+0x10/0x10 [ 95.356973][ T5321] ? dump_emit+0x938/0xb00 [ 95.358792][ T5321] ? dump_align+0xc5/0x110 [ 95.361049][ T5321] writenote+0x1c0/0x2f0 [ 95.363510][ T5321] ? __pfx_writenote+0x10/0x10 [ 95.366335][ T5321] ? elf_core_dump+0x2a8f/0x3a90 [ 95.368549][ T5321] ? elf_core_dump+0x2a8f/0x3a90 [ 95.370756][ T5321] elf_core_dump+0x30f1/0x3a90 [ 95.372898][ T5321] ? __pfx_elf_core_dump+0x10/0x10 [ 95.375132][ T5321] ? kasan_save_track+0x4f/0x80 [ 95.377205][ T5321] ? coredump_write+0x394/0x1960 [ 95.379261][ T5321] ? vfs_coredump+0x3764/0x4520 [ 95.381098][ T5321] ? get_signal+0x1094/0x12c0 [ 95.382822][ T5321] ? arch_do_signal_or_restart+0xbb/0x860 [ 95.385223][ T5321] ? irqentry_exit+0x2ba/0x910 [ 95.387494][ T5321] ? asm_exc_page_fault+0x26/0x30 [ 95.389788][ T5321] ? lock_acquire+0x115/0x350 [ 95.392028][ T5321] ? 0xffffffffff600000 [ 95.393985][ T5321] coredump_write+0x1290/0x1960 [ 95.396197][ T5321] ? __pfx_coredump_write+0x10/0x10 [ 95.398503][ T5321] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.400744][ T5321] ? put_files_struct+0x24f/0x350 [ 95.402924][ T5321] ? do_raw_spin_unlock+0x4d/0x200 [ 95.405321][ T5321] ? unshare_files+0x103/0x140 [ 95.407538][ T5321] vfs_coredump+0x3764/0x4520 [ 95.409733][ T5321] ? __pfx_vfs_coredump+0x10/0x10 [ 95.412232][ T5321] ? __lock_acquire+0x747/0x2de0 [ 95.414630][ T5321] ? __lock_acquire+0x747/0x2de0 [ 95.416944][ T5321] ? lock_acquire+0x115/0x350 [ 95.419140][ T5321] ? lock_acquire+0x115/0x350 [ 95.421343][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 95.423785][ T5321] ? is_bpf_text_address+0x292/0x2b0 [ 95.426040][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 95.428213][ T5321] ? kernel_text_address+0xa5/0xe0 [ 95.430772][ T5321] ? __kernel_text_address+0xd/0x30 [ 95.433429][ T5321] ? unwind_get_return_address+0x4d/0x90 [ 95.436198][ T5321] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 95.438662][ T5321] ? arch_stack_walk+0xfb/0x150 [ 95.440716][ T5321] ? stack_trace_save+0xa9/0x100 [ 95.442876][ T5321] ? __pfx_stack_trace_save+0x10/0x10 [ 95.445114][ T5321] ? stack_depot_save_flags+0x33/0x7f0 [ 95.447276][ T5321] ? __lock_acquire+0x6b0/0x2de0 [ 95.449526][ T5321] ? kasan_save_track+0x4f/0x80 [ 95.451776][ T5321] ? kasan_save_track+0x3e/0x80 [ 95.454410][ T5321] ? kasan_save_free_info+0x40/0x50 [ 95.457076][ T5321] ? __kasan_slab_free+0x5c/0x80 [ 95.459275][ T5321] ? kmem_cache_free+0x182/0x650 [ 95.461500][ T5321] ? get_signal+0x9e7/0x12c0 [ 95.463590][ T5321] ? arch_do_signal_or_restart+0xbb/0x860 [ 95.466063][ T5321] ? irqentry_exit+0x2ba/0x910 [ 95.468275][ T5321] ? asm_exc_page_fault+0x26/0x30 [ 95.470561][ T5321] ? proc_coredump_connector+0x187/0x4e0 [ 95.473332][ T5321] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.476067][ T5321] get_signal+0x1094/0x12c0 [ 95.478321][ T5321] arch_do_signal_or_restart+0xbb/0x860 [ 95.480928][ T5321] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 95.484105][ T5321] irqentry_exit+0x2ba/0x910 [ 95.486093][ T5321] ? trace_irq_disable+0x3b/0x140 [ 95.488090][ T5321] asm_exc_page_fault+0x26/0x30 [ 95.490150][ T5321] RIP: 0033:0x7ff400d9e161 [ 95.492072][ T5321] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 95.501353][ T5321] RSP: 002b:00000000fffffeb0 EFLAGS: 00010217 [ 95.504177][ T5321] RAX: 0000000000000000 RBX: 00007ff401026180 RCX: 00007ff400d9e159 [ 95.507730][ T5321] RDX: 0000000000000000 RSI: 00000000fffffeb0 RDI: 0000000002000400 [ 95.511060][ T5321] RBP: 00007ff400e3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.514846][ T5321] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 95.518753][ T5321] R13: 00007ff401026218 R14: 00007ff401026180 R15: 00007fff202e7018 [ 95.522265][ T5321] [ 95.523759][ T5321] Modules linked in: [ 95.526644][ T5321] ---[ end trace 0000000000000000 ]--- [ 95.618427][ T5321] RIP: 0010:bfs_get_block+0x583/0xb50 [ 95.618473][ T5321] Code: 89 c5 49 8d 7e 20 48 89 f8 48 c1 e8 03 80 3c 18 00 49 89 df 74 05 e8 0c 7b 83 ff 49 8b 6e 20 49 8d 5d 28 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 ee 7a 83 ff 4c 89 f7 48 83 c7 28 [ 95.618486][ T5321] RSP: 0018:ffffc9000e3d6618 EFLAGS: 00010206 [ 95.618502][ T5321] RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff888031e10000 [ 95.618513][ T5321] RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff888037334020 [ 95.618523][ T5321] RBP: 0000000000000200 R08: ffffea00004e1c37 R09: 1ffffd400009c386 [ 95.618533][ T5321] R10: dffffc0000000000 R11: fffff9400009c387 R12: 0000000000000022 [ 95.619477][ T5321] R13: 0000000000000000 R14: ffff888037334000 R15: dffffc0000000000 [ 95.619494][ T5321] FS: 00007ff401bfc6c0(0000) GS:ffff88808c2c2000(0000) knlGS:0000000000000000 [ 95.619508][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.619518][ T5321] CR2: 00007ff401bfbff0 CR3: 0000000032dd4000 CR4: 0000000000352ef0 [ 95.619571][ T5321] Kernel panic - not syncing: Fatal exception [ 95.666778][ T5321] Kernel Offset: disabled [ 95.668779][ T5321] Rebooting in 86400 seconds..