program: syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=0x0], 0xfe, 0x189, &(0x7f00000006c0)="$eJzslD9PwkAYxp+7IgSjk5uJcZBEHChtUeNiDPELkPgvbqJUghYhUBPBybj6AVxd/QosJn4RdTImjM6Ytld6GEBjom3i+xtenuPeu7739vqAIIh/y8vz+9PNW+dSATCFFBLi/1clyOFS/nkheTiT2bzv3D5eb9TnasP27PW+//wYgIe8Aru/dnB1Svxug/f1DjiWhN4Dgyr0ATh2hTbBsC/0iaRrTr6qHlcsUz2qWSVHaE7QnWA4Ife5vu4VQ0mqj0nzzVb7tGhZZuMXxVf96+Y51qX65Pfl90aT+qeDQxc6B4YtodeQ8HvjtUQ6/2ws2F/54/OHIfxLGJV6IiD8ax+VekhEWgT+1LtjWJT8KSb5R9au1rPNVjtTqRbLZtk8M4zcqrasaStG1jUiL47xv6TrT5PS/hMjcuMsjouibTd0L/bHhheHOS53/Y8jveCNnY8gPrIab56JdcxVaWVMOkEQRGjMg7meGTAtXHQAoxB2oQRBEARBEARBEARB/JiPAAAA///DpGx6") r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000240)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r1, 0xc02864c3, &(0x7f0000000400)={&(0x7f0000000440)=[r2], 0x800000000000002, 0x40000039, 0x9}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r3, 0xc02064cc, &(0x7f00000001c0)={r4, r4, 0x1, 0x0, 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01864c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01864c2, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r0, 0xc02864c3, &(0x7f0000000280)={&(0x7f0000000240)=[r2, 0x0, 0x0, r4, r5, r6], 0x6, 0x6, 0x4}) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) r7 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r8 = openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r8, 0xc0506617, &(0x7f0000000580)={@desc={0x1, 0x0, @desc4}, 0x40, 0x0, '\x00', @a}) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r7, 0xc0406618, &(0x7f0000000000)={@desc={0x1, 0x0, @desc4}}) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000600)={0x0, 0x2, 0x7, 0xd}, &(0x7f0000000640)=0x10) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000002c0)={r10, 0xb, 0x6, 0x9}, &(0x7f0000000680)=0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r9, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r12, 0xab00, r13) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r9, 0x84, 0x1f, &(0x7f0000000500)={r11, @in6={{0xa, 0x7, 0x2, @remote, 0x6}}, 0xef66, 0x4}, &(0x7f00000005c0)=0x90) r14 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r14, 0x40946400, &(0x7f0000000140)={'8255\x00', [0xff, 0x2168, 0x2, 0x8, 0x88d6, 0x8f, 0x0, 0x80, 0x2, 0xffffffff, 0x200, 0xfff, 0x344, 0x1, 0x0, 0x200, 0x49, 0x3, 0x81, 0xe, 0x4, 0x0, 0x80, 0x7ff, 0x1, 0xffffffff, 0xb0c4, 0x7df, 0x8, 0xf3, 0x46d]}) [ 92.981961][ T10] cfg80211: failed to load regulatory.db [ 92.984770][ T4652] Bluetooth: hci0: command tx timeout [ 92.949339][ T5326] loop0: detected capacity change from 0 to 16 [ 92.958912][ T10] cfg80211: failed to load regulatory.db [ 92.965360][ T4652] Bluetooth: hci0: command tx timeout [ 93.058648][ T5326] erofs (device loop0): invalid checksum 0xf8a463af, 0x7bbbea8c expected [ 93.094282][ T5326] ------------[ cut here ]------------ [ 93.096753][ T5326] 1 [ 93.096764][ T5326] WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380, CPU#0: syz.0.0/5326 [ 93.102523][ T5326] Modules linked in: [ 93.104211][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.108046][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.112208][ T5326] RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.115038][ T5326] Code: 74 10 4c 89 e7 89 54 24 0c e8 0e 2c 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 1c 1b 19 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 93.123323][ T5326] RSP: 0018:ffffc9000f82f8a0 EFLAGS: 00010246 [ 93.125929][ T5326] RAX: ffffc9000f82f800 RBX: 0000000000000015 RCX: 0000000000000000 [ 93.129212][ T5326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000f82f908 [ 93.132848][ T5326] RBP: ffffc9000f82f990 R08: ffffc9000f82f907 R09: 0000000000000000 [ 93.136541][ T5326] R10: ffffc9000f82f8e0 R11: fffff52001f05f21 R12: 0000000000000000 [ 93.140354][ T5326] R13: 1ffff92001f05f18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 93.143892][ T5326] FS: 00007fb7ddd136c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 93.147634][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.150444][ T5326] CR2: 000055e17488e648 CR3: 000000001f43e000 CR4: 0000000000352ef0 [ 93.153730][ T5326] Call Trace: [ 93.155125][ T5326] [ 93.156366][ T5326] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 93.159085][ T5326] ? __pfx_policy_nodemask+0x10/0x10 [ 93.161392][ T5326] ? kasan_save_track+0x4f/0x80 [ 93.163436][ T5326] ? kasan_save_track+0x3e/0x80 [ 93.165450][ T5326] ? kasan_save_free_info+0x40/0x50 [ 93.167551][ T5326] ? kfree+0x1c5/0x640 [ 93.169544][ T5326] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 93.171904][ T5326] ? security_file_ioctl+0xc3/0x2a0 [ 93.174026][ T5326] ? __se_sys_ioctl+0x47/0x170 [ 93.176040][ T5326] alloc_pages_mpol+0x212/0x380 [ 93.179534][ T5326] ___kmalloc_large_node+0x4c/0x120 [ 93.181738][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.184025][ T5326] __kmalloc_large_node_noprof+0x18/0x90 [ 93.186361][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.188783][ T5326] __kmalloc_noprof+0x405/0x720 [ 93.190855][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.193157][ T5326] drm_syncobj_array_find+0x3a/0x440 [ 93.195422][ T5326] drm_syncobj_wait_ioctl+0x1fa/0x690 [ 93.197707][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.200232][ T5326] drm_ioctl_kernel+0x2df/0x3b0 [ 93.202290][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.204826][ T5326] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 93.207130][ T5326] drm_ioctl+0x70e/0xba0 [ 93.209132][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.211677][ T5326] ? __pfx_drm_ioctl+0x10/0x10 [ 93.213666][ T5326] ? __fget_files+0x2a/0x420 [ 93.215600][ T5326] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.217798][ T5326] ? __pfx_drm_ioctl+0x10/0x10 [ 93.219995][ T5326] __se_sys_ioctl+0xfc/0x170 [ 93.221985][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.224538][ T5326] do_syscall_64+0x174/0x580 [ 93.226588][ T5326] ? trace_irq_disable+0x3b/0x140 [ 93.229110][ T5326] ? clear_bhb_loop+0x40/0x90 [ 93.231363][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.234006][ T5326] RIP: 0033:0x7fb7dcd9e0d9 [ 93.235840][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.244186][ T5326] RSP: 002b:00007fb7ddd12fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.248303][ T5326] RAX: ffffffffffffffda RBX: 00007fb7dd025fa0 RCX: 00007fb7dcd9e0d9 [ 93.251499][ T5326] RDX: 0000200000000400 RSI: 00000000c02864c3 RDI: 0000000000000004 [ 93.254775][ T5326] RBP: 00007fb7dce35024 R08: 0000000000000000 R09: 0000000000000000 [ 93.258201][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.261675][ T5326] R13: 00007fb7dd026038 R14: 00007fb7dd025fa0 R15: 00007ffea494c7f8 [ 93.265011][ T5326] [ 93.266391][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.269591][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.273178][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.277296][ T5326] Call Trace: [ 93.278855][ T5326] [ 93.280161][ T5326] vpanic+0x56c/0xa60 [ 93.281907][ T5326] ? __pfx__printk+0x10/0x10 [ 93.283884][ T5326] ? __pfx_vpanic+0x10/0x10 [ 93.285800][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 93.288010][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 93.290329][ T5326] panic+0xc5/0xd0 [ 93.291979][ T5326] ? __pfx_panic+0x10/0x10 [ 93.293921][ T5326] __warn+0x315/0x4c0 [ 93.295565][ T5326] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.298162][ T5326] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.300815][ T5326] __report_bug+0x276/0x570 [ 93.302694][ T5326] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.305230][ T5326] ? __pfx___report_bug+0x10/0x10 [ 93.307343][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 93.309493][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 93.311724][ T5326] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.314304][ T5326] report_bug+0x16a/0x220 [ 93.316123][ T5326] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.318682][ T5326] ? __alloc_frozen_pages_noprof+0x2d0/0x380 [ 93.321160][ T5326] handle_bug+0x9c/0x200 [ 93.322872][ T5326] exc_invalid_op+0x1a/0x50 [ 93.324879][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 93.326993][ T5326] RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 [ 93.330017][ T5326] Code: 74 10 4c 89 e7 89 54 24 0c e8 0e 2c 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 1c 1b 19 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 93.338042][ T5326] RSP: 0018:ffffc9000f82f8a0 EFLAGS: 00010246 [ 93.340572][ T5326] RAX: ffffc9000f82f800 RBX: 0000000000000015 RCX: 0000000000000000 [ 93.343970][ T5326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000f82f908 [ 93.347328][ T5326] RBP: ffffc9000f82f990 R08: ffffc9000f82f907 R09: 0000000000000000 [ 93.350608][ T5326] R10: ffffc9000f82f8e0 R11: fffff52001f05f21 R12: 0000000000000000 [ 93.354025][ T5326] R13: 1ffff92001f05f18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 93.357321][ T5326] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 93.359944][ T5326] ? __pfx_policy_nodemask+0x10/0x10 [ 93.362313][ T5326] ? kasan_save_track+0x4f/0x80 [ 93.364343][ T5326] ? kasan_save_track+0x3e/0x80 [ 93.366373][ T5326] ? kasan_save_free_info+0x40/0x50 [ 93.368538][ T5326] ? kfree+0x1c5/0x640 [ 93.370290][ T5326] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 93.372611][ T5326] ? security_file_ioctl+0xc3/0x2a0 [ 93.374777][ T5326] ? __se_sys_ioctl+0x47/0x170 [ 93.376912][ T5326] alloc_pages_mpol+0x212/0x380 [ 93.379044][ T5326] ___kmalloc_large_node+0x4c/0x120 [ 93.381255][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.383599][ T5326] __kmalloc_large_node_noprof+0x18/0x90 [ 93.386120][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.388343][ T5326] __kmalloc_noprof+0x405/0x720 [ 93.390481][ T5326] ? drm_syncobj_array_find+0x3a/0x440 [ 93.392750][ T5326] drm_syncobj_array_find+0x3a/0x440 [ 93.394865][ T5326] drm_syncobj_wait_ioctl+0x1fa/0x690 [ 93.397096][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.399737][ T5326] drm_ioctl_kernel+0x2df/0x3b0 [ 93.401931][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.404364][ T5326] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 93.406698][ T5326] drm_ioctl+0x70e/0xba0 [ 93.408466][ T5326] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 93.410964][ T5326] ? __pfx_drm_ioctl+0x10/0x10 [ 93.413020][ T5326] ? __fget_files+0x2a/0x420 [ 93.415043][ T5326] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.420122][ T5326] ? __pfx_drm_ioctl+0x10/0x10 [ 93.422204][ T5326] __se_sys_ioctl+0xfc/0x170 [ 93.424182][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.426635][ T5326] do_syscall_64+0x174/0x580 [ 93.428636][ T5326] ? trace_irq_disable+0x3b/0x140 [ 93.431120][ T5326] ? clear_bhb_loop+0x40/0x90 [ 93.433675][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.436206][ T5326] RIP: 0033:0x7fb7dcd9e0d9 [ 93.438135][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.446105][ T5326] RSP: 002b:00007fb7ddd12fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.449634][ T5326] RAX: ffffffffffffffda RBX: 00007fb7dd025fa0 RCX: 00007fb7dcd9e0d9 [ 93.453078][ T5326] RDX: 0000200000000400 RSI: 00000000c02864c3 RDI: 0000000000000004 [ 93.456375][ T5326] RBP: 00007fb7dce35024 R08: 0000000000000000 R09: 0000000000000000 [ 93.459804][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.463234][ T5326] R13: 00007fb7dd026038 R14: 00007fb7dd025fa0 R15: 00007ffea494c7f8 [ 93.466652][ T5326] [ 93.468400][ T5326] Kernel Offset: disabled [ 93.470237][ T5326] Rebooting in 86400 seconds..