program: syz_mount_image$squashfs(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="005901e3fd18fb9c322293c67dcde48bfeffd1843c336e09b34af65ad26aafded7da5cfeeda2b8d8d900c2195f00f646f699eeb47813177405a6a6baf786c0d14f2079a9efa9db8973bcca25eb2973856c6760a483c41d0980c78a4cb096a5affa6b980600000000000000a1eacd2c820176737d4eb55dca564820dd769d8742f6d9ab243775a67afcdf845f978e95365cdf6f30aa43423b381881433e00ccbe6353b21300d8f0ca972589398eef9487db78486fcf174990c488031f8b39cc01bb509f3ea4bcde33d4c9e305ecb4dd88204c5d7bb5e469cabfda0feca3ce70c0acbc34d13e5a5c796eab23abfe3b717834f8e9d7120e1e925c4e210b4152c75210b3e979fbe8ddf23eef2d53733209b22206e0a4afc354c33d7ca2a00116a14d686e4aa86b6ec6a4130178c3ad8c723c0d8506bd7bff780000000000000000004b2ec61cfde813cc124715aaaf5508b93d8cf0860042108b660b74f94b1e4851eeec09fdb7a617eabeeeff8ce8bb99f4b1f9c2896cf31e19c3c24155b0ea7dc3cae1b56acb1946830cad94af3f1caf43ea03b38fc08a7e19480e283a4c0d", @ANYRESDEC, @ANYRESHEX, @ANYRES32, @ANYRESDEC, @ANYRES32, @ANYRES32], 0x1, 0x1fa, &(0x7f0000000940)="$eJzskr9rFEEUx7+zO7e3kYQcciKKIGrQWCS3t9H4o1CwMaggSIQYEDz2NnFx44/sgd6RYq1S2AgGIUEsBEkKC/EfcAsrsVEIdiGSOkWKNJJzZWbfrnP/gcV8iv3uzPsx772Z+9GTqAygu7PgARUIOKr4/ouBAzjK5BaaZqY26Q1Si+xXjUwT0t+k3XOdqWmABcc3xo3kYPMYq6C/uvt1Ex4G7+LC2+sfftwqLa3v337/Wfhfu93+BHaqOfjuzceXV5YHZHp2Z1rk2U2zPGZyZMUWiQC82pva2OSHUM1zBUvrB+w/Xgk5r2fAnBUbwOiXkeVLzsALg3JG7c6DRhj689Hl5wa25VE/dxY88XMPQJqmqewdwAQA1Ue0v6b4HOYoTwIwkRY+HP+oteYe16J2ZySYa8z6s/5D1x0bd844zlm3NhOEviO+AE1ThtMEIfQ0AHFNfaIEltlFi3vksw+9MKU0srM+pXxLubrhE72xhhKbK0NSxJbJT4xgEichRvs0ZsrukMzCIRubAINJizpX6svOsqVh1HsUNhcheqOwVfAiR30LpWLhqoux83Fe9iLpUCZF76ukW6T5i85fKpcZDHrPwzFg4Vmj1ZqvW8BaP25+yyxyz7WKv0qsDkycWjF7m7toQqPRaDQajUaj0Wj+G/4GAAD//18UnCE=") r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ff8000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x41, 0x3) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, 0x0) mmap(&(0x7f0000371000/0x5000)=nil, 0x5000, 0x7, 0x11, r0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) chdir(&(0x7f0000000040)='./file0\x00') open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 80.907957][ T4537] Bluetooth: hci0: command tx timeout [ 81.930357][ T5115] loop0: detected capacity change from 0 to 8 [ 82.013766][ T5115] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 82.018669][ T5115] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 82.021939][ T5115] CPU: 0 UID: 0 PID: 5115 Comm: syz.0.0 Not tainted 6.11.0-syzkaller-11558-g075dbe9f6e3c #0 [ 82.025315][ T5115] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 82.028948][ T5115] RIP: 0010:follow_pfnmap_start+0x1a7/0xfd0 [ 82.031092][ T5115] Code: 8d 9f 80 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 57 0c 1a 00 48 8b 1b 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 3a 0c 1a 00 4c 8b 23 48 c7 c0 7c [ 82.037783][ T5115] RSP: 0018:ffffc9000179f100 EFLAGS: 00010202 [ 82.039965][ T5115] RAX: 000000000000000b RBX: 0000000000000058 RCX: 0000000000040000 [ 82.042785][ T5115] RDX: ffffc9000b572000 RSI: 0000000000001b9b RDI: ffffc9000179f1e0 [ 82.045554][ T5115] RBP: ffffc9000179f290 R08: ffffc9000179f311 R09: 0000000000000000 [ 82.048410][ T5115] R10: ffffc9000179f2f0 R11: fffff520002f3e63 R12: dffffc0000000000 [ 82.051181][ T5115] R13: 1ffff1100015ddd3 R14: ffffc9000179f2e0 R15: ffff888000aeee88 [ 82.053930][ T5115] FS: 00007fc0bf1126c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 82.057002][ T5115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 82.059285][ T5115] CR2: 00007fc0be5254f0 CR3: 000000003e0ee000 CR4: 0000000000350ef0 [ 82.061938][ T5115] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 82.064664][ T5115] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 82.067274][ T5115] Call Trace: [ 82.068468][ T5115] [ 82.069484][ T5115] ? __die_body+0x5f/0xb0 [ 82.071062][ T5115] ? die_addr+0xb0/0xe0 [ 82.072523][ T5115] ? exc_general_protection+0x3dd/0x5d0 [ 82.074426][ T5115] ? asm_exc_general_protection+0x26/0x30 [ 82.076303][ T5115] ? follow_pfnmap_start+0x1a7/0xfd0 [ 82.078102][ T5115] ? __pfx_follow_pfnmap_start+0x10/0x10 [ 82.080050][ T5115] ? __pfx_validate_chain+0x10/0x10 [ 82.081730][ T5115] ? __pfx_validate_chain+0x10/0x10 [ 82.083511][ T5115] get_pat_info+0x182/0x3f0 [ 82.084957][ T5115] ? __pfx_get_pat_info+0x10/0x10 [ 82.086573][ T5115] untrack_pfn+0x327/0x640 [ 82.088083][ T5115] ? __pfx_untrack_pfn+0x10/0x10 [ 82.089714][ T5115] ? unmap_vmas+0x1f1/0x5f0 [ 82.091241][ T5115] ? __pfx_lock_release+0x10/0x10 [ 82.092900][ T5115] unmap_single_vma+0x1f6/0x2b0 [ 82.094300][ T5115] unmap_vmas+0x3cc/0x5f0 [ 82.095537][ T5115] ? __pfx_unmap_vmas+0x10/0x10 [ 82.096961][ T5115] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 82.098590][ T5115] ? tlb_gather_mmu+0x24e/0x310 [ 82.100026][ T5115] unmap_region+0x214/0x380 [ 82.101359][ T5115] ? __pfx_unmap_region+0x10/0x10 [ 82.102834][ T5115] ? __mas_set_range+0x133/0x3c0 [ 82.104367][ T5115] ? fput+0x1a8/0x230 [ 82.105602][ T5115] mmap_region+0x22f9/0x2990 [ 82.106946][ T5115] ? __pfx_mmap_region+0x10/0x10 [ 82.108305][ T5115] ? __asan_memset+0x23/0x50 [ 82.109696][ T5115] ? process_measurement+0x3ca/0x1fb0 [ 82.111456][ T5115] ? __pfx_lock_acquire+0x10/0x10 [ 82.113138][ T5115] ? mm_get_unmapped_area_vmflags+0xb9/0xf0 [ 82.115179][ T5115] ? bpf_lsm_mmap_addr+0x9/0x10 [ 82.116846][ T5115] ? security_mmap_addr+0x6f/0x250 [ 82.118539][ T5115] ? __get_unmapped_area+0x2ed/0x350 [ 82.120384][ T5115] do_mmap+0x8f0/0x1000 [ 82.121810][ T5115] ? __pfx_do_mmap+0x10/0x10 [ 82.123528][ T5115] ? __pfx_down_write_killable+0x10/0x10 [ 82.125676][ T5115] ? common_file_perm+0x1a6/0x210 [ 82.127288][ T5115] vm_mmap_pgoff+0x1dd/0x3d0 [ 82.128725][ T5115] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 82.130614][ T5115] ? __fget_files+0x29/0x470 [ 82.132386][ T5115] ? __fget_files+0x3f3/0x470 [ 82.134156][ T5115] ? __fget_files+0x29/0x470 [ 82.135930][ T5115] ksys_mmap_pgoff+0x4eb/0x720 [ 82.137721][ T5115] ? __x64_sys_mmap+0x7f/0x140 [ 82.139499][ T5115] do_syscall_64+0xf3/0x230 [ 82.141266][ T5115] ? clear_bhb_loop+0x35/0x90 [ 82.142835][ T5115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.144590][ T5115] RIP: 0033:0x7fc0be37df39 [ 82.145853][ T5115] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 82.151173][ T5115] RSP: 002b:00007fc0bf112038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 82.153409][ T5115] RAX: ffffffffffffffda RBX: 00007fc0be535f80 RCX: 00007fc0be37df39 [ 82.155552][ T5115] RDX: 0000000000000007 RSI: 0000000000005000 RDI: 0000000020371000 [ 82.157728][ T5115] RBP: 00007fc0be3f0216 R08: 0000000000000004 R09: 0000000000000000 [ 82.160122][ T5115] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 82.162782][ T5115] R13: 0000000000000000 R14: 00007fc0be535f80 R15: 00007fff1166da68 [ 82.165542][ T5115] [ 82.166503][ T5115] Modules linked in: [ 82.168197][ T5115] ---[ end trace 0000000000000000 ]--- [ 82.335425][ T5115] RIP: 0010:follow_pfnmap_start+0x1a7/0xfd0 [ 82.337390][ T5115] Code: 8d 9f 80 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 57 0c 1a 00 48 8b 1b 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 3a 0c 1a 00 4c 8b 23 48 c7 c0 7c [ 82.344007][ T5115] RSP: 0018:ffffc9000179f100 EFLAGS: 00010202 [ 82.355933][ T5115] RAX: 000000000000000b RBX: 0000000000000058 RCX: 0000000000040000 [ 82.359517][ T5115] RDX: ffffc9000b572000 RSI: 0000000000001b9b RDI: ffffc9000179f1e0 [ 82.362674][ T5115] RBP: ffffc9000179f290 R08: ffffc9000179f311 R09: 0000000000000000 [ 82.375501][ T5115] R10: ffffc9000179f2f0 R11: fffff520002f3e63 R12: dffffc0000000000 [ 82.378762][ T5115] R13: 1ffff1100015ddd3 R14: ffffc9000179f2e0 R15: ffff888000aeee88 [ 82.386212][ T5115] FS: 00007fc0bf1126c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 82.389836][ T5115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 82.402942][ T5115] CR2: 0000000020000040 CR3: 000000003e0ee000 CR4: 0000000000350ef0 [ 82.406363][ T5115] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 82.409028][ T5115] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 82.412035][ T5115] Kernel panic - not syncing: Fatal exception [ 82.414608][ T5115] Kernel Offset: disabled [ 82.416300][ T5115] Rebooting in 86400 seconds..