program: syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000500)='./bus\x00', 0x10418, &(0x7f0000000040)=ANY=[], 0xfe, 0x4b1, &(0x7f0000001d00)="$eJzs201sVNUbx/HfM3c6TIf+/5YXCxgCTTSxgkBfsEBqYnix0YQXLVQj8SWVTrHSdkinKCUgLNWdC5Yu3bpwZdwaEpfGhcEYFibIxs2sxB3m3LlvM5TOjG1nKP1+CJx7zzx3OOc8c+ecM5kRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQjrx6uLfPWt0KAADQTCdPj/QOMP8DALCmnGH/DwAAsJaYPP0u054LJTvhn5dlj0/OXLo8emx44cvaTaaUPD/e/c329Q/sf2nwwMGwXPz65bZNp06fOdx9tDB9cTZfLObHu0dnJs8VxvN1P8NSr6+2yx+A7ukLl8YnJord/XsHKh6+3Hlv3fquzqHB945mwtjRY8PDpxMx6bb//L8/5FEr/Iw8vSDTx99/ayclpbT0sajx2llp7X4ndvmdGD027HdkanJsZs49aKkgKlU5JplwjJqQiyVJSa5dllmePVubPP0g05F9JTslyQvHYbf/wXBd7WmFtNu6SurRKsjZY2ydPH0g0619nXojGFc//xnpaqsbhxWXDu7/gpXsTf/9wN1P7m3z+Fvdr89MFBKxlgruqNU+PzTTY/7elJWnU/4dX7IR7Wx1c9Bk7fI0LVPmq0/8dYX8delTQwd27DyUXGFsqfE8LnZvcHPVMye3BUsHS7k/y98v1Cdrnv6U6f5vWf+8J5wDpBsPFrvwj6Y0DyvNPE3J9M+1klnVvtRL7O8jq33uX9n2t2ePFi7Oz06e/2huwcdz2cMfFudmx84t/HB57+ola2rtY6ulGtuS5ay84/v801J0XbAH+F/5LG7NN1fj10JPVRlKvn7qOa57F9vAOsq1yczTXZkm3t9anmeUa3hs1gKX/2GZiqWfLcx0kP90+SyR/5fj8ctaZRnxc/v/8uda4Vpi29nNj6pfify7Nrn8vyPTkb+3Bp9plPPvVcW6uC6Z3r25PYhLZVxcOuxO+RknJqfyvS72gUwbfwpj5cfmgthNcWyfiy3K9MWtytj1QezmOLbfxd6W6c6vC8c+HccOuNh5l6873WFszsXuCGK74ti95wpT47WG1eW/X6a3r79mYZ8fmf/E/X+jqow8lPPFj5cr/52JuhtBXs8G+U/XyP+XMs3/tT3stz/24ctqg/9vnH+3Vv7uZmVsuKHcGMf21dutVnP53yDTvVduR30O+hacxhlK5v+ZdGUZjWuL8r8hUdcZtCvT4FisRcX5KxfGpqbysxxwwAEH0UGr35nQDG7+H3Gz+qBn4TommP87ymfxiun+Z/H8P1RVRlo0/29M1A0Fq5a2tJSdm77YtkXKFuev7JmcHjufP5+fGdg/2Nt/aH/vwMG2TLi4i4/qHrsngcv/bpmu/fhLtI+pXP8tvP7PVZWRFuV/U7JPFeuauodiTXL575Bp8O7taL+52Po/3P/3PFtZRvdfi/K/OVHXGbSro8GxAAAAAAAAAAAAAAAAAIDVJGeenpPp8siLFv6GqJ7v/41XlZHl//5X+YfJNb7/1ZWoG2/S7xoaGmgAAAAAAAAAAIAmScnT1zI9r5JddxUd0olkiSfavwEAAP//G6xIAA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000600)=0x1, 0x4) r5 = open_tree(r0, &(0x7f0000000380)='./file1\x00', 0x9001) ioctl$DRM_IOCTL_GET_CTX(r5, 0xc0086423, &(0x7f00000003c0)={0x0, 0x2}) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0xc01, 0x3, 0x290, 0x0, 0x5002004a, 0x0, 0x128, 0x0, 0x1f8, 0x3c8, 0x3c8, 0x1f8, 0x3c8, 0x3, 0x0, {[{{@ip={@rand_addr, @local, 0x0, 0x0, 'veth0_virt_wifi\x00', 'ip6tnl0\x00'}, 0x0, 0xe0, 0x128, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}, @common=@unspec=@connmark={{0x30}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x20000}}}, {{@uncond, 0x0, 0xb0, 0xd0, 0x0, {}, [@common=@set={{0x40}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2f0) r6 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) bind$ax25(r6, &(0x7f00000001c0)={{0x3, @default, 0x1}, [@null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x48) io_setup(0x6, &(0x7f0000000680)=0x0) syz_clone(0x0, &(0x7f0000000400), 0x0, &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)) io_submit(r7, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x180a, 0x0, 0x3, 0x1, 0x0, r6, 0x0}]) sendfile(r0, r1, 0x0, 0xfffe82) [ 58.584775][ T5319] loop0: detected capacity change from 0 to 128 [ 58.642281][ T5319] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 58.655523][ T5319] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 58.660441][ T5304] Bluetooth: hci0: command tx timeout [ 58.670653][ T25] audit: type=1800 audit(1743124472.862:2): pid=5319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=94 res=0 errno=0 [ 58.680163][ T5319] Cannot find set identified by id 0 to match [ 58.715277][ T5321] UDF-fs: error (device loop0): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 58.722205][ T5319] UDF-fs: error (device loop0): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 58.728604][ T5321] ------------[ cut here ]------------ [ 58.730776][ T5321] WARNING: CPU: 0 PID: 5321 at fs/udf/truncate.c:224 udf_truncate_extents+0x10cd/0x1320 [ 58.734779][ T5321] Modules linked in: [ 58.736318][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-07318-g4fa118e5b79f #0 PREEMPT(full) [ 58.741360][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 58.745407][ T5321] RIP: 0010:udf_truncate_extents+0x10cd/0x1320 [ 58.747799][ T5321] Code: 48 3b 84 24 a0 01 00 00 0f 85 4b 02 00 00 44 89 f8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 f4 54 6d fe 90 <0f> 0b 90 eb 8a 48 8d 8c 24 60 01 00 00 80 e1 07 80 c1 03 38 c1 0f [ 58.755376][ T5321] RSP: 0018:ffffc9000d4b6c60 EFLAGS: 00010293 [ 58.757554][ T5321] RAX: ffffffff8356315c RBX: 0000000000000120 RCX: ffff888000204880 [ 58.760614][ T5321] RDX: 0000000000000000 RSI: 0000000000000120 RDI: 0000000000000000 [ 58.763561][ T5321] RBP: ffffc9000d4b6e50 R08: ffffffff8356257a R09: ffffffff8353fd1d [ 58.766561][ T5321] R10: 0000000000000002 R11: ffff888000204880 R12: dffffc0000000000 [ 58.770256][ T5321] R13: 0000000000000000 R14: 0000000000000120 R15: 0000000000000000 [ 58.774348][ T5321] FS: 00007fb196ab86c0(0000) GS:ffff88808c5f1000(0000) knlGS:0000000000000000 [ 58.778934][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.781748][ T5321] CR2: 00007fb196a97990 CR3: 000000004366e000 CR4: 0000000000352ef0 [ 58.784790][ T5321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 58.787688][ T5321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 58.790752][ T5321] Call Trace: [ 58.792028][ T5321] [ 58.793162][ T5321] ? __warn+0x165/0x4d0 [ 58.794723][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.796860][ T5321] ? report_bug+0x2b3/0x500 [ 58.798694][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.800899][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.802920][ T5321] ? udf_truncate_extents+0x10cf/0x1320 [ 58.804945][ T5321] ? handle_bug+0x89/0x170 [ 58.806540][ T5321] ? exc_invalid_op+0x1a/0x50 [ 58.808221][ T5321] ? asm_exc_invalid_op+0x1a/0x20 [ 58.810226][ T5321] ? udf_current_aext+0x3bd/0xad0 [ 58.812121][ T5321] ? udf_truncate_extents+0x4ea/0x1320 [ 58.814271][ T5321] ? udf_truncate_extents+0x10cc/0x1320 [ 58.816437][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.818746][ T5321] ? __lock_acquire+0xad5/0xd80 [ 58.820682][ T5321] ? __pfx_udf_truncate_extents+0x10/0x10 [ 58.822797][ T5321] ? do_raw_spin_lock+0x151/0x370 [ 58.824311][ T5321] ? do_raw_spin_unlock+0x58/0x8b0 [ 58.826507][ T5321] udf_write_failed+0x176/0x1b0 [ 58.828905][ T5321] udf_write_begin+0x1f7/0x250 [ 58.830660][ T5321] generic_perform_write+0x329/0xa10 [ 58.832634][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 58.834707][ T5321] ? __generic_file_write_iter+0x102/0x230 [ 58.837191][ T5321] ? udf_file_write_iter+0x2cd/0x6c0 [ 58.839419][ T5321] udf_file_write_iter+0x2e7/0x6c0 [ 58.841162][ T5321] __kernel_write_iter+0x439/0x990 [ 58.843088][ T5321] ? __pfx_udf_file_write_iter+0x10/0x10 [ 58.845266][ T5321] ? __pfx___kernel_write_iter+0x10/0x10 [ 58.847542][ T5321] ? kasan_save_track+0x3f/0x80 [ 58.849515][ T5321] ? __kasan_kmalloc+0x9d/0xb0 [ 58.851450][ T5321] ? __kmalloc_cache_noprof+0x236/0x370 [ 58.853535][ T5321] ? elf_core_dump+0x3046/0x4ae0 [ 58.855499][ T5321] ? do_coredump+0x22c3/0x3260 [ 58.857427][ T5321] ? get_signal+0x13ed/0x1730 [ 58.859365][ T5321] ? irqentry_exit_to_user_mode+0x7e/0x250 [ 58.861698][ T5321] ? iov_iter_kvec+0x4e/0x180 [ 58.863512][ T5321] __kernel_write+0x122/0x180 [ 58.865365][ T5321] ? __pfx___kernel_write+0x10/0x10 [ 58.867403][ T5321] __dump_emit+0x241/0x370 [ 58.869367][ T5321] ? __pfx___dump_emit+0x10/0x10 [ 58.871346][ T5321] ? __kmalloc_cache_noprof+0x236/0x370 [ 58.873473][ T5321] ? dump_emit+0x99/0xd0 [ 58.875088][ T5321] elf_core_dump+0x3822/0x4ae0 [ 58.876996][ T5321] ? __pfx_elf_core_dump+0x10/0x10 [ 58.879039][ T5321] ? dump_vma_snapshot+0xc66/0x1180 [ 58.880888][ T5321] ? up_write+0x1ab/0x590 [ 58.882399][ T5321] ? rcu_read_lock_any_held+0xbb/0x160 [ 58.884384][ T5321] ? getname_kernel+0x140/0x2f0 [ 58.886184][ T5321] do_coredump+0x22c3/0x3260 [ 58.887894][ T5321] ? __pfx_do_coredump+0x10/0x10 [ 58.889881][ T5321] ? proc_coredump_connector+0x1fe/0x6a0 [ 58.891995][ T5321] ? __pfx_proc_coredump_connector+0x10/0x10 [ 58.894219][ T5321] ? _raw_spin_unlock_irq+0x23/0x50 [ 58.896225][ T5321] ? lockdep_hardirqs_on+0x9d/0x150 [ 58.898331][ T5321] get_signal+0x13ed/0x1730 [ 58.900206][ T5321] ? __pfx_get_signal+0x10/0x10 [ 58.902166][ T5321] ? __pfx_force_sig_fault+0x10/0x10 [ 58.904184][ T5321] arch_do_signal_or_restart+0x98/0x840 [ 58.906264][ T5321] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 58.908751][ T5321] ? irqentry_exit_to_user_mode+0x53/0x250 [ 58.911029][ T5321] irqentry_exit_to_user_mode+0x7e/0x250 [ 58.913226][ T5321] exc_page_fault+0x599/0x8b0 [ 58.915203][ T5321] asm_exc_page_fault+0x26/0x30 [ 58.916976][ T5321] RIP: 0033:0x0 [ 58.918539][ T5321] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 58.921391][ T5321] RSP: 002b:0000200000000408 EFLAGS: 00010217 [ 58.923722][ T5321] RAX: 0000000000000000 RBX: 00007fb195da5fa0 RCX: 00007fb195b8d169 [ 58.926700][ T5321] RDX: 0000200000000440 RSI: 0000200000000400 RDI: 0000000000000000 [ 58.929908][ T5321] RBP: 00007fb195c0e2a0 R08: 00002000000004c0 R09: 00002000000004c0 [ 58.933119][ T5321] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000000 [ 58.936327][ T5321] R13: 0000000000000000 R14: 00007fb195da5fa0 R15: 00007ffd350c51d8 [ 58.939628][ T5321] [ 58.940818][ T5321] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 58.943401][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-07318-g4fa118e5b79f #0 PREEMPT(full) [ 58.947863][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 58.951908][ T5321] Call Trace: [ 58.953281][ T5321] [ 58.954516][ T5321] dump_stack_lvl+0x241/0x360 [ 58.956454][ T5321] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.958473][ T5321] ? __pfx__printk+0x10/0x10 [ 58.960207][ T5321] ? vscnprintf+0x5d/0x90 [ 58.961800][ T5321] panic+0x349/0x880 [ 58.963329][ T5321] ? __warn+0x174/0x4d0 [ 58.964973][ T5321] ? __pfx_panic+0x10/0x10 [ 58.966698][ T5321] __warn+0x344/0x4d0 [ 58.968312][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.970479][ T5321] report_bug+0x2b3/0x500 [ 58.972207][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.974392][ T5321] ? udf_truncate_extents+0x10cd/0x1320 [ 58.976592][ T5321] ? udf_truncate_extents+0x10cf/0x1320 [ 58.978753][ T5321] handle_bug+0x89/0x170 [ 58.980461][ T5321] exc_invalid_op+0x1a/0x50 [ 58.982246][ T5321] asm_exc_invalid_op+0x1a/0x20 [ 58.984156][ T5321] RIP: 0010:udf_truncate_extents+0x10cd/0x1320 [ 58.986551][ T5321] Code: 48 3b 84 24 a0 01 00 00 0f 85 4b 02 00 00 44 89 f8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 f4 54 6d fe 90 <0f> 0b 90 eb 8a 48 8d 8c 24 60 01 00 00 80 e1 07 80 c1 03 38 c1 0f [ 58.993970][ T5321] RSP: 0018:ffffc9000d4b6c60 EFLAGS: 00010293 [ 58.996358][ T5321] RAX: ffffffff8356315c RBX: 0000000000000120 RCX: ffff888000204880 [ 58.999385][ T5321] RDX: 0000000000000000 RSI: 0000000000000120 RDI: 0000000000000000 [ 59.002391][ T5321] RBP: ffffc9000d4b6e50 R08: ffffffff8356257a R09: ffffffff8353fd1d [ 59.005430][ T5321] R10: 0000000000000002 R11: ffff888000204880 R12: dffffc0000000000 [ 59.008661][ T5321] R13: 0000000000000000 R14: 0000000000000120 R15: 0000000000000000 [ 59.011663][ T5321] ? udf_current_aext+0x3bd/0xad0 [ 59.013628][ T5321] ? udf_truncate_extents+0x4ea/0x1320 [ 59.015714][ T5321] ? udf_truncate_extents+0x10cc/0x1320 [ 59.017786][ T5321] ? __lock_acquire+0xad5/0xd80 [ 59.019673][ T5321] ? __pfx_udf_truncate_extents+0x10/0x10 [ 59.021866][ T5321] ? do_raw_spin_lock+0x151/0x370 [ 59.024084][ T5321] ? do_raw_spin_unlock+0x58/0x8b0 [ 59.026037][ T5321] udf_write_failed+0x176/0x1b0 [ 59.027931][ T5321] udf_write_begin+0x1f7/0x250 [ 59.029691][ T5321] generic_perform_write+0x329/0xa10 [ 59.031481][ T5321] ? __pfx_generic_perform_write+0x10/0x10 [ 59.033601][ T5321] ? __generic_file_write_iter+0x102/0x230 [ 59.035841][ T5321] ? udf_file_write_iter+0x2cd/0x6c0 [ 59.037860][ T5321] udf_file_write_iter+0x2e7/0x6c0 [ 59.039775][ T5321] __kernel_write_iter+0x439/0x990 [ 59.041818][ T5321] ? __pfx_udf_file_write_iter+0x10/0x10 [ 59.044147][ T5321] ? __pfx___kernel_write_iter+0x10/0x10 [ 59.046275][ T5321] ? kasan_save_track+0x3f/0x80 [ 59.048263][ T5321] ? __kasan_kmalloc+0x9d/0xb0 [ 59.050415][ T5321] ? __kmalloc_cache_noprof+0x236/0x370 [ 59.052576][ T5321] ? elf_core_dump+0x3046/0x4ae0 [ 59.054480][ T5321] ? do_coredump+0x22c3/0x3260 [ 59.056345][ T5321] ? get_signal+0x13ed/0x1730 [ 59.058037][ T5321] ? irqentry_exit_to_user_mode+0x7e/0x250 [ 59.060093][ T5321] ? iov_iter_kvec+0x4e/0x180 [ 59.061943][ T5321] __kernel_write+0x122/0x180 [ 59.063734][ T5321] ? __pfx___kernel_write+0x10/0x10 [ 59.065704][ T5321] __dump_emit+0x241/0x370 [ 59.067383][ T5321] ? __pfx___dump_emit+0x10/0x10 [ 59.069264][ T5321] ? __kmalloc_cache_noprof+0x236/0x370 [ 59.071327][ T5321] ? dump_emit+0x99/0xd0 [ 59.072979][ T5321] elf_core_dump+0x3822/0x4ae0 [ 59.074836][ T5321] ? __pfx_elf_core_dump+0x10/0x10 [ 59.076738][ T5321] ? dump_vma_snapshot+0xc66/0x1180 [ 59.078693][ T5321] ? up_write+0x1ab/0x590 [ 59.080369][ T5321] ? rcu_read_lock_any_held+0xbb/0x160 [ 59.082452][ T5321] ? getname_kernel+0x140/0x2f0 [ 59.084252][ T5321] do_coredump+0x22c3/0x3260 [ 59.085963][ T5321] ? __pfx_do_coredump+0x10/0x10 [ 59.087879][ T5321] ? proc_coredump_connector+0x1fe/0x6a0 [ 59.090064][ T5321] ? __pfx_proc_coredump_connector+0x10/0x10 [ 59.092307][ T5321] ? _raw_spin_unlock_irq+0x23/0x50 [ 59.094129][ T5321] ? lockdep_hardirqs_on+0x9d/0x150 [ 59.096155][ T5321] get_signal+0x13ed/0x1730 [ 59.098009][ T5321] ? __pfx_get_signal+0x10/0x10 [ 59.099964][ T5321] ? __pfx_force_sig_fault+0x10/0x10 [ 59.102032][ T5321] arch_do_signal_or_restart+0x98/0x840 [ 59.104688][ T5321] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 59.107627][ T5321] ? irqentry_exit_to_user_mode+0x53/0x250 [ 59.110432][ T5321] irqentry_exit_to_user_mode+0x7e/0x250 [ 59.113220][ T5321] exc_page_fault+0x599/0x8b0 [ 59.115188][ T5321] asm_exc_page_fault+0x26/0x30 [ 59.117101][ T5321] RIP: 0033:0x0 [ 59.118588][ T5321] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 59.121418][ T5321] RSP: 002b:0000200000000408 EFLAGS: 00010217 [ 59.123846][ T5321] RAX: 0000000000000000 RBX: 00007fb195da5fa0 RCX: 00007fb195b8d169 [ 59.126896][ T5321] RDX: 0000200000000440 RSI: 0000200000000400 RDI: 0000000000000000 [ 59.129952][ T5321] RBP: 00007fb195c0e2a0 R08: 00002000000004c0 R09: 00002000000004c0 [ 59.133022][ T5321] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000000 [ 59.136003][ T5321] R13: 0000000000000000 R14: 00007fb195da5fa0 R15: 00007ffd350c51d8 [ 59.138994][ T5321] [ 59.140604][ T5321] Kernel Offset: disabled [ 59.142383][ T5321] Rebooting in 86400 seconds..