program: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) (async) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x1) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0xff) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000340)) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x40) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000240)) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x1018ed8, &(0x7f0000000180)={[{@sysvgroups}, {@noload}, {@nobh}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x4}}, {@norecovery}, {@errors_continue}, {@quota}]}, 0x6, 0x644, &(0x7f00000006c0)="$eJzs3c9rHG0dAPDvzCZ5kzS+6SsiNigGPLQgTZNarHqxrQd7KFiwBxEPDU1SQ7c/SFKwtdAEPCgoiHgt0ov/gHfp3ZsI6s2zUEUqFrR0ZWZnm81mN7ttsrtJ5vOBzT7zzLN5nm9mn8wzM/vsBFBas9mPNOJUxNubScR007qpqK+cLcq9+teTW9kjiVrtu/9MIinyGuWT4vlEsTAeEX+8EvHpyu561x89vrNYrdU9jTi3cffBufVHj8+u3l28vXx7+d7C+a9duDj/9YULC00N/XAniuer177z+V/85IdfXflT9WwSl+LG6I+XoiWOgzIbs/G2CLE5fyQiLmaJNn+Xo+YYhFBqleL9OBoRn43pqORLddOx+vOhNg7oq1olora3pFsB4KjSvaGsGuOAxrF9b8fBN/o8Khmcl5frB0C74x8pTjmM58dGk6+SpiOj+rmNkwdQf1bHmyfjz948mXkWO85DvH63dUYOoJ5ONrci4nPt4k/ytp3MI83iT3cc6ycRMR8RY0X7vrWPNiRN6X6ch9lLj/FXsvibt0MaEZeK5yz/ygfW33paa9DxA1BOLy4XO/LNbGl7/5eNPRrjn9ge/zxtvG5q/5dkcsPe/3Ue/zX29+P5uCdtGYdlY5br7X/laGvG33529Ved6q+P/2aeNR5Z/Y2x4CC83IqYaYn/p1mwxfgniz9pM/7Nity81Fsd3/7zP652Wjfs+GvPI063Pf7ZHpVmqT2uT55bWa0uz9d/tq3j93/4wW871d8+/o/6EGl72faf7BB/0/ZPW1+X/U0etP+VW60Zv7v+/G6n+qe6bv/072NJ/XhzrMj50dbGxtpCxFhyrShS5C9ubKyd3zveepnXtfx5oR7/mS+17/873v8tUU00/mX24MH37rzqtO5D3v9NF5Pf1npsQydZ/Evdt/+u/p/l/bLHOv7z/Ydf6LSuffzJvmICAAAAAACAskrza7BJOvcunaZzc/X5sp+JybR6f33jyyv3H95bijiTfx5yNI00yT8yMl1fTlZWq8sLxedhG8vnW5a/EhGfRMSvKxP58tyt+9WlYQcPAAAAAAAAAAAAAAAAAAAAh8SJYv5/4z7V/67U5/8DJdH9BnO77v8AHBP9vMEkcLjl/X+vXfzHg2sLMFj2/1Be+j+Ul/4P5aX/Q3np/1Be+j+Ul/4P5aX/AwAAAMCx9MkXX/w1iYjNb0zkj8xYsc6kXzjeRt+rdKVv7QAGT4+G8np36d9gH0qnp/H/f4svB+x/c4AhSNpl5oOD2t6d/0XbV27b2n/bAAAAAAAAAAAAAIC606c6z/9/v7nBwFFj2h+U1z7m//vqADjifPU/lJdjfKDLLP4Y77Si2/x/AAAAAAAAAAAAAODATOWPJJ0r5gJPRZrOzUV8KiJOxmiyslpdno+IjyPiL5XRj7LlhWE3GgAAAAAAAAAAAAAAAAAAAI6Z9UeP7yxWq8trzYn/7co53onGXVC7F671UGbPxDfjPV8VyeD/LBMRMfSN0rfESFNOErGZbflD0bC19TgczcgTQ/7HBAAAAAAAAAAAAAAAAAAAJdQ097i9md8MuEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHjb9//vkliarL+gp8I7E8OOEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4mv4fAAD//6AzO/k=") (async) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) (async) mknod$loop(&(0x7f0000000240)='./file0\x00', 0x1200, 0x1) [ 85.488855][ T5338] Bluetooth: hci0: command tx timeout [ 85.530116][ T5363] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI [ 85.535443][ T5363] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 85.539075][ T5363] CPU: 0 UID: 0 PID: 5363 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.551882][ T5363] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.557259][ T5363] RIP: 0010:bcsp_recv+0x13d/0x1740 [ 85.559415][ T5363] Code: 89 4c 24 40 48 89 54 24 28 48 c1 ea 03 48 89 54 24 68 48 89 5c 24 20 48 c1 eb 03 48 89 5c 24 60 4c 89 7c 24 38 48 8b 44 24 58 <42> 80 3c 30 00 74 08 4c 89 ff e8 44 65 b8 f9 49 8b 1f 31 ff 48 89 [ 85.567375][ T5363] RSP: 0018:ffffc9000d34fc00 EFLAGS: 00010206 [ 85.569988][ T5363] RAX: 0000000000000021 RBX: 0000000000000030 RCX: 000000000000002f [ 85.573400][ T5363] RDX: 000000000000002f RSI: 0000000000000001 RDI: 0000000000000000 [ 85.576835][ T5363] RBP: ffffc9000d34fd60 R08: ffff88804014841f R09: 1ffff11008029083 [ 85.580133][ T5363] R10: dffffc0000000000 R11: ffffffff886c5400 R12: 0000000000000001 [ 85.583620][ T5363] R13: ffffc9000d34fe00 R14: dffffc0000000000 R15: 0000000000000108 [ 85.587027][ T5363] FS: 00007efe718f56c0(0000) GS:ffff88808d007000(0000) knlGS:0000000000000000 [ 85.590859][ T5363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.593654][ T5363] CR2: 00005555696047c8 CR3: 0000000042c0c000 CR4: 0000000000352ef0 [ 85.597067][ T5363] Call Trace: [ 85.598515][ T5363] [ 85.599908][ T5363] ? __pfx_bcsp_recv+0x10/0x10 [ 85.601812][ T5363] ? rcu_read_lock_any_held+0xb3/0x120 [ 85.603960][ T5363] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 85.606382][ T5363] ? tty_audit_push+0x7c/0x250 [ 85.608494][ T5363] hci_uart_tty_receive+0x191/0x220 [ 85.610844][ T5363] ? __pfx_hci_uart_tty_receive+0x10/0x10 [ 85.613295][ T5363] tiocsti+0x23c/0x2c0 [ 85.615098][ T5363] ? __pfx_tiocsti+0x10/0x10 [ 85.617188][ T5363] ? __fget_files+0x2a/0x420 [ 85.619240][ T5363] ? __fget_files+0x3a0/0x420 [ 85.621335][ T5363] ? __fget_files+0x2a/0x420 [ 85.623338][ T5363] tty_ioctl+0x626/0xde0 [ 85.625152][ T5363] ? __pfx_tty_ioctl+0x10/0x10 [ 85.627225][ T5363] __se_sys_ioctl+0xf9/0x170 [ 85.629279][ T5363] do_syscall_64+0xfa/0x3b0 [ 85.631148][ T5363] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.633208][ T5363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.635625][ T5363] ? clear_bhb_loop+0x60/0xb0 [ 85.637492][ T5363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.639806][ T5363] RIP: 0033:0x7efe7098eec9 [ 85.641666][ T5363] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.649077][ T5363] RSP: 002b:00007efe718f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.652527][ T5363] RAX: ffffffffffffffda RBX: 00007efe70be5fa0 RCX: 00007efe7098eec9 [ 85.655958][ T5363] RDX: 0000200000000340 RSI: 0000000000005412 RDI: 0000000000000004 [ 85.659151][ T5363] RBP: 00007efe70a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.662549][ T5363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.666075][ T5363] R13: 00007efe70be6038 R14: 00007efe70be5fa0 R15: 00007ffc6a0d0a98 [ 85.669553][ T5363] [ 85.670900][ T5363] Modules linked in: [ 85.673081][ T5363] ---[ end trace 0000000000000000 ]--- [ 85.696479][ T5363] RIP: 0010:bcsp_recv+0x13d/0x1740 [ 85.699487][ T5363] Code: 89 4c 24 40 48 89 54 24 28 48 c1 ea 03 48 89 54 24 68 48 89 5c 24 20 48 c1 eb 03 48 89 5c 24 60 4c 89 7c 24 38 48 8b 44 24 58 <42> 80 3c 30 00 74 08 4c 89 ff e8 44 65 b8 f9 49 8b 1f 31 ff 48 89 [ 85.710004][ T5363] RSP: 0018:ffffc9000d34fc00 EFLAGS: 00010206 [ 85.712581][ T5363] RAX: 0000000000000021 RBX: 0000000000000030 RCX: 000000000000002f [ 85.715912][ T5363] RDX: 000000000000002f RSI: 0000000000000001 RDI: 0000000000000000 [ 85.720330][ T5363] RBP: ffffc9000d34fd60 R08: ffff88804014841f R09: 1ffff11008029083 [ 85.723666][ T5363] R10: dffffc0000000000 R11: ffffffff886c5400 R12: 0000000000000001 [ 85.727109][ T5363] R13: ffffc9000d34fe00 R14: dffffc0000000000 R15: 0000000000000108 [ 85.731145][ T5363] FS: 00007efe718f56c0(0000) GS:ffff88808d007000(0000) knlGS:0000000000000000 [ 85.734988][ T5363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.738150][ T5363] CR2: 00007efe718b2fc8 CR3: 0000000042c0c000 CR4: 0000000000352ef0 [ 85.742593][ T5363] Kernel panic - not syncing: Fatal exception [ 85.745370][ T5363] Kernel Offset: disabled [ 85.747102][ T5363] Rebooting in 86400 seconds..