program: r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xca) ioctl$sock_proto_private(r1, 0x89e8, &(0x7f0000000100)="6a7fb6617c2de8bdc5a7c24a7f0d0300e167e40f4546c4b55c5457d697f9a858b9e6df91a7045b87") ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) syz_mount_image$hfs(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="696f636861727365743d69736f383835392d31342c636f6465706167653d63703836362c00b98ca84a82894a44d230d85781d07b941c527aeeede9ffdeae490b216650602e9c2958dafbc442834d0c8d457de56e510ec8bdd0461f18ca158d9b4874283995508025489486ff72fe3e8375536e15ce54fbb90c0ffc51888e49e205952f538430ec33160206e38a404836"], 0x1, 0x274, &(0x7f00000007c0)="$eJzs3cFuEkEcx/HfDLSlltQVa0w8Vpt4Mm29GC8mhofwZNSCSSOpidZEPRnPxgfw7iv4EJ6ML6AnTz4AtzUzO5QtLCyLXSj0+0nYLmX/M//psMwMLV0BuLAeNn99vfvH3YxUUUXSfclKqklVSdd0vfbm6PjwuNNuZRWwGr5WfIS7GSWRZujYg6P2cAHWx/mIIHL3qqqnv4dyxHEc/y4WYuiW5ePP/gxWWgtnp3+8NvPMyvFh3gmcseFzMrM7T5jueldvtVliSgCABRDGfxsGjnqYv1sr7YRhf6nG/+68E5i1ldN3TVe98d9PHWLj+veyf6i/3vNLOPe47a0Sp6naLxHtwIzEjF1VKuRi158fdtp3Dl52WlYf9SBIHbblt63kqduTk+120rCNCfOfvu2+Brvi2rCfnX/9jGvMZ76bH+axifRFrZP5XzU2rpt8T0UDPZXkvzu6RN/KKDlqRC9d8ZXc6L9doPxW1gamsKn3E1ZDmadmvVFenj6qMRCVtG5vXFRScUbUfk5dW4NR/Wfz6Miymc/mkdnWX31TMzX/t+6nvaNJzkx3jD8yPDPGtqfqj4wmSMwWaoYXrxWPgfdJz3RPm6/fvX/xtNNpv2JnwXYUdozORz7sLNfOvF+gMAup1xMxmF5Ibt5lkvVfar2y62e9bhONmafHeYWnStwbsTZo+O2lQiu4jYzfLg7XOGLNpatuc/O2dGvyGiM1ppmhnlemqZ96wvv/AAAAAAAAAAAAAAAAAAAAi6bkTxHY5C/Lsy3LZ4kBAAAAAAAAAAAAAAAAAAAAACjbf1//t6cS9/4XeMHr/4rr/wJz8i8AAP//phODZA==") r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x8}, 0x0, 0x0, 0x1, 0x4, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800}, 0x20) getsockopt$SO_TIMESTAMP(r2, 0x1, 0xf, 0x0, &(0x7f0000001dc0)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1ff) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4, 0x11, r4, 0x0) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000140)={0x0, 0x6}) syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) (async) syz_init_net_socket$ax25(0x3, 0x3, 0xca) (async) ioctl$sock_proto_private(r1, 0x89e8, &(0x7f0000000100)="6a7fb6617c2de8bdc5a7c24a7f0d0300e167e40f4546c4b55c5457d697f9a858b9e6df91a7045b87") (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) (async) syz_mount_image$hfs(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="696f636861727365743d69736f383835392d31342c636f6465706167653d63703836362c00b98ca84a82894a44d230d85781d07b941c527aeeede9ffdeae490b216650602e9c2958dafbc442834d0c8d457de56e510ec8bdd0461f18ca158d9b4874283995508025489486ff72fe3e8375536e15ce54fbb90c0ffc51888e49e205952f538430ec33160206e38a404836"], 0x1, 0x274, &(0x7f00000007c0)="$eJzs3cFuEkEcx/HfDLSlltQVa0w8Vpt4Mm29GC8mhofwZNSCSSOpidZEPRnPxgfw7iv4EJ6ML6AnTz4AtzUzO5QtLCyLXSj0+0nYLmX/M//psMwMLV0BuLAeNn99vfvH3YxUUUXSfclKqklVSdd0vfbm6PjwuNNuZRWwGr5WfIS7GSWRZujYg6P2cAHWx/mIIHL3qqqnv4dyxHEc/y4WYuiW5ePP/gxWWgtnp3+8NvPMyvFh3gmcseFzMrM7T5jueldvtVliSgCABRDGfxsGjnqYv1sr7YRhf6nG/+68E5i1ldN3TVe98d9PHWLj+veyf6i/3vNLOPe47a0Sp6naLxHtwIzEjF1VKuRi158fdtp3Dl52WlYf9SBIHbblt63kqduTk+120rCNCfOfvu2+Brvi2rCfnX/9jGvMZ76bH+axifRFrZP5XzU2rpt8T0UDPZXkvzu6RN/KKDlqRC9d8ZXc6L9doPxW1gamsKn3E1ZDmadmvVFenj6qMRCVtG5vXFRScUbUfk5dW4NR/Wfz6Miymc/mkdnWX31TMzX/t+6nvaNJzkx3jD8yPDPGtqfqj4wmSMwWaoYXrxWPgfdJz3RPm6/fvX/xtNNpv2JnwXYUdozORz7sLNfOvF+gMAup1xMxmF5Ibt5lkvVfar2y62e9bhONmafHeYWnStwbsTZo+O2lQiu4jYzfLg7XOGLNpatuc/O2dGvyGiM1ppmhnlemqZ96wvv/AAAAAAAAAAAAAAAAAAAAi6bkTxHY5C/Lsy3LZ4kBAAAAAAAAAAAAAAAAAAAAACjbf1//t6cS9/4XeMHr/4rr/wJz8i8AAP//phODZA==") (async) socket$nl_sock_diag(0x10, 0x3, 0x4) (async) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x8}, 0x0, 0x0, 0x1, 0x4, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x9) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800}, 0x20) (async) getsockopt$SO_TIMESTAMP(r2, 0x1, 0xf, 0x0, &(0x7f0000001dc0)) (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1ff) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4, 0x11, r4, 0x0) (async) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000140)={0x0, 0x6}) (async) [ 59.068961][ T5321] loop0: detected capacity change from 0 to 64 [ 59.077970][ T5321] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 59.082287][ T5321] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 59.085138][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-00233-g9fb2cfa4635a #0 [ 59.088701][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 59.092217][ T5321] RIP: 0010:hfs_find_init+0x72/0x1f0 [ 59.094337][ T5321] Code: d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 e4 b3 75 ff 48 c7 03 00 00 00 00 48 89 2c 24 4c 8d 75 40 4d 89 f7 49 c1 ef 03 <43> 0f b6 04 2f 84 c0 0f 85 10 01 00 00 41 8b 06 8d 7c 00 04 be c0 [ 59.101194][ T5321] RSP: 0018:ffffc9000d3d7420 EFLAGS: 00010202 [ 59.103437][ T5321] RAX: 1ffff92001a7aea3 RBX: ffffc9000d3d7518 RCX: ffff888000e3a440 [ 59.105932][ T5321] RDX: 0000000000000000 RSI: ffffc9000d3d7500 RDI: ffffc9000d3d7510 [ 59.108405][ T5321] RBP: 0000000000000000 R08: ffffffff828a5e5f R09: 0000000000000000 [ 59.111283][ T5321] R10: ffffc9000d3d7500 R11: fffff52001a7aea7 R12: ffffc9000d3d7500 [ 59.114075][ T5321] R13: dffffc0000000000 R14: 0000000000000040 R15: 0000000000000008 [ 59.117046][ T5321] FS: 00007f19d39fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 59.120451][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.122984][ T5321] CR2: 00007f19c8e07c00 CR3: 0000000040504000 CR4: 0000000000352ef0 [ 59.126014][ T5321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.128981][ T5321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.132350][ T5321] Call Trace: [ 59.133704][ T5321] [ 59.134893][ T5321] ? __die_body+0x5f/0xb0 [ 59.136554][ T5321] ? die_addr+0xb0/0xe0 [ 59.138173][ T5321] ? exc_general_protection+0x3dd/0x5d0 [ 59.140350][ T5321] ? asm_exc_general_protection+0x26/0x30 [ 59.142161][ T5321] ? hfs_get_block+0x3bf/0xb60 [ 59.143839][ T5321] ? hfs_find_init+0x72/0x1f0 [ 59.145463][ T5321] hfs_get_block+0x4f4/0xb60 [ 59.147107][ T5321] ? __pfx_hfs_get_block+0x10/0x10 [ 59.148864][ T5321] ? _raw_spin_unlock+0x28/0x50 [ 59.150471][ T5321] ? create_empty_buffers+0x53e/0x740 [ 59.152359][ T5321] ? rcu_is_watching+0x15/0xb0 [ 59.154057][ T5321] block_read_full_folio+0x418/0xcd0 [ 59.155924][ T5321] ? __pfx_hfs_get_block+0x10/0x10 [ 59.157931][ T5321] ? __pfx_block_read_full_folio+0x10/0x10 [ 59.160167][ T5321] ? folio_add_lru+0x28f/0x870 [ 59.161708][ T5321] filemap_read_folio+0x14b/0x630 [ 59.163395][ T5321] ? __pfx_hfs_read_folio+0x10/0x10 [ 59.165212][ T5321] ? __pfx_filemap_read_folio+0x10/0x10 [ 59.167171][ T5321] ? __filemap_get_folio+0x949/0xbd0 [ 59.169162][ T5321] ? __pfx_lock_release+0x10/0x10 [ 59.171242][ T5321] do_read_cache_folio+0x3f5/0x850 [ 59.173270][ T5321] ? __pfx_hfs_read_folio+0x10/0x10 [ 59.175247][ T5321] do_read_cache_page+0x30/0x200 [ 59.177223][ T5321] hfs_btree_open+0x506/0xf40 [ 59.179074][ T5321] hfs_mdb_get+0x1443/0x21b0 [ 59.180792][ T5321] ? __pfx_hfs_mdb_get+0x10/0x10 [ 59.182687][ T5321] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 59.184823][ T5321] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 59.187009][ T5321] ? __raw_spin_lock_init+0x45/0x100 [ 59.189103][ T5321] hfs_fill_super+0x38c/0x6b0 [ 59.191019][ T5321] ? __pfx_hfs_fill_super+0x10/0x10 [ 59.192931][ T5321] ? do_raw_spin_lock+0x14f/0x370 [ 59.194834][ T5321] ? sb_set_blocksize+0x98/0xf0 [ 59.196504][ T5321] ? setup_bdev_super+0x4e6/0x5d0 [ 59.198408][ T5321] get_tree_bdev_flags+0x48c/0x5c0 [ 59.200324][ T5321] ? __pfx_hfs_fill_super+0x10/0x10 [ 59.202110][ T5321] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 59.204156][ T5321] ? apparmor_capable+0x13b/0x1b0 [ 59.206101][ T5321] vfs_get_tree+0x90/0x2b0 [ 59.207810][ T5321] do_new_mount+0x2be/0xb40 [ 59.209466][ T5321] ? __pfx_do_new_mount+0x10/0x10 [ 59.211261][ T5321] __se_sys_mount+0x2d6/0x3c0 [ 59.212862][ T5321] ? __pfx___se_sys_mount+0x10/0x10 [ 59.214646][ T5321] ? do_syscall_64+0x100/0x230 [ 59.216295][ T5321] ? __x64_sys_mount+0x20/0xc0 [ 59.218052][ T5321] do_syscall_64+0xf3/0x230 [ 59.219920][ T5321] ? clear_bhb_loop+0x35/0x90 [ 59.221743][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.223929][ T5321] RIP: 0033:0x7f19d3f7fefa [ 59.225266][ T5321] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 59.232101][ T5321] RSP: 002b:00007f19d39fde68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 59.235300][ T5321] RAX: ffffffffffffffda RBX: 00007f19d39fdef0 RCX: 00007f19d3f7fefa [ 59.238276][ T5321] RDX: 0000000020000240 RSI: 0000000020000280 RDI: 00007f19d39fdeb0 [ 59.241034][ T5321] RBP: 0000000020000240 R08: 00007f19d39fdef0 R09: 0000000000000000 [ 59.243478][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000280 [ 59.245703][ T5321] R13: 00007f19d39fdeb0 R14: 0000000000000274 R15: 0000000020000380 [ 59.248290][ T5321] [ 59.249312][ T5321] Modules linked in: [ 59.251098][ T5321] ---[ end trace 0000000000000000 ]--- [ 59.254772][ T4678] Bluetooth: hci0: command tx timeout [ 59.266982][ T5321] RIP: 0010:hfs_find_init+0x72/0x1f0 [ 59.268896][ T5321] Code: d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 e4 b3 75 ff 48 c7 03 00 00 00 00 48 89 2c 24 4c 8d 75 40 4d 89 f7 49 c1 ef 03 <43> 0f b6 04 2f 84 c0 0f 85 10 01 00 00 41 8b 06 8d 7c 00 04 be c0 [ 59.276593][ T5321] RSP: 0018:ffffc9000d3d7420 EFLAGS: 00010202 [ 59.278753][ T5321] RAX: 1ffff92001a7aea3 RBX: ffffc9000d3d7518 RCX: ffff888000e3a440 [ 59.282135][ T5321] RDX: 0000000000000000 RSI: ffffc9000d3d7500 RDI: ffffc9000d3d7510 [ 59.284888][ T5321] RBP: 0000000000000000 R08: ffffffff828a5e5f R09: 0000000000000000 [ 59.287855][ T5321] R10: ffffc9000d3d7500 R11: fffff52001a7aea7 R12: ffffc9000d3d7500 [ 59.291422][ T5321] R13: dffffc0000000000 R14: 0000000000000040 R15: 0000000000000008 [ 59.294296][ T5321] FS: 00007f19d39fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 59.297376][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.299865][ T5321] CR2: 00007f39ad595ed8 CR3: 0000000040504000 CR4: 0000000000352ef0 [ 59.303171][ T5321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.305929][ T5321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.308653][ T5321] Kernel panic - not syncing: Fatal exception [ 59.310941][ T5321] Kernel Offset: disabled [ 59.312450][ T5321] Rebooting in 86400 seconds..