program: syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) r2 = syz_clone(0x40200, 0x0, 0x49, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f00000004c0)={'#! ', './file0'}, 0xb) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x2, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xa1, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffe, 0x0, 0x0, 0x0, 0xffff}, r2, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_script(r0, &(0x7f00000008c0), 0xfecc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0xfecc) [ 68.703353][ T5299] Bluetooth: hci0: command tx timeout [ 68.736735][ T5313] loop0: detected capacity change from 0 to 64 [ 68.846657][ T5313] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI [ 68.851083][ T5313] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 68.854158][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 68.858651][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.862826][ T5313] RIP: 0010:bfs_get_block+0x589/0xae0 [ 68.865002][ T5313] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 c0 da 8f ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 94 da 8f ff 4c 89 ef [ 68.872483][ T5313] RSP: 0018:ffffc9000d6af658 EFLAGS: 00010206 [ 68.875068][ T5313] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 68.878353][ T5313] RDX: ffffc9000df12000 RSI: 00000000000003db RDI: ffff888044069108 [ 68.881635][ T5313] RBP: ffff8880320cce68 R08: ffffea00013410b7 R09: 1ffffd4000268216 [ 68.885054][ T5313] R10: dffffc0000000000 R11: fffff94000268217 R12: 0000000000000028 [ 68.888359][ T5313] R13: ffff8880440690e8 R14: 0000000000000000 R15: 0000000000000013 [ 68.891767][ T5313] FS: 00007fe6668386c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 [ 68.895474][ T5313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.898301][ T5313] CR2: 0000200000001000 CR3: 0000000043406000 CR4: 0000000000352ef0 [ 68.901611][ T5313] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 68.904698][ T5313] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 68.907714][ T5313] Call Trace: [ 68.909084][ T5313] [ 68.910265][ T5313] __block_write_begin_int+0x6b5/0x1900 [ 68.912554][ T5313] ? __pfx_bfs_get_block+0x10/0x10 [ 68.914558][ T5313] ? __pfx___block_write_begin_int+0x10/0x10 [ 68.916907][ T5313] ? __filemap_get_folio+0x79f/0xaf0 [ 68.919111][ T5313] ? __pfx_bfs_get_block+0x10/0x10 [ 68.921033][ T5313] block_write_begin+0x8a/0x120 [ 68.923168][ T5313] ? bfs_write_begin+0x1e/0xd0 [ 68.925164][ T5313] bfs_write_begin+0x35/0xd0 [ 68.927187][ T5313] generic_perform_write+0x2c4/0x910 [ 68.929403][ T5313] ? __pfx_generic_perform_write+0x10/0x10 [ 68.931964][ T5313] ? file_update_time+0x2da/0x490 [ 68.933969][ T5313] ? __generic_file_write_iter+0xf9/0x230 [ 68.936408][ T5313] ? generic_file_write_iter+0xfb/0x540 [ 68.938734][ T5313] generic_file_write_iter+0x10f/0x540 [ 68.941017][ T5313] ? __pfx_generic_file_write_iter+0x10/0x10 [ 68.943791][ T5313] ? __lock_acquire+0xaac/0xd20 [ 68.945913][ T5313] ? rcu_read_lock_any_held+0xb3/0x120 [ 68.948239][ T5313] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 68.950795][ T5313] vfs_write+0x548/0xa90 [ 68.952960][ T5313] ? __pfx_generic_file_write_iter+0x10/0x10 [ 68.955208][ T5313] ? __pfx_vfs_write+0x10/0x10 [ 68.957309][ T5313] ? __fget_files+0x2a/0x420 [ 68.959288][ T5313] ksys_write+0x145/0x250 [ 68.961138][ T5313] ? rcu_is_watching+0x15/0xb0 [ 68.963105][ T5313] ? __pfx_ksys_write+0x10/0x10 [ 68.965045][ T5313] ? do_syscall_64+0xba/0x210 [ 68.966993][ T5313] do_syscall_64+0xf6/0x210 [ 68.968866][ T5313] ? clear_bhb_loop+0x60/0xb0 [ 68.970820][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.973167][ T5313] RIP: 0033:0x7fe66598e969 [ 68.974905][ T5313] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.982471][ T5313] RSP: 002b:00007fe666838038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.985648][ T5313] RAX: ffffffffffffffda RBX: 00007fe665bb5fa0 RCX: 00007fe66598e969 [ 68.988483][ T5313] RDX: 000000000000fecc RSI: 0000200000000100 RDI: 0000000000000008 [ 68.991435][ T5313] RBP: 00007fe665a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 68.994448][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.997504][ T5313] R13: 0000000000000000 R14: 00007fe665bb5fa0 R15: 00007fff2d0d8738 [ 69.000628][ T5313] [ 69.001850][ T5313] Modules linked in: [ 69.005701][ T5313] ---[ end trace 0000000000000000 ]--- [ 69.012346][ T5313] RIP: 0010:bfs_get_block+0x589/0xae0 [ 69.014634][ T5313] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 c0 da 8f ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 94 da 8f ff 4c 89 ef [ 69.021341][ T5313] RSP: 0018:ffffc9000d6af658 EFLAGS: 00010206 [ 69.024849][ T5313] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 69.028311][ T5313] RDX: ffffc9000df12000 RSI: 00000000000003db RDI: ffff888044069108 [ 69.031728][ T5313] RBP: ffff8880320cce68 R08: ffffea00013410b7 R09: 1ffffd4000268216 [ 69.035621][ T5313] R10: dffffc0000000000 R11: fffff94000268217 R12: 0000000000000028 [ 69.038997][ T5313] R13: ffff8880440690e8 R14: 0000000000000000 R15: 0000000000000013 [ 69.042244][ T5313] FS: 00007fe6668386c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 [ 69.046194][ T5313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.048916][ T5313] CR2: 0000200000001000 CR3: 0000000043406000 CR4: 0000000000352ef0 [ 69.052380][ T5313] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.056702][ T5313] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.060205][ T5313] Kernel panic - not syncing: Fatal exception [ 69.062556][ T5313] Kernel Offset: disabled [ 69.063966][ T5313] Rebooting in 86400 seconds..