program: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) r0 = syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x200000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000340)={r3, r3, 0x8, 0x1, &(0x7f0000000180)="e2", 0xb, 0x1, 0xc45, 0x1010, 0x3, 0x0, 0x8, 'syz0\x00'}) mknodat$loop(r2, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') linkat(r1, &(0x7f0000000100)='./file1\x00', r2, &(0x7f0000000240)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0x0, &(0x7f0000000880)=ANY=[@ANYRES32=r4, @ANYRES8=r1, @ANYRESDEC=r2, @ANYRES64=r2, @ANYBLOB="ed2cb4b16ccef3179d43b4ab487ae27ab0181a811674c15aa03b01e1b8a0c0b1dac89267df3bf4b79e41c2411e2a3359b7c1c17fecc63ce62bde0f23e1a0a42da911048abf382424ac633e7b83b5d8f915419eca74e661289dcab0dc5c4aada5ebc08d73fff6045a6732f8a4798ae1d9155d4bdd68ce744c09945929f3405fe90a1e5cf8c11c0e312790998ed97df07a35fa56e14030f059863c97015273042d7bae6beb4d5492f0a4d06b22246a7899501c0770b7c777ea1b6b5461b5cb0b352ac40b4dbe9cc3c344dd05a89f8c39f14951ddbd1524de2103be3c130fac43eaec40698e3a56b2bb893382629d701a21fcb9aa460a8a4c9ae4126774a0", @ANYRES64, @ANYRES32, @ANYRES16=r0, @ANYRES8, @ANYRES64=r1], 0x0, 0x0, &(0x7f0000000000)) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000f00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r5 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r5, &(0x7f0000000180)=""/105, 0x69) ioctl$TCFLSH(r5, 0x540b, 0x2) r6 = syz_mount_image$hfs(&(0x7f00000002c0), &(0x7f0000000280)='./file1\x00', 0xc0d0, &(0x7f0000002700)=ANY=[], 0x0, 0x277, &(0x7f0000000580)="$eJzs3cFqE0Ecx/HfTNK62lLXtiKIB6kWPElbL+JFkL6BF0+iNhGKoYJWUC9Wz+IDeBffwIfwJJ4Fb5703ltkZidmk2azaUycJH4/kLDJzn/nP9mJs/8EGwH4b93a/v7h2g93M1JFFUk3JCspkaqSzupc8mxvf3e/Ua/1O1DFR7ibURZpjrTZ2av3Ck1siAhS96iqxfxzGI/kW+wMMAn8uz/zK/+8lU6Ed6ffn0TJbqQ+zkk6iJ1FZOZQh3qupdh5AADiCuu/Dev8Yrh+t1ZaD8t+5/o/5QvoYewEIsut/77Kahp3fk/7Xe16z5dwbr9tVYnD9DWvbGZVOhIoqyp9Lvbkw91G/erO40bN6o1uBrlmq/6+lk3dlny2r48eeq1HbdrH8GNf8GOYc2PYKsh/ZbQ9ljOfzRdz16R6r9qf679q07jT5M9U2nWmsvw3io/oR5lmrQpGecZ3cj70EPQdZUVdaeTNh2N2fECQluXpo5a7orLRbZZErfSM2iqJWu2Oas/m4shxM+/MHbOmn/qk7dz1v3Wv9roGeWe6Nr5lmBl9x1P1LVO/npiL/qmDCz1b2qGHhON7qwe6rqWnL14+ut9o1J+wMcTGq/BiTko+g260JsGk5DOzG+5FjtJ79a9nZpR/lfCPtU/6MQP5bmZWuOsuk9V/uXplw5dI7i7tc53eLDt47oibBbXBsr8/VVzBdTD+o4cFmaKvIgatuS5dkS4P0mMmDXnOCLOtr7rH5/8AAAAAAAAAAAAAAAAAAADTZnT/5SBR0a7YYwQAAAAAAAAAAAAAAAAAAAAAYNpNxO//Kvf35G8re8Tv/wJj9zsAAP//X8l10A==") r7 = syz_open_dev$I2C(&(0x7f0000000300), 0xa, 0x80402) ioctl$I2C_FUNCS(r7, 0x705, &(0x7f0000000040)=0x100817) r8 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r9 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r9, 0x4c09, 0x8000) io_setup(0x2, &(0x7f0000000200)=0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000008, 0x4000010, r0, 0xe4bad000) io_submit(r10, 0x3, &(0x7f0000000800)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r8, &(0x7f0000000ac0)="cf65f2ee8174eec85fb52636d8910065bc01107a6f93dff5f480f2e2353dad9da31e16280d0093a1baf2b70229f5c1f5d4ce28f92be4931d709fb536a6a1f966478279b16a41551acc55c0c4858df9", 0x4f}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x7, 0x2, r2, &(0x7f00000009c0)="9e5a4a42cc4ad75cb4d3ac000bd6e8ae8ebee9653e203fd2738508fae8cf69b4c9239728e85edc6e9982f8925049c3e42856623f0812deef3168f48ddc38744a9551ee28b23b9fab7e91d3434839b967573a7d8f9098dec66cbaa2d284b27256ea8b931907b131db102ccdcad410af4ddb004e3dc250619b481aae51d1c92f189735443d497d1f29a32812cda5cd9afd4067d629139776186cffb4ac22503af37c5e554d9c829c6d86666a7f42b1bc8cf2d7d0495092a383a8867ae833b2508fb8737b77e302f15a785c843bc5efc373f5f2687a6de7bf37f18c40f5c654168361f5d5a1586b4d75a644f8", 0xeb, 0x7, 0x0, 0x1, r5}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x6, 0x1, r6, &(0x7f0000000480)="270d19ca", 0x4, 0x8, 0x0, 0x3, r5}]) r11 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001ec0), 0x300, 0x0) ioctl$CDROM_SELECT_DISK(r11, 0x5322, 0x3) [ 75.112405][ T5321] Bluetooth: hci0: command tx timeout [ 75.245180][ T5342] loop0: detected capacity change from 0 to 64 [ 75.253078][ T5342] ======================================================= [ 75.253078][ T5342] WARNING: The mand mount option has been deprecated and [ 75.253078][ T5342] and is ignored by this kernel. Remove the mand [ 75.253078][ T5342] option from the mount to silence this warning. [ 75.253078][ T5342] ======================================================= [ 75.283878][ T5342] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN NOPTI [ 75.288906][ T5342] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 75.292399][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller-00286-gc435a4f487e8 #0 PREEMPT(full) [ 75.297259][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.301932][ T5342] RIP: 0010:hfs_find_init+0x6a/0x1e0 [ 75.304285][ T5342] Code: 7e 18 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 48 bc 8a ff 49 c7 07 00 00 00 00 48 8d 6b 40 49 89 ef 49 c1 ef 03 <43> 0f b6 04 2f 84 c0 0f 85 0c 01 00 00 8b 45 00 8d 3c 45 04 00 00 [ 75.312482][ T5342] RSP: 0018:ffffc9000d647588 EFLAGS: 00010202 [ 75.315205][ T5342] RAX: 1ffff92001ac8ecf RBX: 0000000000000000 RCX: 0000000000100000 [ 75.318419][ T5342] RDX: ffffc9000e77b000 RSI: 00000000000035c7 RDI: ffffc9000d647670 [ 75.321606][ T5342] RBP: 0000000000000040 R08: ffffc9000d647697 R09: 0000000000000000 [ 75.324811][ T5342] R10: ffffc9000d647660 R11: fffff52001ac8ed3 R12: ffff88803462a640 [ 75.328020][ T5342] R13: dffffc0000000000 R14: ffffc9000d647660 R15: 0000000000000008 [ 75.331512][ T5342] FS: 00007f87a58466c0(0000) GS:ffff88808d21c000(0000) knlGS:0000000000000000 [ 75.334925][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.337649][ T5342] CR2: 00007fe4723909c0 CR3: 000000003f87c000 CR4: 0000000000352ef0 [ 75.341118][ T5342] Call Trace: [ 75.342604][ T5342] [ 75.343841][ T5342] hfs_get_block+0x51b/0xbd0 [ 75.345837][ T5342] ? __pfx_hfs_get_block+0x10/0x10 [ 75.347981][ T5342] block_read_full_folio+0x29c/0x830 [ 75.350185][ T5342] ? __pfx_hfs_get_block+0x10/0x10 [ 75.352180][ T5342] filemap_read_folio+0x117/0x380 [ 75.354272][ T5342] ? __pfx_hfs_read_folio+0x10/0x10 [ 75.356771][ T5342] ? __pfx_filemap_read_folio+0x10/0x10 [ 75.359087][ T5342] ? filemap_add_folio+0x1af/0x270 [ 75.361359][ T5342] do_read_cache_folio+0x350/0x590 [ 75.363613][ T5342] ? __pfx_hfs_read_folio+0x10/0x10 [ 75.365936][ T5342] read_cache_page+0x5d/0x170 [ 75.367999][ T5342] hfs_btree_open+0x55f/0x14f0 [ 75.370199][ T5342] ? hfs_mdb_get+0x1293/0x2080 [ 75.372347][ T5342] hfs_mdb_get+0x1327/0x2080 [ 75.374384][ T5342] ? __pfx_hfs_mdb_get+0x10/0x10 [ 75.376572][ T5342] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 75.380566][ T5342] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.383466][ T5342] hfs_fill_super+0x37b/0x640 [ 75.385412][ T5342] ? __pfx_hfs_fill_super+0x10/0x10 [ 75.387489][ T5342] ? sb_set_blocksize+0x104/0x180 [ 75.389524][ T5342] ? setup_bdev_super+0x4c1/0x5b0 [ 75.391778][ T5342] get_tree_bdev_flags+0x40b/0x4d0 [ 75.394086][ T5342] ? __pfx_hfs_fill_super+0x10/0x10 [ 75.396223][ T5342] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 75.398842][ T5342] vfs_get_tree+0x92/0x2b0 [ 75.400666][ T5342] do_new_mount+0x24a/0xa40 [ 75.402558][ T5342] __se_sys_mount+0x317/0x410 [ 75.404681][ T5342] ? __pfx___se_sys_mount+0x10/0x10 [ 75.407142][ T5342] ? do_syscall_64+0xbe/0x3b0 [ 75.409174][ T5342] ? __x64_sys_mount+0x20/0xc0 [ 75.411415][ T5342] do_syscall_64+0xfa/0x3b0 [ 75.413592][ T5342] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.415999][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.418745][ T5342] ? clear_bhb_loop+0x60/0xb0 [ 75.420830][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.423342][ T5342] RIP: 0033:0x7f87a49900ca [ 75.425349][ T5342] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.433947][ T5342] RSP: 002b:00007f87a5845e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 75.437480][ T5342] RAX: ffffffffffffffda RBX: 00007f87a5845ef0 RCX: 00007f87a49900ca [ 75.440814][ T5342] RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 00007f87a5845eb0 [ 75.444106][ T5342] RBP: 00002000000002c0 R08: 00007f87a5845ef0 R09: 000000000000c0d0 [ 75.447475][ T5342] R10: 000000000000c0d0 R11: 0000000000000246 R12: 0000200000000280 [ 75.451195][ T5342] R13: 00007f87a5845eb0 R14: 0000000000000277 R15: 0000200000002700 [ 75.455407][ T5342] [ 75.457077][ T5342] Modules linked in: [ 75.459731][ T5342] ---[ end trace 0000000000000000 ]--- [ 75.468011][ T5342] RIP: 0010:hfs_find_init+0x6a/0x1e0 [ 75.470361][ T5342] Code: 7e 18 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 48 bc 8a ff 49 c7 07 00 00 00 00 48 8d 6b 40 49 89 ef 49 c1 ef 03 <43> 0f b6 04 2f 84 c0 0f 85 0c 01 00 00 8b 45 00 8d 3c 45 04 00 00 [ 75.478837][ T5342] RSP: 0018:ffffc9000d647588 EFLAGS: 00010202 [ 75.483389][ T5342] RAX: 1ffff92001ac8ecf RBX: 0000000000000000 RCX: 0000000000100000 [ 75.487681][ T5342] RDX: ffffc9000e77b000 RSI: 00000000000035c7 RDI: ffffc9000d647670 [ 75.491075][ T5342] RBP: 0000000000000040 R08: ffffc9000d647697 R09: 0000000000000000 [ 75.495224][ T5342] R10: ffffc9000d647660 R11: fffff52001ac8ed3 R12: ffff88803462a640 [ 75.498422][ T5342] R13: dffffc0000000000 R14: ffffc9000d647660 R15: 0000000000000008 [ 75.501413][ T5342] FS: 00007f87a58466c0(0000) GS:ffff88808d21c000(0000) knlGS:0000000000000000 [ 75.505441][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.508009][ T5342] CR2: 00007fe4723909c0 CR3: 000000003f87c000 CR4: 0000000000352ef0 [ 75.511426][ T5342] Kernel panic - not syncing: Fatal exception [ 75.514447][ T5342] Kernel Offset: disabled [ 75.516303][ T5342] Rebooting in 86400 seconds..