program: syz_mount_image$exfat(&(0x7f0000000380), &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f0000000100)=ANY=[], 0x1, 0x14fe, &(0x7f0000002ac0)="$eJzs3QuYjtX6MPB1r7UexjTxNslhWPe6H940WCZJckiSQ5IkSZJTQtIkSUJiyCkJSchxkhyGkBwmJo3z+ZBz0mRLkiSnnML6rqndtve//b/s/e39//y/Pffvutb1rvtaz72etd6beZ/nuebwQ9fhtZrUrt6IiMS/BH57SRFCxAghBgkh8gkhAiFE+fjy8dnjeRSk/GsnYf9ej6Zd6xWwa4nrn7Nx/XM2rn/OxvXP2bj+ORvXP2fj+udsXH/GcrKtMwvfwC3ntn/9+X/Mby/8/P//Q/z5n7Nx/f/TnM7zzxzN9f9Pctl7/89lcP1zNq5/zsb1z9m4/jkb1z9n4/ozlpNd6+fP3K5tu9b//hhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM5Qzn/BVaCPF7/1qvizHGGGOMMcYYY/8+Pve1XgFjjDHGGGOMMcb+54GQQgktApFL5BYxIo+IFdeJOHG9yCvyiYi4QcSLG0V+cZMoIAqKQqKwSBBFRFFhBAorSISimCguouJmUULcIhJFSVFKlBZOlBFJ4lZRVtwmyonbRXlxh6gg7hQVRSVRWVQRd4mq4m5RTdwjqot7RQ1RU9QStcV9oo64X9QVD4h64kFRXzwkGoiHRUPxiGgkHhWNxWOiiXhcNBVPiGaiuWghWopW/1f5r4ie4lXRS/QWKaKP6CteE/1EfzFADBSDxOtisHhDDBFviqFimBgu3hIjxNtipHhHjBKjxRjxrhgrxonxYoKYKCaJVPGemCzeF1PEB2KqmCamixkiTcwUs8SHYraYI+aKj8Q88bGYLxaIhWKRSBefiMViicgQn4ql4jORKZaJ5WKFWClWidVijVgr1on1YoPYKDaJzWKL2Co+F9vEdrFD7BS7xG6xR3wh9oovxT7xlcgSX/+T+Wf/S343ECBAggQNGnJBLoiBGIiFWIiDOMgLeSECEYiHeMgP+aEAFIBCUAgSIAGKQlFAQCAgKAbFIApRKAElIBESoRSUAgcOkiAJysJtUA7KQXkoDxWgAlSESlAJqkAVqApVoRpUg+pQHWpADagFteA+uA/uh7pQF+pBPagP9aEBNICG0BAaQSNoDI2hCTSBptAUmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIRk6QkfoBJ2gM3SGLtAFukJX6AbdoTu8Aq/Aq/Aq9IYasg/0hb7QD/rBABgIA+F1GAxvwBvwJgyFYTAc3oK34G0YCWdgFIyGMTAGqspxMB4mAMlJkAqpMBkmwxSYAlNhGkyDGZAGM2EWzILZMAfmwEcwDz6Gj2EBLIBFkA7psBiWQAZkwFI4C5mwDJbDClgJq2AlrIG1sAbWwwZYD5tgE2yBLfA5fA7bYTvshJ2wG3bDF/AFfAlfwlDIgizYD/vhAByAg3AQDsEhOAyH4QgcgaNwFI7BMTgOJ+AknIDTcBrOwFk4B+fgAlyAi3ARLsPl7P/8MpuWWuaSuWSMjJGxMlbGyTiZV+aVERmR8TJe5pf5ZQFZQBaShWSCTJBFZVGJEiXJUBaTxWRURmUJWUImykRZSpaSTjqZJJNkWVlWlpPlZHl5h6wg75QVZSXZ1lWRVWRV2c5Vk/fI6rK6rCFrylqytqwt68g6sq6sK+vJerK+rC8byIdlQ9kHBsCjMrsyTeQwaCqHQzPZXLaQLeXb8KRsLUdCG9lWtpNPy9EwCjrI1i5ZPic7yvHQSb4gJ8CLsoucBF3ly7Kb7C57yFdkT9nG9ZK95VToI/vKGdBP9pcD5EA5G2rK7IrVkm/KoXKYHC7fkovgbTlSviNHydFyjHxXjpXj5Hg5QU6Uk2SqfE9Olu/LKfIDOVVOk9PlDJkmZ8pZ8kM5W86Rc+VHcp78WM6XC+RCuUimy0/kYrlEZshP5VL5mcyUy+RyuUKulKvkarlGrpXr5Hq5QW6Um+RmuUVulZ/LbXK73CF3yl1yt9wjv5B75Zdyn/xKZsmv5X75J3lAfiMPym/lIfmdPCy/l0fkD/Ko/FEekz/J4/KEPClPydPyZ3lGnpXn5Hl5Qf4iL8pL8rL0UihQUimlVaByqdwqRuVRseo6FaeuV3lVPhVRN6h4daPKr25SBVRBVUgVVgmqiCqqjEJlFalQFVPFVVTdrEqoW1SiKqlKqdLKqTIqSd2qyqrbVDl1uyqv7lAV1J2qoqqkKqsq6i5VVd2tqql7VHV1r6qhaqpaqra6T9VR96u66gFVTz2o6quHVAP1sGqoHlGN1KOqsXpMNVGPq6bqCdVMNVctVEvVSj2pWqunVBvVVrVTT6v26hnVQT2rktVzqqN6XnVSL6jO6kXVRb2kuqqXVTfVXfVQl9Rl5VUv1VulqD6qr3pN9VP91QA1UA1Sr6vB6g01RL2phqpharh6S41Qb6uR6h01So1WY9S7aqwap8arCWqimqRS1XtqsnpfTVEfqKlqmpquZqg0NVMN+PNMc/+B/Pf/Tv6QX8++RW1Vn6ttarvaoXaqXWq32qP2qL1qr9qn9qkslaX2q/3qgDqgDqqD6pA6pA6rw+qIOqKOqqPqmDqmjqsT6rw6pU6rn9UZdVadVefVBXVBXfzzeyA0aKmV1jrQuXRuHaPz6Fh9nY7T1+u8Op+O6Bt0vL5R59c36QK6oC6kC+sEXUQX1Uajtpp0qIvp4jqqb9Yl9C06UZfUpXRp7XQZnaRv/Zfzr7a+VrqVbq1b6za6jW6n2+n2ur3uoDvoZJ2sO+qOupPupDvrzrqL7qK76q66m+6me+geuqfuqb0QIkWn6L76Nd1P99cD9EA9SL+uB+vBeogeoofqoXq4Hq5H6BF6pB6pR+lReoweo8fqsXq8Hq8n6ok6VafqyXqynqKn6Kl6qp6up+s0naZn6Vl6tp6t5+q5ep6ep+fr+XqhXqjTdbperBfrDJ2hl+qlOlMv08v0Cr1Cr9Kr9Bq9Rq/T6/QGvUFv0pt0pv79GzR36B16l96l9+g9eq/eq/fpfTpLZ+n9er8+oA/og/qgPqQP6cP6sD6ij+ij+qg+po/p4/q4PqlP6tP6tD6jz+hz+py+oC/oi/qivqwvZ1/2BTKQgQ50kCvIFcQEMUFsEBvEBXFB3iBvEAkiQXwQH+QPbgoKBAWDQkHhICEoEhQNTICBDSgIg2JB8SAa3ByUCG4JEoOSQamgdOCCMkFScGtQNrgtKBfcHpQP7ggqBHcGFYNKQeWgSnBXUDW4O6gW3BNUD+4NagQ1g1pB7eC+oE5wf1A3eCCoFzwY1A8eChoEDwcNg0eCRsGjQePgsaBJ8HjQNHgiaBY0D1oELYNW/9b5vT9T8CnXy/Q2KaaP6WteM/1MfzPADDSDzOtmsHnDDDFvmqFmmBlu3jIjzNtmpHnHjDKjzRjzrhlrxpnxZoKZaCaZVPOemWzeN1PMB2aqmWammxkmzcw0s8yHZraZY+aaj8w887GZbxaYhWaRSTefmMVmickwn5ql5jOTaZaZ5WaFWWlWmdVmjVlr1pn1ZoPZaDaZzWaL2Wo+N9vMdrPD7DS7zG6zx3xh9povzT7zlckyX5v95k/mgPnGHDTfmkPmO3PYfG+OmB/MUfOjOWZ+MsfNCXPSnDKnzc/mjDlrzpnz5oL5xVw0l8xl47Mv7rM/3lGjxlyYC2MwBmMxFuMwDvNiXoxgBOMxHvNjfiyABbAQFsIETMCiWBSzERIWw2IYxSiWwBKYiIlYCkuhQ4dJmIRlsSyWw3JYHstjBayAFbEiVsbs+5G78G68G+/Be/BevBdrYk2sjbWxDtbBulgX62E9rI/1sQE2wIbYEBthI2yMjbEJNsGm2BSbYTNsgS2wFbbC1tga22AbbIftsD22xw7YAZMxGTtiR+yEnbAzdsYu2AW7Ylfsht2wB/bAntgTe2EvTMEU7It9sR/2wwE4AAfhIByMg3EIDsGhOBSH43AcgSNwJI7EUTgax+C7OBbH4XicgBNxEqZiKk7GyTgFp+BUnIrTcTqmYRrOwlk4G2fjXJyL83Aezsf5uBAXYjqm42JcjBmYgUtxKWZiJi7H5bgSV+JqXI1rcS2ux/W4ETfiZtyMW3ErbsNtuAN34C7chXtwD+7FvbgP92EWZuF+3I8H8AAexIN4CA/hYTyMR/AIHsWjeAyP4XE8DifxJJ7G03gGz+A5PIcX8Be8iJfwMnqMsXlsrL3OxtnrbV6bz8bYPL2FEH+JC9nCNsEWsUWtsQVswb+J0VqbaEvaUra0dbaMTbK3/iGuaCvZyraKvctWtXfban+I69j7bV37gK1nH7S17X1/E9e3D9kG9nHb0D5hG9nmtrFtaZvYx21T+4RtZpvbFralbW+fsR3sszbZPmc72uf/EC+2S+xau86utxvsXvulPWfP2yP2B3vB/mJ72d52kH3dDrZv2CH2TTvUDvtDPMa+a8facXa8nWAn2kl/iKfbGTbNzrSz7Id2tp3zhzjdfmLn2Qw73y6wC+2iX+PsNWXYT+1S+5nNtMvscrvCrrSr7Gq75i9rXWE32c12i91jv7Db7Ha7w+60u+zuX+PsfeyzX9ks+7U9bL+3B+w39qA9ag/Z736Ns/d31P5oj9mf7HF7wp60p+xp+7M9Y8/+uv/svZ+yl+xl660gIEmKNAWUi3JTDOWhWLqO4uh6ykv5KEI3UDzdSPnpJipABakQFaYEKkJFyRCSJaKQilFxitLNVIJuoUQqSaWoNDkqQ0l0K5Wl26gc3U7l6Q6qQHdSRapElakK3UVV6W6qRvdQdbqXalBNqkW16T6qQ/dTXXqA6tGDVJ8eogb0MDWkR6gRPUqN6TFqQo9TU3qCmlFzakEtqRU9Sa3pKWpDbakdPU3t6RnqQM9SMj1HHel56kQvUGd6kbrQS9SVXqZu1J160CvUk16lXtSbUqgP9aXXqB/1pwE0kAbR6zSY3qAh9CYNpWE0nN6iEfQ2jaR3aBSNpjH0Lo2lcTSeJtBEmkSp9B5NpvdpCn1AU2kaTacZlEYzaRZ9SLNpDs2lj2gefUzzaQEtpEWUTp/QYlpCGfQpLaXPKJOW0XJaQStpFa2mNbSW1tF62kAbaRNtpi20lT6nbbSddtBO2kW7aQ99QXvpS9pHX1EWfU376U90gL6hg/QtHaLv6DB9T0foBzpKP9Ix+omO0wk6SafoNP1MZ+gsnaPzdIF+oYt0iS6TJxFCKEMV6jAIc4W5w5gwTxgbXhfGhdeHecN8YSS8IYwPbwzzhzeFBcKCYaGwcJgQFgmLhibE0IYUhmGxsHgYDW8OS4S3hIlhybBUWDp0YZkwKbw1LBveFpYLbw/Lh3eEFcI7w4phpbByWCW8K6wa3h1WC+8Jq4f3hjXCmmGtsHZ4X1gnvD+sGz4Q1gsfDMuFD4UNwofDhuEjYaPw0bBx+FjYJHw8bBo+ETYLm4ctwpZhq/DJsHX4VNgmbBu2C58O24fPhB3CZ8Pk8LmwY/j8VcdTwj5h3/C18LXQ+wfUwuiiaHr0k+ji6JJoRvTT6NLoZ9HM6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kbo5uiWqPe1cwsHTjrltAtcLpfbxbg8LtZd5+Lc9S6vy+ci7gYX7250+d1NroAr6Aq5wi7BFXFFnXHorCMXumKuuIu6m10Jd4tLdCVdKVfaOVfGJbmWrpVr5Vq7p1wb19a1c0+7p90z7hn3rHvWPec6uuddJ/eC6+xedF3cS+4l97Lr5rq7Hu4V19O96nq53i7Fpbi+rq/r5/q5AW6AG+QGucFusBvihrihbqgb7oa7EW6EG+lGulFulBvjxrixbqwb78a7iW6iS3WpbrKb7Ka4KW6qm+qmu+kuzaW5WW6Wm+1mu7lurpvn5rn5br5b6Ba6dJfuFrvFLsNluKVuqct0mW65W+5WupVutVvt1rq1br1b7za6jW6z2+y2uq1um9vmdrgdbpfb5fa4PW6v2+v2uX0uy2W5/W6/O+AOuIPuW3fIfecOu+/dEfeDO+p+dMfcT+64O+FOulPutPvZnXFn3Tl33l1wv7iL7pK77LxLjbwXmRx5PzIl8kFkamRaZHpkRiQtMjMyK/JhZHZkTmRu5KPIvMjHkfmRBZGFkUWR9MgnkcWRJZGMyKeRpZHPIpmRZZHlkRWRlZFVEe+LbAt9MV/cR/3NvoS/xSf6kr6UL+2dL+OT/K2+rL/Nl/O3+/L+Dl/B3+kr+kq+sn/CN/PNfQvf0rfyT/rW/infxrf17fzTvr1/xnfwz/pk/5zv6J/3nfwLvrN/0XfxL/mu/mXfzXf3Pfwrvqd/1ffyvX2K7+P7+td8P9/fD/AD/SD/uh/s3/BD/Jt+qB/mh/u3/Aj/th/p3/Gj/Gg/xr/rx/pxfryf4Cf6ST7Vv+cn+/f9FP+Bn+qn+el+hk/zM/0s/6Gf7ef4uf4jP89/7Of7BX6hX+TT/Sd+sV/iM/ynfqn/zGf6ZX65X+FX+lV+tV/j1/p1fr3f4Df6TX6z3+K3+s/9Nr/d7/A7/S6/2+/xX/i9/ku/z3/ls/zXfr//kz/gv/EH/bf+kP/OH/bf+yP+B3/U/+iP+Z/8cX/Cn/Sn/Gn/sz/jz/pz/ry/4H/xF/0lf5l/Zo0xxhhj7B+irjLe57/JkX/u9xVCXL+98KH/Or6xwG/9/rkT2keEEM/17vro761GjZSUlD8fm6lEUHyBECJyJT+XuBIvE+3EMyJZtBVl/zIe81fn6i+7X6CrzB+9Q4jYv8rJzv89vjL/bX93//3luHlXnX+BEInFr+TkEVfiK/OX+2/mL9j6KvPn+SZViDZ/lRMnrsRX5k8ST4nnRfLfHMkYY4wxxhhjjP2mv6zc+Wr3t9n35wn6Sk5ucSX+e/fnjDHGGGOMMcYY+9/lxe49nn0yObltZ+78T3V8vt/e6v8t6+EOd/6BzrX+ysQYY4wxxhj7d7ty0X+tV8IYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjOVc/y9+ndjv57ra3xpkjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG/lP9nwAAAP//sjE7Eg==") socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x0) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$bt_l2cap_L2CAP_OPTIONS(r5, 0x6, 0x1, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x145802, 0x0) pwritev2(r6, &(0x7f00000001c0)=[{&(0x7f0000000200)='y', 0xf4240}], 0x1, 0x0, 0x0, 0x0) [ 71.851952][ T4532] Bluetooth: hci0: command tx timeout [ 71.963056][ T5105] loop0: detected capacity change from 0 to 256 [ 71.992024][ T5105] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d18cac, utbl_chksum : 0xe619d30d) [ 72.256434][ T5107] process 'syz.0.0' launched './file1' with NULL argv: empty string added [ 72.277186][ T5107] ================================================================== [ 72.280467][ T5107] BUG: KASAN: stack-out-of-bounds in exfat_get_block+0x1d43/0x2180 [ 72.283652][ T5107] Write of size 4 at addr ffffc9000323f420 by task syz.0.0/5107 [ 72.286559][ T5107] [ 72.287525][ T5107] CPU: 0 UID: 0 PID: 5107 Comm: syz.0.0 Not tainted 6.11.0-syzkaller-11624-ge477dba5442c #0 [ 72.291533][ T5107] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 72.296082][ T5107] Call Trace: [ 72.297526][ T5107] [ 72.298807][ T5107] dump_stack_lvl+0x241/0x360 [ 72.300835][ T5107] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.302894][ T5107] ? __pfx__printk+0x10/0x10 [ 72.304810][ T5107] ? _printk+0xd5/0x120 [ 72.306575][ T5107] print_report+0x169/0x550 [ 72.308475][ T5107] ? __virt_addr_valid+0xbd/0x530 [ 72.310412][ T5107] ? exfat_get_block+0x1d43/0x2180 [ 72.312343][ T5107] kasan_report+0x143/0x180 [ 72.314032][ T5107] ? exfat_get_block+0x1d43/0x2180 [ 72.315974][ T5107] exfat_get_block+0x1d43/0x2180 [ 72.317936][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.319965][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.322242][ T5107] __blockdev_direct_IO+0x1c8e/0x4890 [ 72.324336][ T5107] ? __pfx___blockdev_direct_IO+0x10/0x10 [ 72.326481][ T5107] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 72.328984][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.331216][ T5107] ? __pfx_filemap_invalidate_pages+0x10/0x10 [ 72.333787][ T5107] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 72.336357][ T5107] exfat_direct_IO+0x151/0x400 [ 72.338263][ T5107] generic_file_direct_write+0x17a/0x390 [ 72.340506][ T5107] __generic_file_write_iter+0x126/0x230 [ 72.342639][ T5107] ? exfat_file_write_iter+0x15a/0x3f0 [ 72.344805][ T5107] exfat_file_write_iter+0x165/0x3f0 [ 72.346919][ T5107] do_iter_readv_writev+0x600/0x880 [ 72.349222][ T5107] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 72.351831][ T5107] ? rcu_read_lock_any_held+0xb7/0x160 [ 72.354080][ T5107] vfs_writev+0x376/0xba0 [ 72.355847][ T5107] ? __pfx_lock_acquire+0x10/0x10 [ 72.357837][ T5107] ? __pfx_vfs_writev+0x10/0x10 [ 72.359815][ T5107] ? __might_fault+0xaa/0x120 [ 72.361924][ T5107] ? __fget_files+0x29/0x470 [ 72.364071][ T5107] ? __fget_files+0x29/0x470 [ 72.366133][ T5107] __se_sys_pwritev2+0x1ca/0x2d0 [ 72.368230][ T5107] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 72.370391][ T5107] ? do_syscall_64+0x100/0x230 [ 72.372327][ T5107] ? __x64_sys_pwritev2+0x21/0xf0 [ 72.374324][ T5107] do_syscall_64+0xf3/0x230 [ 72.376171][ T5107] ? clear_bhb_loop+0x35/0x90 [ 72.378055][ T5107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.380536][ T5107] RIP: 0033:0x7f84f1f7df39 [ 72.382483][ T5107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.390465][ T5107] RSP: 002b:00007f84f2ca8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 72.393852][ T5107] RAX: ffffffffffffffda RBX: 00007f84f2136130 RCX: 00007f84f1f7df39 [ 72.396868][ T5107] RDX: 0000000000000001 RSI: 00000000200001c0 RDI: 000000000000000a [ 72.400058][ T5107] RBP: 00007f84f1ff0216 R08: 0000000000000000 R09: 0000000000000000 [ 72.403237][ T5107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.406300][ T5107] R13: 0000000000000000 R14: 00007f84f2136130 R15: 00007ffc49ed72c8 [ 72.409461][ T5107] [ 72.410703][ T5107] [ 72.411697][ T5107] The buggy address belongs to stack of task syz.0.0/5107 [ 72.414433][ T5107] and is located at offset 96 in frame: [ 72.416590][ T5107] exfat_get_block+0x0/0x2180 [ 72.418415][ T5107] [ 72.419423][ T5107] This frame has 4 objects: [ 72.421425][ T5107] [32, 36) 'last_clu.i' [ 72.421439][ T5107] [48, 60) 'new_clu.i' [ 72.423507][ T5107] [80, 84) 'fclus.i' [ 72.425176][ T5107] [96, 100) 'cluster' [ 72.426706][ T5107] [ 72.429310][ T5107] The buggy address belongs to the virtual mapping at [ 72.429310][ T5107] [ffffc90003238000, ffffc90003241000) created by: [ 72.429310][ T5107] copy_process+0x5d1/0x3d50 [ 72.436126][ T5107] [ 72.437129][ T5107] The buggy address belongs to the physical page: [ 72.440161][ T5107] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880356c2600 pfn:0x356c2 [ 72.444484][ T5107] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 72.447293][ T5107] raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 72.450561][ T5107] raw: ffff8880356c2600 0000000000000000 00000001ffffffff 0000000000000000 [ 72.453840][ T5107] page dumped because: kasan: bad access detected [ 72.456231][ T5107] page_owner tracks the page as allocated [ 72.458374][ T5107] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5104, tgid 5104 (syz.0.0), ts 72252502627, free_ts 70233627786 [ 72.465458][ T5107] post_alloc_hook+0x1f3/0x230 [ 72.467342][ T5107] get_page_from_freelist+0x3045/0x3190 [ 72.469537][ T5107] __alloc_pages_noprof+0x256/0x6c0 [ 72.471602][ T5107] alloc_pages_mpol_noprof+0x3e8/0x680 [ 72.473656][ T5107] __vmalloc_node_range_noprof+0xa2b/0x13f0 [ 72.475959][ T5107] dup_task_struct+0x444/0x8c0 [ 72.477827][ T5107] copy_process+0x5d1/0x3d50 [ 72.479662][ T5107] kernel_clone+0x226/0x8f0 [ 72.481369][ T5107] __se_sys_clone3+0x2cb/0x350 [ 72.483276][ T5107] do_syscall_64+0xf3/0x230 [ 72.485018][ T5107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.487287][ T5107] page last free pid 5090 tgid 5090 stack trace: [ 72.489712][ T5107] free_unref_page+0xcfb/0xf20 [ 72.491610][ T5107] __slab_free+0x31b/0x3d0 [ 72.493382][ T5107] qlist_free_all+0x9a/0x140 [ 72.495197][ T5107] kasan_quarantine_reduce+0x14f/0x170 [ 72.497328][ T5107] __kasan_slab_alloc+0x23/0x80 [ 72.499236][ T5107] __kmalloc_cache_noprof+0x132/0x2c0 [ 72.501354][ T5107] ipv6_add_addr+0x580/0x1090 [ 72.503158][ T5107] addrconf_add_linklocal+0x36c/0xa30 [ 72.505304][ T5107] addrconf_addr_gen+0x510/0xbb0 [ 72.507284][ T5107] addrconf_init_auto_addrs+0x96a/0xeb0 [ 72.509502][ T5107] addrconf_notify+0xaff/0x1020 [ 72.511533][ T5107] notifier_call_chain+0x19f/0x3e0 [ 72.513664][ T5107] __dev_notify_flags+0x207/0x400 [ 72.515711][ T5107] dev_change_flags+0xf0/0x1a0 [ 72.517623][ T5107] do_setlink+0xcd0/0x41f0 [ 72.519466][ T5107] rtnl_newlink+0x180d/0x20a0 [ 72.521458][ T5107] [ 72.522538][ T5107] Memory state around the buggy address: [ 72.524995][ T5107] ffffc9000323f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.528334][ T5107] ffffc9000323f380: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 00 04 [ 72.531536][ T5107] >ffffc9000323f400: f2 f2 04 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 [ 72.534681][ T5107] ^ [ 72.536704][ T5107] ffffc9000323f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.539962][ T5107] ffffc9000323f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.543450][ T5107] ================================================================== [ 72.547079][ T5107] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.549811][ T5107] CPU: 0 UID: 0 PID: 5107 Comm: syz.0.0 Not tainted 6.11.0-syzkaller-11624-ge477dba5442c #0 [ 72.554052][ T5107] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 72.558397][ T5107] Call Trace: [ 72.559769][ T5107] [ 72.561013][ T5107] dump_stack_lvl+0x241/0x360 [ 72.563166][ T5107] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.565466][ T5107] ? __pfx__printk+0x10/0x10 [ 72.567393][ T5107] ? lock_release+0xbf/0xa30 [ 72.569305][ T5107] ? vscnprintf+0x5d/0x90 [ 72.571024][ T5107] panic+0x349/0x880 [ 72.572590][ T5107] ? check_panic_on_warn+0x21/0xb0 [ 72.574676][ T5107] ? __pfx_panic+0x10/0x10 [ 72.576464][ T5107] ? mark_lock+0x9a/0x360 [ 72.578178][ T5107] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 72.580644][ T5107] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 72.583061][ T5107] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 72.585818][ T5107] ? print_report+0x502/0x550 [ 72.587907][ T5107] check_panic_on_warn+0x86/0xb0 [ 72.589928][ T5107] ? exfat_get_block+0x1d43/0x2180 [ 72.591941][ T5107] end_report+0x77/0x160 [ 72.593670][ T5107] kasan_report+0x154/0x180 [ 72.595526][ T5107] ? exfat_get_block+0x1d43/0x2180 [ 72.597561][ T5107] exfat_get_block+0x1d43/0x2180 [ 72.599590][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.601695][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.603961][ T5107] __blockdev_direct_IO+0x1c8e/0x4890 [ 72.606591][ T5107] ? __pfx___blockdev_direct_IO+0x10/0x10 [ 72.609222][ T5107] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 72.611802][ T5107] ? __pfx_exfat_get_block+0x10/0x10 [ 72.613868][ T5107] ? __pfx_filemap_invalidate_pages+0x10/0x10 [ 72.616221][ T5107] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 72.618645][ T5107] exfat_direct_IO+0x151/0x400 [ 72.620554][ T5107] generic_file_direct_write+0x17a/0x390 [ 72.622686][ T5107] __generic_file_write_iter+0x126/0x230 [ 72.624857][ T5107] ? exfat_file_write_iter+0x15a/0x3f0 [ 72.626957][ T5107] exfat_file_write_iter+0x165/0x3f0 [ 72.629202][ T5107] do_iter_readv_writev+0x600/0x880 [ 72.631541][ T5107] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 72.633915][ T5107] ? rcu_read_lock_any_held+0xb7/0x160 [ 72.636089][ T5107] vfs_writev+0x376/0xba0 [ 72.637771][ T5107] ? __pfx_lock_acquire+0x10/0x10 [ 72.639778][ T5107] ? __pfx_vfs_writev+0x10/0x10 [ 72.641686][ T5107] ? __might_fault+0xaa/0x120 [ 72.643540][ T5107] ? __fget_files+0x29/0x470 [ 72.645417][ T5107] ? __fget_files+0x29/0x470 [ 72.647358][ T5107] __se_sys_pwritev2+0x1ca/0x2d0 [ 72.649534][ T5107] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 72.652045][ T5107] ? do_syscall_64+0x100/0x230 [ 72.654046][ T5107] ? __x64_sys_pwritev2+0x21/0xf0 [ 72.656086][ T5107] do_syscall_64+0xf3/0x230 [ 72.657858][ T5107] ? clear_bhb_loop+0x35/0x90 [ 72.659757][ T5107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.662051][ T5107] RIP: 0033:0x7f84f1f7df39 [ 72.663897][ T5107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.671964][ T5107] RSP: 002b:00007f84f2ca8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 72.675146][ T5107] RAX: ffffffffffffffda RBX: 00007f84f2136130 RCX: 00007f84f1f7df39 [ 72.678301][ T5107] RDX: 0000000000000001 RSI: 00000000200001c0 RDI: 000000000000000a [ 72.681510][ T5107] RBP: 00007f84f1ff0216 R08: 0000000000000000 R09: 0000000000000000 [ 72.684943][ T5107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.688438][ T5107] R13: 0000000000000000 R14: 00007f84f2136130 R15: 00007ffc49ed72c8 [ 72.691683][ T5107] [ 72.693272][ T5107] Kernel Offset: disabled [ 72.695050][ T5107] Rebooting in 86400 seconds..