program: syz_mount_image$exfat(&(0x7f0000000380), &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f0000000100)=ANY=[], 0x1, 0x14fe, &(0x7f0000002ac0)="$eJzs3QuYjtX6MPB1r7UexjTxNslhWPe6H940WCZJckiSQ5IkSZJTQtIkSUJiyCkJSchxkhyGkBwmJo3z+ZBz0mRLkiSnnML6rqndtve//b/s/e39//y/Pffvutb1rvtaz72etd6beZ/nuebwQ9fhtZrUrt6IiMS/BH57SRFCxAghBgkh8gkhAiFE+fjy8dnjeRSk/GsnYf9ej6Zd6xWwa4nrn7Nx/XM2rn/OxvXP2bj+ORvXP2fj+udsXH/GcrKtMwvfwC3ntn/9+X/Mby/8/P//Q/z5n7Nx/f/TnM7zzxzN9f9Pctl7/89lcP1zNq5/zsb1z9m4/jkb1z9n4/ozlpNd6+fP3K5tu9b//hhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM5Qzn/BVaCPF7/1qvizHGGGOMMcYYY/8+Pve1XgFjjDHGGGOMMcb+54GQQgktApFL5BYxIo+IFdeJOHG9yCvyiYi4QcSLG0V+cZMoIAqKQqKwSBBFRFFhBAorSISimCguouJmUULcIhJFSVFKlBZOlBFJ4lZRVtwmyonbRXlxh6gg7hQVRSVRWVQRd4mq4m5RTdwjqot7RQ1RU9QStcV9oo64X9QVD4h64kFRXzwkGoiHRUPxiGgkHhWNxWOiiXhcNBVPiGaiuWghWopW/1f5r4ie4lXRS/QWKaKP6CteE/1EfzFADBSDxOtisHhDDBFviqFimBgu3hIjxNtipHhHjBKjxRjxrhgrxonxYoKYKCaJVPGemCzeF1PEB2KqmCamixkiTcwUs8SHYraYI+aKj8Q88bGYLxaIhWKRSBefiMViicgQn4ql4jORKZaJ5WKFWClWidVijVgr1on1YoPYKDaJzWKL2Co+F9vEdrFD7BS7xG6xR3wh9oovxT7xlcgSX/+T+Wf/S343ECBAggQNGnJBLoiBGIiFWIiDOMgLeSECEYiHeMgP+aEAFIBCUAgSIAGKQlFAQCAgKAbFIApRKAElIBESoRSUAgcOkiAJysJtUA7KQXkoDxWgAlSESlAJqkAVqApVoRpUg+pQHWpADagFteA+uA/uh7pQF+pBPagP9aEBNICG0BAaQSNoDI2hCTSBptAUmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIRk6QkfoBJ2gM3SGLtAFukJX6AbdoTu8Aq/Aq/Aq9IYasg/0hb7QD/rBABgIA+F1GAxvwBvwJgyFYTAc3oK34G0YCWdgFIyGMTAGqspxMB4mAMlJkAqpMBkmwxSYAlNhGkyDGZAGM2EWzILZMAfmwEcwDz6Gj2EBLIBFkA7psBiWQAZkwFI4C5mwDJbDClgJq2AlrIG1sAbWwwZYD5tgE2yBLfA5fA7bYTvshJ2wG3bDF/AFfAlfwlDIgizYD/vhAByAg3AQDsEhOAyH4QgcgaNwFI7BMTgOJ+AknIDTcBrOwFk4B+fgAlyAi3ARLsPl7P/8MpuWWuaSuWSMjJGxMlbGyTiZV+aVERmR8TJe5pf5ZQFZQBaShWSCTJBFZVGJEiXJUBaTxWRURmUJWUImykRZSpaSTjqZJJNkWVlWlpPlZHl5h6wg75QVZSXZ1lWRVWRV2c5Vk/fI6rK6rCFrylqytqwt68g6sq6sK+vJerK+rC8byIdlQ9kHBsCjMrsyTeQwaCqHQzPZXLaQLeXb8KRsLUdCG9lWtpNPy9EwCjrI1i5ZPic7yvHQSb4gJ8CLsoucBF3ly7Kb7C57yFdkT9nG9ZK95VToI/vKGdBP9pcD5EA5G2rK7IrVkm/KoXKYHC7fkovgbTlSviNHydFyjHxXjpXj5Hg5QU6Uk2SqfE9Olu/LKfIDOVVOk9PlDJkmZ8pZ8kM5W86Rc+VHcp78WM6XC+RCuUimy0/kYrlEZshP5VL5mcyUy+RyuUKulKvkarlGrpXr5Hq5QW6Um+RmuUVulZ/LbXK73CF3yl1yt9wjv5B75Zdyn/xKZsmv5X75J3lAfiMPym/lIfmdPCy/l0fkD/Ko/FEekz/J4/KEPClPydPyZ3lGnpXn5Hl5Qf4iL8pL8rL0UihQUimlVaByqdwqRuVRseo6FaeuV3lVPhVRN6h4daPKr25SBVRBVUgVVgmqiCqqjEJlFalQFVPFVVTdrEqoW1SiKqlKqdLKqTIqSd2qyqrbVDl1uyqv7lAV1J2qoqqkKqsq6i5VVd2tqql7VHV1r6qhaqpaqra6T9VR96u66gFVTz2o6quHVAP1sGqoHlGN1KOqsXpMNVGPq6bqCdVMNVctVEvVSj2pWqunVBvVVrVTT6v26hnVQT2rktVzqqN6XnVSL6jO6kXVRb2kuqqXVTfVXfVQl9Rl5VUv1VulqD6qr3pN9VP91QA1UA1Sr6vB6g01RL2phqpharh6S41Qb6uR6h01So1WY9S7aqwap8arCWqimqRS1XtqsnpfTVEfqKlqmpquZqg0NVMN+PNMc/+B/Pf/Tv6QX8++RW1Vn6ttarvaoXaqXWq32qP2qL1qr9qn9qkslaX2q/3qgDqgDqqD6pA6pA6rw+qIOqKOqqPqmDqmjqsT6rw6pU6rn9UZdVadVefVBXVBXfzzeyA0aKmV1jrQuXRuHaPz6Fh9nY7T1+u8Op+O6Bt0vL5R59c36QK6oC6kC+sEXUQX1Uajtpp0qIvp4jqqb9Yl9C06UZfUpXRp7XQZnaRv/Zfzr7a+VrqVbq1b6za6jW6n2+n2ur3uoDvoZJ2sO+qOupPupDvrzrqL7qK76q66m+6me+geuqfuqb0QIkWn6L76Nd1P99cD9EA9SL+uB+vBeogeoofqoXq4Hq5H6BF6pB6pR+lReoweo8fqsXq8Hq8n6ok6VafqyXqynqKn6Kl6qp6up+s0naZn6Vl6tp6t5+q5ep6ep+fr+XqhXqjTdbperBfrDJ2hl+qlOlMv08v0Cr1Cr9Kr9Bq9Rq/T6/QGvUFv0pt0pv79GzR36B16l96l9+g9eq/eq/fpfTpLZ+n9er8+oA/og/qgPqQP6cP6sD6ij+ij+qg+po/p4/q4PqlP6tP6tD6jz+hz+py+oC/oi/qivqwvZ1/2BTKQgQ50kCvIFcQEMUFsEBvEBXFB3iBvEAkiQXwQH+QPbgoKBAWDQkHhICEoEhQNTICBDSgIg2JB8SAa3ByUCG4JEoOSQamgdOCCMkFScGtQNrgtKBfcHpQP7ggqBHcGFYNKQeWgSnBXUDW4O6gW3BNUD+4NagQ1g1pB7eC+oE5wf1A3eCCoFzwY1A8eChoEDwcNg0eCRsGjQePgsaBJ8HjQNHgiaBY0D1oELYNW/9b5vT9T8CnXy/Q2KaaP6WteM/1MfzPADDSDzOtmsHnDDDFvmqFmmBlu3jIjzNtmpHnHjDKjzRjzrhlrxpnxZoKZaCaZVPOemWzeN1PMB2aqmWammxkmzcw0s8yHZraZY+aaj8w887GZbxaYhWaRSTefmMVmickwn5ql5jOTaZaZ5WaFWWlWmdVmjVlr1pn1ZoPZaDaZzWaL2Wo+N9vMdrPD7DS7zG6zx3xh9povzT7zlckyX5v95k/mgPnGHDTfmkPmO3PYfG+OmB/MUfOjOWZ+MsfNCXPSnDKnzc/mjDlrzpnz5oL5xVw0l8xl47Mv7rM/3lGjxlyYC2MwBmMxFuMwDvNiXoxgBOMxHvNjfiyABbAQFsIETMCiWBSzERIWw2IYxSiWwBKYiIlYCkuhQ4dJmIRlsSyWw3JYHstjBayAFbEiVsbs+5G78G68G+/Be/BevBdrYk2sjbWxDtbBulgX62E9rI/1sQE2wIbYEBthI2yMjbEJNsGm2BSbYTNsgS2wFbbC1tga22AbbIftsD22xw7YAZMxGTtiR+yEnbAzdsYu2AW7Ylfsht2wB/bAntgTe2EvTMEU7It9sR/2wwE4AAfhIByMg3EIDsGhOBSH43AcgSNwJI7EUTgax+C7OBbH4XicgBNxEqZiKk7GyTgFp+BUnIrTcTqmYRrOwlk4G2fjXJyL83Aezsf5uBAXYjqm42JcjBmYgUtxKWZiJi7H5bgSV+JqXI1rcS2ux/W4ETfiZtyMW3ErbsNtuAN34C7chXtwD+7FvbgP92EWZuF+3I8H8AAexIN4CA/hYTyMR/AIHsWjeAyP4XE8DifxJJ7G03gGz+A5PIcX8Be8iJfwMnqMsXlsrL3OxtnrbV6bz8bYPL2FEH+JC9nCNsEWsUWtsQVswb+J0VqbaEvaUra0dbaMTbK3/iGuaCvZyraKvctWtXfban+I69j7bV37gK1nH7S17X1/E9e3D9kG9nHb0D5hG9nmtrFtaZvYx21T+4RtZpvbFralbW+fsR3sszbZPmc72uf/EC+2S+xau86utxvsXvulPWfP2yP2B3vB/mJ72d52kH3dDrZv2CH2TTvUDvtDPMa+a8facXa8nWAn2kl/iKfbGTbNzrSz7Id2tp3zhzjdfmLn2Qw73y6wC+2iX+PsNWXYT+1S+5nNtMvscrvCrrSr7Gq75i9rXWE32c12i91jv7Db7Ha7w+60u+zuX+PsfeyzX9ks+7U9bL+3B+w39qA9ag/Z736Ns/d31P5oj9mf7HF7wp60p+xp+7M9Y8/+uv/svZ+yl+xl660gIEmKNAWUi3JTDOWhWLqO4uh6ykv5KEI3UDzdSPnpJipABakQFaYEKkJFyRCSJaKQilFxitLNVIJuoUQqSaWoNDkqQ0l0K5Wl26gc3U7l6Q6qQHdSRapElakK3UVV6W6qRvdQdbqXalBNqkW16T6qQ/dTXXqA6tGDVJ8eogb0MDWkR6gRPUqN6TFqQo9TU3qCmlFzakEtqRU9Sa3pKWpDbakdPU3t6RnqQM9SMj1HHel56kQvUGd6kbrQS9SVXqZu1J160CvUk16lXtSbUqgP9aXXqB/1pwE0kAbR6zSY3qAh9CYNpWE0nN6iEfQ2jaR3aBSNpjH0Lo2lcTSeJtBEmkSp9B5NpvdpCn1AU2kaTacZlEYzaRZ9SLNpDs2lj2gefUzzaQEtpEWUTp/QYlpCGfQpLaXPKJOW0XJaQStpFa2mNbSW1tF62kAbaRNtpi20lT6nbbSddtBO2kW7aQ99QXvpS9pHX1EWfU376U90gL6hg/QtHaLv6DB9T0foBzpKP9Ix+omO0wk6SafoNP1MZ+gsnaPzdIF+oYt0iS6TJxFCKEMV6jAIc4W5w5gwTxgbXhfGhdeHecN8YSS8IYwPbwzzhzeFBcKCYaGwcJgQFgmLhibE0IYUhmGxsHgYDW8OS4S3hIlhybBUWDp0YZkwKbw1LBveFpYLbw/Lh3eEFcI7w4phpbByWCW8K6wa3h1WC+8Jq4f3hjXCmmGtsHZ4X1gnvD+sGz4Q1gsfDMuFD4UNwofDhuEjYaPw0bBx+FjYJHw8bBo+ETYLm4ctwpZhq/DJsHX4VNgmbBu2C58O24fPhB3CZ8Pk8LmwY/j8VcdTwj5h3/C18LXQ+wfUwuiiaHr0k+ji6JJoRvTT6NLoZ9HM6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kbo5uiWqPe1cwsHTjrltAtcLpfbxbg8LtZd5+Lc9S6vy+ci7gYX7250+d1NroAr6Aq5wi7BFXFFnXHorCMXumKuuIu6m10Jd4tLdCVdKVfaOVfGJbmWrpVr5Vq7p1wb19a1c0+7p90z7hn3rHvWPec6uuddJ/eC6+xedF3cS+4l97Lr5rq7Hu4V19O96nq53i7Fpbi+rq/r5/q5AW6AG+QGucFusBvihrihbqgb7oa7EW6EG+lGulFulBvjxrixbqwb78a7iW6iS3WpbrKb7Ka4KW6qm+qmu+kuzaW5WW6Wm+1mu7lurpvn5rn5br5b6Ba6dJfuFrvFLsNluKVuqct0mW65W+5WupVutVvt1rq1br1b7za6jW6z2+y2uq1um9vmdrgdbpfb5fa4PW6v2+v2uX0uy2W5/W6/O+AOuIPuW3fIfecOu+/dEfeDO+p+dMfcT+64O+FOulPutPvZnXFn3Tl33l1wv7iL7pK77LxLjbwXmRx5PzIl8kFkamRaZHpkRiQtMjMyK/JhZHZkTmRu5KPIvMjHkfmRBZGFkUWR9MgnkcWRJZGMyKeRpZHPIpmRZZHlkRWRlZFVEe+LbAt9MV/cR/3NvoS/xSf6kr6UL+2dL+OT/K2+rL/Nl/O3+/L+Dl/B3+kr+kq+sn/CN/PNfQvf0rfyT/rW/infxrf17fzTvr1/xnfwz/pk/5zv6J/3nfwLvrN/0XfxL/mu/mXfzXf3Pfwrvqd/1ffyvX2K7+P7+td8P9/fD/AD/SD/uh/s3/BD/Jt+qB/mh/u3/Aj/th/p3/Gj/Gg/xr/rx/pxfryf4Cf6ST7Vv+cn+/f9FP+Bn+qn+el+hk/zM/0s/6Gf7ef4uf4jP89/7Of7BX6hX+TT/Sd+sV/iM/ynfqn/zGf6ZX65X+FX+lV+tV/j1/p1fr3f4Df6TX6z3+K3+s/9Nr/d7/A7/S6/2+/xX/i9/ku/z3/ls/zXfr//kz/gv/EH/bf+kP/OH/bf+yP+B3/U/+iP+Z/8cX/Cn/Sn/Gn/sz/jz/pz/ry/4H/xF/0lf5l/Zo0xxhhj7B+irjLe57/JkX/u9xVCXL+98KH/Or6xwG/9/rkT2keEEM/17vro761GjZSUlD8fm6lEUHyBECJyJT+XuBIvE+3EMyJZtBVl/zIe81fn6i+7X6CrzB+9Q4jYv8rJzv89vjL/bX93//3luHlXnX+BEInFr+TkEVfiK/OX+2/mL9j6KvPn+SZViDZ/lRMnrsRX5k8ST4nnRfLfHMkYY4wxxhhjjP2mv6zc+Wr3t9n35wn6Sk5ucSX+e/fnjDHGGGOMMcYY+9/lxe49nn0yObltZ+78T3V8vt/e6v8t6+EOd/6BzrX+ysQYY4wxxhj7d7ty0X+tV8IYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjOVc/y9+ndjv57ra3xpkjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG/lP9nwAAAP//sjE7Eg==") socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x0) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$bt_l2cap_L2CAP_OPTIONS(r5, 0x6, 0x1, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, 0x0) sendmsg$DCCPDIAG_GETSOCK(r6, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000040}, 0xc, &(0x7f0000000240)={&(0x7f0000000780)={0x4c, 0x13, 0x218, 0x70bd28, 0x25dfdbfe, {0x15, 0x9, 0x2, 0x1, {0x4e23, 0x4e23, [0x0, 0x779, 0x400], [0x0, 0x9, 0x7, 0x9], 0x0, [0x9, 0x31]}, 0x1ff, 0x401}}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x24040040) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x145802, 0x0) pwritev2(r7, &(0x7f00000001c0)=[{&(0x7f0000000200)='y', 0xf4240}], 0x1, 0x0, 0x0, 0x0) [ 78.515173][ T4533] Bluetooth: hci0: command tx timeout [ 78.673770][ T5114] loop0: detected capacity change from 0 to 256 [ 78.699744][ T5114] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d18cac, utbl_chksum : 0xe619d30d) [ 79.036593][ T5116] process 'syz.0.0' launched './file1' with NULL argv: empty string added [ 79.051847][ T5116] ================================================================== [ 79.054889][ T5116] BUG: KASAN: stack-out-of-bounds in exfat_get_block+0x1d43/0x2180 [ 79.058016][ T5116] Write of size 4 at addr ffffc900030df420 by task syz.0.0/5116 [ 79.061261][ T5116] [ 79.062639][ T5116] CPU: 0 UID: 0 PID: 5116 Comm: syz.0.0 Not tainted 6.12.0-rc1-syzkaller-00042-gf23aa4c0761a #0 [ 79.067348][ T5116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 79.071280][ T5116] Call Trace: [ 79.072565][ T5116] [ 79.073700][ T5116] dump_stack_lvl+0x241/0x360 [ 79.075702][ T5116] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.077746][ T5116] ? __pfx__printk+0x10/0x10 [ 79.079789][ T5116] ? _printk+0xd5/0x120 [ 79.081801][ T5116] print_report+0x169/0x550 [ 79.084011][ T5116] ? __virt_addr_valid+0xbd/0x530 [ 79.086348][ T5116] ? exfat_get_block+0x1d43/0x2180 [ 79.088586][ T5116] kasan_report+0x143/0x180 [ 79.090484][ T5116] ? exfat_get_block+0x1d43/0x2180 [ 79.092521][ T5116] exfat_get_block+0x1d43/0x2180 [ 79.094533][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.096620][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.098703][ T5116] __blockdev_direct_IO+0x1c8e/0x4890 [ 79.101012][ T5116] ? __pfx___blockdev_direct_IO+0x10/0x10 [ 79.103579][ T5116] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 79.106495][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.108390][ T5116] ? __pfx_filemap_invalidate_pages+0x10/0x10 [ 79.111108][ T5116] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 79.113681][ T5116] exfat_direct_IO+0x151/0x400 [ 79.115580][ T5116] generic_file_direct_write+0x17a/0x390 [ 79.117625][ T5116] __generic_file_write_iter+0x126/0x230 [ 79.119596][ T5116] ? exfat_file_write_iter+0x15a/0x3f0 [ 79.121654][ T5116] exfat_file_write_iter+0x165/0x3f0 [ 79.124010][ T5116] do_iter_readv_writev+0x600/0x880 [ 79.126490][ T5116] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 79.128909][ T5116] ? rcu_read_lock_any_held+0xb7/0x160 [ 79.130958][ T5116] vfs_writev+0x376/0xba0 [ 79.132739][ T5116] ? __pfx_lock_acquire+0x10/0x10 [ 79.134768][ T5116] ? __pfx_vfs_writev+0x10/0x10 [ 79.136753][ T5116] ? __might_fault+0xaa/0x120 [ 79.139017][ T5116] ? __fget_files+0x29/0x470 [ 79.141602][ T5116] ? __fget_files+0x29/0x470 [ 79.144026][ T5116] __se_sys_pwritev2+0x1ca/0x2d0 [ 79.146168][ T5116] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 79.148315][ T5116] ? do_syscall_64+0x100/0x230 [ 79.150072][ T5116] ? __x64_sys_pwritev2+0x21/0xf0 [ 79.151816][ T5116] do_syscall_64+0xf3/0x230 [ 79.153478][ T5116] ? clear_bhb_loop+0x35/0x90 [ 79.155142][ T5116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.157288][ T5116] RIP: 0033:0x7f24f037dff9 [ 79.159120][ T5116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.167962][ T5116] RSP: 002b:00007f24f120e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 79.171106][ T5116] RAX: ffffffffffffffda RBX: 00007f24f0536130 RCX: 00007f24f037dff9 [ 79.173846][ T5116] RDX: 0000000000000001 RSI: 00000000200001c0 RDI: 000000000000000b [ 79.176637][ T5116] RBP: 00007f24f03f0296 R08: 0000000000000000 R09: 0000000000000000 [ 79.180057][ T5116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.183040][ T5116] R13: 0000000000000000 R14: 00007f24f0536130 R15: 00007ffd5eaf44a8 [ 79.185599][ T5116] [ 79.186667][ T5116] [ 79.187523][ T5116] The buggy address belongs to stack of task syz.0.0/5116 [ 79.190149][ T5116] and is located at offset 96 in frame: [ 79.192845][ T5116] exfat_get_block+0x0/0x2180 [ 79.194413][ T5116] [ 79.195203][ T5116] This frame has 4 objects: [ 79.196768][ T5116] [32, 36) 'last_clu.i' [ 79.196782][ T5116] [48, 60) 'new_clu.i' [ 79.198196][ T5116] [80, 84) 'fclus.i' [ 79.199774][ T5116] [96, 100) 'cluster' [ 79.201212][ T5116] [ 79.203650][ T5116] The buggy address belongs to the virtual mapping at [ 79.203650][ T5116] [ffffc900030d8000, ffffc900030e1000) created by: [ 79.203650][ T5116] copy_process+0x5d1/0x3d50 [ 79.210506][ T5116] [ 79.211862][ T5116] The buggy address belongs to the physical page: [ 79.215372][ T5116] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x557f76247 pfn:0x1fce1 [ 79.219294][ T5116] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 79.222223][ T5116] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 79.226235][ T5116] raw: 0000000557f76247 0000000000000000 00000001ffffffff 0000000000000000 [ 79.230120][ T5116] page dumped because: kasan: bad access detected [ 79.233050][ T5116] page_owner tracks the page as allocated [ 79.235463][ T5116] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5113, tgid 5113 (syz.0.0), ts 79033103858, free_ts 78695975312 [ 79.243589][ T5116] post_alloc_hook+0x1f3/0x230 [ 79.245384][ T5116] get_page_from_freelist+0x3045/0x3190 [ 79.247225][ T5116] __alloc_pages_noprof+0x256/0x6c0 [ 79.248780][ T5116] alloc_pages_mpol_noprof+0x3e8/0x680 [ 79.250397][ T5116] __vmalloc_node_range_noprof+0xa2b/0x13f0 [ 79.252177][ T5116] dup_task_struct+0x444/0x8c0 [ 79.254136][ T5116] copy_process+0x5d1/0x3d50 [ 79.256102][ T5116] kernel_clone+0x226/0x8f0 [ 79.258261][ T5116] __se_sys_clone3+0x2cb/0x350 [ 79.260270][ T5116] do_syscall_64+0xf3/0x230 [ 79.262026][ T5116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.264185][ T5116] page last free pid 74 tgid 74 stack trace: [ 79.266390][ T5116] free_unref_folios+0xf12/0x18d0 [ 79.268356][ T5116] shrink_folio_list+0x81fd/0x8cc0 [ 79.270384][ T5116] evict_folios+0x549b/0x7b50 [ 79.272251][ T5116] try_to_shrink_lruvec+0x9ab/0xbb0 [ 79.274306][ T5116] shrink_one+0x3b9/0x850 [ 79.276008][ T5116] shrink_node+0x3799/0x3de0 [ 79.278207][ T5116] kswapd+0x1ca3/0x3700 [ 79.281398][ T5116] kthread+0x2f0/0x390 [ 79.284231][ T5116] ret_from_fork+0x4b/0x80 [ 79.286575][ T5116] ret_from_fork_asm+0x1a/0x30 [ 79.288708][ T5116] [ 79.289770][ T5116] Memory state around the buggy address: [ 79.291740][ T5116] ffffc900030df300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.294889][ T5116] ffffc900030df380: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 00 04 [ 79.297979][ T5116] >ffffc900030df400: f2 f2 04 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 [ 79.300431][ T5116] ^ [ 79.302178][ T5116] ffffc900030df480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.304938][ T5116] ffffc900030df500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.307710][ T5116] ================================================================== [ 79.311995][ T5116] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 79.315612][ T5116] CPU: 0 UID: 0 PID: 5116 Comm: syz.0.0 Not tainted 6.12.0-rc1-syzkaller-00042-gf23aa4c0761a #0 [ 79.320014][ T5116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 79.324178][ T5116] Call Trace: [ 79.325508][ T5116] [ 79.326704][ T5116] dump_stack_lvl+0x241/0x360 [ 79.328606][ T5116] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.331217][ T5116] ? __pfx__printk+0x10/0x10 [ 79.334221][ T5116] ? lock_release+0xbf/0xa30 [ 79.336632][ T5116] ? vscnprintf+0x5d/0x90 [ 79.338510][ T5116] panic+0x349/0x880 [ 79.340155][ T5116] ? check_panic_on_warn+0x21/0xb0 [ 79.342225][ T5116] ? __pfx_panic+0x10/0x10 [ 79.344265][ T5116] ? mark_lock+0x9a/0x360 [ 79.346175][ T5116] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 79.348845][ T5116] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 79.351431][ T5116] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 79.353966][ T5116] ? print_report+0x502/0x550 [ 79.355906][ T5116] check_panic_on_warn+0x86/0xb0 [ 79.357885][ T5116] ? exfat_get_block+0x1d43/0x2180 [ 79.360136][ T5116] end_report+0x77/0x160 [ 79.362105][ T5116] kasan_report+0x154/0x180 [ 79.363993][ T5116] ? exfat_get_block+0x1d43/0x2180 [ 79.366051][ T5116] exfat_get_block+0x1d43/0x2180 [ 79.368025][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.370479][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.372996][ T5116] __blockdev_direct_IO+0x1c8e/0x4890 [ 79.375786][ T5116] ? __pfx___blockdev_direct_IO+0x10/0x10 [ 79.378623][ T5116] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 79.381049][ T5116] ? __pfx_exfat_get_block+0x10/0x10 [ 79.383257][ T5116] ? __pfx_filemap_invalidate_pages+0x10/0x10 [ 79.385828][ T5116] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 79.388781][ T5116] exfat_direct_IO+0x151/0x400 [ 79.391235][ T5116] generic_file_direct_write+0x17a/0x390 [ 79.393777][ T5116] __generic_file_write_iter+0x126/0x230 [ 79.396309][ T5116] ? exfat_file_write_iter+0x15a/0x3f0 [ 79.398511][ T5116] exfat_file_write_iter+0x165/0x3f0 [ 79.400630][ T5116] do_iter_readv_writev+0x600/0x880 [ 79.402764][ T5116] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 79.405094][ T5116] ? rcu_read_lock_any_held+0xb7/0x160 [ 79.407419][ T5116] vfs_writev+0x376/0xba0 [ 79.409485][ T5116] ? __pfx_lock_acquire+0x10/0x10 [ 79.412157][ T5116] ? __pfx_vfs_writev+0x10/0x10 [ 79.414409][ T5116] ? __might_fault+0xaa/0x120 [ 79.416182][ T5116] ? __fget_files+0x29/0x470 [ 79.417853][ T5116] ? __fget_files+0x29/0x470 [ 79.419378][ T5116] __se_sys_pwritev2+0x1ca/0x2d0 [ 79.421376][ T5116] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 79.423575][ T5116] ? do_syscall_64+0x100/0x230 [ 79.425636][ T5116] ? __x64_sys_pwritev2+0x21/0xf0 [ 79.427824][ T5116] do_syscall_64+0xf3/0x230 [ 79.430115][ T5116] ? clear_bhb_loop+0x35/0x90 [ 79.432108][ T5116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.434506][ T5116] RIP: 0033:0x7f24f037dff9 [ 79.436346][ T5116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.445884][ T5116] RSP: 002b:00007f24f120e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 79.450418][ T5116] RAX: ffffffffffffffda RBX: 00007f24f0536130 RCX: 00007f24f037dff9 [ 79.453558][ T5116] RDX: 0000000000000001 RSI: 00000000200001c0 RDI: 000000000000000b [ 79.456829][ T5116] RBP: 00007f24f03f0296 R08: 0000000000000000 R09: 0000000000000000 [ 79.459994][ T5116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.463114][ T5116] R13: 0000000000000000 R14: 00007f24f0536130 R15: 00007ffd5eaf44a8 [ 79.466677][ T5116] [ 79.468814][ T5116] Kernel Offset: disabled [ 79.471116][ T5116] Rebooting in 86400 seconds..