program: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) syz_mount_image$hfs(&(0x7f0000000180), &(0x7f0000000080)='./file1\x00', 0x84, &(0x7f0000000000)=ANY=[], 0x8b, 0x2d5, &(0x7f0000025dc0)="$eJzs3c9OE10Yx/HfmSlteeHFUTAmxoVBia4M4Ma4aWKI1+BGI9KaEBqIiImysXFtvAD3bLwAL8KVMXGNK1deALsxZ3pKz7QzbYHQAfl+ktrO9Px5zsy0c56RZgTgwnq0sr93/7d9GClUKOmhFNi3bqok6aquVd9s7qzvNBv1QQ2FUlXJw0hJTdNXZm2zkVXV1ktqOJFdKmnaX4fTEcdx/KvoIFCkqnsOs94MpIr7dIZ+4bOs0rM80bPcCqXWGOM5i8yBDvRWM0XHAQAolmmf3wN3np928/cgkBbcad8////8v+B4T+aODooOoWDe+T/JsmJj9++l5K1uvmc06cp3ssSj9mPnYmW1j6zUBNOks8r+ZDGJJZh8ud5s3FvbatYDfVAtYfy8cE5STXWXs2ZF29/0fMa6tLK/sD+sdK6pZAwTdgzL3fhrNa/IbFanx93aozDfzHfzzET6rPrh/K8UG3/Mbk89nujGv5jX3Narp/Y5apfKGeVluxtK19MbduAow7yMRG5LxaHSFwiidJzlzFpl9dRqj24pryfXzmxmreUhteZsrS9ere7RnF/ztJlP5omZ1x991Yo3/w/s1l5Q/yczu5GkpDsyBo6nlJSM/FWtG5klg6OPBUfU3cYf9UIPNPP63e7GarPZ2B73CxvD2Du9mC8i9a7pHARnJcLjvbDfsf4aRY3t0nh6L59401XdTrGTmf4yld2N1YpfuD3Szgmxt8HOx3qE3jsX8IZGOMZvJRSmu9Pzy7wX/xPzD7NfHqad/3n5ymKS9Nh/ogHz9HjYtM1rcSkjN+heqv/Pa8m46/P5GdBUZgbX0mg5V1L31l3ptrdyf68yKOeKdEWH2fD5Z1b0Q8+5/g8AAAAAAAAAAAAAAAAAAHDejOPXGl53/B05AAAAAAAAAAAAAAAAAAAAAADHkH//36pO8f6/qd8BjHz/394bewI4kb8BAAD//+jIZ98=") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x40441, 0x106) (async, rerun: 64) r1 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") (rerun: 64) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000000)={0x9, 0x100000000}) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='gretap0\x00', 0x10) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000100)=ANY=[], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffff03}, 0x94) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r3, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r4, @ANYRESHEX=r5, @ANYRES32=r5, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) [ 93.186926][ T5313] loop0: detected capacity change from 0 to 64 [ 93.197794][ T1359] cfg80211: failed to load regulatory.db [ 93.201621][ T5277] Bluetooth: hci0: command tx timeout [ 93.501746][ T1159] ------------[ cut here ]------------ [ 93.505297][ T1159] kernel BUG at fs/hfs/inode.c:476! [ 93.539204][ T1159] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 93.543035][ T1159] CPU: 0 UID: 0 PID: 1159 Comm: kworker/u4:9 Not tainted syzkaller #0 PREEMPT(full) [ 93.547222][ T1159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.552169][ T1159] Workqueue: writeback wb_workfn (flush-7:0) [ 93.554932][ T1159] RIP: 0010:hfs_write_inode+0x95e/0x990 [ 93.557617][ T1159] Code: 89 de 81 e6 00 00 00 40 31 ff e8 5d c6 0e ff 81 e3 00 00 00 40 75 15 e8 10 c2 0e ff 4c 89 f3 e9 b1 f7 ff ff e8 03 c2 0e ff 90 <0f> 0b e8 fb c1 0e ff e8 36 66 7a fe eb e4 44 89 e1 80 e1 07 80 c1 [ 93.565777][ T1159] RSP: 0000:ffffc900016ff120 EFLAGS: 00010293 [ 93.568594][ T1159] RAX: ffffffff82b84fad RBX: f8f8f8f8f8f8f8f8 RCX: ffff8880367b0000 [ 93.572364][ T1159] RDX: 0000000000000000 RSI: ffffffff8edd1410 RDI: 0000000000000000 [ 93.575823][ T1159] RBP: ffffc900016ff2a8 R08: ffff8880367b0000 R09: 0000000000000003 [ 93.579141][ T1159] R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000 [ 93.582682][ T1159] R13: dffffc0000000000 R14: ffff8880524bb500 R15: 1ffff920002dfe28 [ 93.586163][ T1159] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 93.590082][ T1159] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.592999][ T1159] CR2: 00007f065500b113 CR3: 0000000012594000 CR4: 0000000000352ef0 [ 93.596680][ T1159] Call Trace: [ 93.598235][ T1159] [ 93.599647][ T1159] ? __pfx_hfs_write_inode+0x10/0x10 [ 93.602071][ T1159] ? do_raw_spin_unlock+0x4d/0x210 [ 93.604368][ T1159] __writeback_single_inode+0x6ac/0xf90 [ 93.606875][ T1159] writeback_sb_inodes+0x9de/0x1b00 [ 93.609222][ T1159] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 93.611488][ T1159] ? __pfx_down_read_trylock+0x10/0x10 [ 93.613928][ T1159] ? __pfx___up_read+0x10/0x10 [ 93.616136][ T1159] __writeback_inodes_wb+0x114/0x240 [ 93.618607][ T1159] wb_writeback+0x42f/0xad0 [ 93.620838][ T1159] ? queue_io+0x2d1/0x470 [ 93.622923][ T1159] ? __pfx_wb_writeback+0x10/0x10 [ 93.625168][ T1159] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.627459][ T1159] ? process_scheduled_works+0xa20/0x14e0 [ 93.630048][ T1159] wb_workfn+0x980/0x10f0 [ 93.632052][ T1159] ? __pfx_wb_workfn+0x10/0x10 [ 93.634172][ T1159] ? rcu_is_watching+0x15/0xb0 [ 93.636251][ T1159] ? trace_hrtimer_start+0x82/0x200 [ 93.638566][ T1159] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.640803][ T1159] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 93.643353][ T1159] ? process_scheduled_works+0xa20/0x14e0 [ 93.645907][ T1159] ? rcu_is_watching+0x15/0xb0 [ 93.648029][ T1159] ? process_scheduled_works+0xa20/0x14e0 [ 93.650588][ T1159] process_scheduled_works+0xa8e/0x14e0 [ 93.653242][ T1159] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.655932][ T1159] ? assign_work+0x3cf/0x5d0 [ 93.657967][ T1159] worker_thread+0xa47/0xfb0 [ 93.660115][ T1159] ? __kthread_parkme+0x71/0x1f0 [ 93.662401][ T1159] kthread+0x388/0x470 [ 93.664269][ T1159] ? __pfx_worker_thread+0x10/0x10 [ 93.666544][ T1159] ? __pfx_kthread+0x10/0x10 [ 93.668721][ T1159] ret_from_fork+0x514/0xb70 [ 93.670695][ T1159] ? __pfx_ret_from_fork+0x10/0x10 [ 93.673056][ T1159] ? __switch_to+0xc89/0x1420 [ 93.675188][ T1159] ? __pfx_kthread+0x10/0x10 [ 93.677231][ T1159] ret_from_fork_asm+0x1a/0x30 [ 93.679373][ T1159] [ 93.680787][ T1159] Modules linked in: [ 93.684423][ T1159] ---[ end trace 0000000000000000 ]--- [ 93.743929][ T1159] RIP: 0010:hfs_write_inode+0x95e/0x990 [ 93.747331][ T1159] Code: 89 de 81 e6 00 00 00 40 31 ff e8 5d c6 0e ff 81 e3 00 00 00 40 75 15 e8 10 c2 0e ff 4c 89 f3 e9 b1 f7 ff ff e8 03 c2 0e ff 90 <0f> 0b e8 fb c1 0e ff e8 36 66 7a fe eb e4 44 89 e1 80 e1 07 80 c1 [ 93.756748][ T1159] RSP: 0000:ffffc900016ff120 EFLAGS: 00010293 [ 93.760124][ T1159] RAX: ffffffff82b84fad RBX: f8f8f8f8f8f8f8f8 RCX: ffff8880367b0000 [ 93.804140][ T1159] RDX: 0000000000000000 RSI: ffffffff8edd1410 RDI: 0000000000000000 [ 93.807865][ T1159] RBP: ffffc900016ff2a8 R08: ffff8880367b0000 R09: 0000000000000003 [ 93.815530][ T1159] R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000 [ 93.821313][ T1159] R13: dffffc0000000000 R14: ffff8880524bb500 R15: 1ffff920002dfe28 [ 93.835074][ T1159] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 93.838901][ T1159] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.841752][ T1159] CR2: 00007f91be80f000 CR3: 000000001295a000 CR4: 0000000000352ef0 [ 93.854829][ T1159] Kernel panic - not syncing: Fatal exception [ 93.857764][ T1159] Kernel Offset: disabled [ 93.859554][ T1159] Rebooting in 86400 seconds..