program: syz_mount_image$squashfs(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1f0, &(0x7f00000002c0)="$eJzsks9rE0EUxz+zu21XsTRIVBRB1GLroc1mq/HHQcGLQT1JhVoQDEmswdQf3YAm9BBBKOJF0IMV8SBIRDyI/4A5eOpNQbzVQs899OBFWldmMrtO/wMP8znku2/mve/Me5mb0b1oANhcny9DBolHlq9C4AEHhFqi4vbU13pJa7/eP+/0tKv1t9bNE62paRC1Q8sFp7unclBk2JH9tbRCmaFrnHp98cO3y7Xn33euvf0s8y9caX5CjFSG3rz6+PTc4qCyF1enTR+3u/+lL42AZxtTyyveXrKG1y7/z+6lR533hcc/eTFAyviXscUzweATR3tGzdatUr1enYvOPnRYU0f9WJ8vy4/rQBzHseodKAJmjmz/nZGzz4NJwCVOc+T8ZDAC5Bqzd3NRszVWmy3NVGeqt8NwohAcC4LjYe5GrV4Ner/COEJPEKlHAdnJNmO/D9jQOdvZijCupveFWdtv/HWjh7fWOkZtooJuWptMVI5gkiP4wP22MFaHlYuHaqmIwNVB3jPuJ1SWrzbGy3fqlQUEIinr4KUe+VX60iA0g4mT7eTaC1qHtRa1dgA5qlUdJy86eamecnD0ex5tQz8PSo3GXF4OqfeVroXpWphpmwOTp2bcf81JTrtYLBaLxWKxWCwWy3/D3wAAAP//m9SdVA==") (async) chdir(&(0x7f0000000080)='./file0\x00') r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x8000) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) syz_open_procfs$namespace(r1, &(0x7f0000000040)='ns/time_for_children\x00') [ 75.814277][ T4664] Bluetooth: hci0: command tx timeout [ 75.845850][ T5310] loop0: detected capacity change from 0 to 8 [ 75.890517][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 75.901765][ T5310] ------------[ cut here ]------------ [ 75.911967][ T5310] UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 [ 75.916602][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 75.920614][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 75.926681][ T5310] shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') [ 75.937581][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted 6.15.0-syzkaller-01599-gddddf9d64f73 #0 PREEMPT(full) [ 75.937600][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.937606][ T5310] Call Trace: [ 75.937611][ T5310] [ 75.937615][ T5310] dump_stack_lvl+0x189/0x250 [ 75.937719][ T5310] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.937729][ T5310] ? __pfx__printk+0x10/0x10 [ 75.937734][ T5310] ? stack_depot_save_flags+0x42b/0x910 [ 75.937770][ T5310] ? kasan_save_track+0x4f/0x80 [ 75.937785][ T5310] ? __kasan_kmalloc+0x93/0xb0 [ 75.937792][ T5310] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 75.937802][ T5310] ? squashfs_page_actor_init+0x59/0x1e0 [ 75.937816][ T5310] ubsan_epilogue+0xa/0x40 [ 75.937826][ T5310] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 75.937852][ T5310] squashfs_bio_read+0xeac/0x1090 [ 75.937876][ T5310] squashfs_read_data+0x1fd/0x890 [ 75.937891][ T5310] ? squashfs_page_actor_init+0x59/0x1e0 [ 75.937905][ T5310] squashfs_read_table+0x341/0x3a0 [ 75.937925][ T5310] squashfs_fill_super+0x209/0x2050 [ 75.937940][ T5310] ? set_blocksize+0x158/0x500 [ 75.937958][ T5310] ? sb_set_blocksize+0xc7/0x180 [ 75.937974][ T5310] get_tree_bdev_flags+0x40b/0x4d0 [ 75.937981][ T5310] ? __pfx_squashfs_fill_super+0x10/0x10 [ 75.937991][ T5310] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 75.938000][ T5310] vfs_get_tree+0x8f/0x2b0 [ 75.938008][ T5310] do_new_mount+0x24a/0xa40 [ 75.938020][ T5310] __se_sys_mount+0x317/0x410 [ 75.938030][ T5310] ? __pfx___se_sys_mount+0x10/0x10 [ 75.938038][ T5310] ? do_syscall_64+0xba/0x210 [ 75.938077][ T5310] ? __x64_sys_mount+0x20/0xc0 [ 75.938089][ T5310] do_syscall_64+0xf6/0x210 [ 75.938099][ T5310] ? clear_bhb_loop+0x60/0xb0 [ 75.938112][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.938123][ T5310] RIP: 0033:0x7f07f699010a [ 75.938133][ T5310] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.938140][ T5310] RSP: 002b:00007f07f2df4e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 75.938151][ T5310] RAX: ffffffffffffffda RBX: 00007f07f2df4ef0 RCX: 00007f07f699010a [ 75.938157][ T5310] RDX: 0000200000000200 RSI: 0000200000000240 RDI: 00007f07f2df4eb0 [ 75.938163][ T5310] RBP: 0000200000000200 R08: 00007f07f2df4ef0 R09: 0000000000000000 [ 75.938169][ T5310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000240 [ 75.938176][ T5310] R13: 00007f07f2df4eb0 R14: 00000000000001f0 R15: 0000200000000280 [ 75.938192][ T5310] [ 75.938197][ T5310] ---[ end trace ]--- [ 76.053994][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.058953][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.062608][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.067309][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.070870][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.075074][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.078731][ T5291] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.100092][ T5310] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 76.103144][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted 6.15.0-syzkaller-01599-gddddf9d64f73 #0 PREEMPT(full) [ 76.107694][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.112228][ T5310] Call Trace: [ 76.113654][ T5310] [ 76.114896][ T5310] dump_stack_lvl+0x99/0x250 [ 76.116788][ T5310] ? __asan_memcpy+0x40/0x70 [ 76.118968][ T5310] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.121476][ T5310] ? __pfx__printk+0x10/0x10 [ 76.123385][ T5310] panic+0x2db/0x790 [ 76.125094][ T5310] ? __pfx_panic+0x10/0x10 [ 76.126968][ T5310] ? _printk+0xcf/0x120 [ 76.128753][ T5310] ? __pfx__printk+0x10/0x10 [ 76.130618][ T5310] ? stack_depot_save_flags+0x42b/0x910 [ 76.132696][ T5310] ? kasan_save_track+0x4f/0x80 [ 76.134656][ T5310] ? __kasan_kmalloc+0x93/0xb0 [ 76.136686][ T5310] check_panic_on_warn+0x89/0xb0 [ 76.138695][ T5310] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 76.141235][ T5310] squashfs_bio_read+0xeac/0x1090 [ 76.143266][ T5310] squashfs_read_data+0x1fd/0x890 [ 76.145314][ T5310] ? squashfs_page_actor_init+0x59/0x1e0 [ 76.147676][ T5310] squashfs_read_table+0x341/0x3a0 [ 76.149804][ T5310] squashfs_fill_super+0x209/0x2050 [ 76.151891][ T5310] ? set_blocksize+0x158/0x500 [ 76.153858][ T5310] ? sb_set_blocksize+0xc7/0x180 [ 76.155905][ T5310] get_tree_bdev_flags+0x40b/0x4d0 [ 76.158018][ T5310] ? __pfx_squashfs_fill_super+0x10/0x10 [ 76.160319][ T5310] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 76.162679][ T5310] vfs_get_tree+0x8f/0x2b0 [ 76.164680][ T5310] do_new_mount+0x24a/0xa40 [ 76.166543][ T5310] __se_sys_mount+0x317/0x410 [ 76.168566][ T5310] ? __pfx___se_sys_mount+0x10/0x10 [ 76.170788][ T5310] ? do_syscall_64+0xba/0x210 [ 76.172853][ T5310] ? __x64_sys_mount+0x20/0xc0 [ 76.174869][ T5310] do_syscall_64+0xf6/0x210 [ 76.176731][ T5310] ? clear_bhb_loop+0x60/0xb0 [ 76.178716][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.181157][ T5310] RIP: 0033:0x7f07f699010a [ 76.183061][ T5310] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.191222][ T5310] RSP: 002b:00007f07f2df4e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 76.194655][ T5310] RAX: ffffffffffffffda RBX: 00007f07f2df4ef0 RCX: 00007f07f699010a [ 76.197987][ T5310] RDX: 0000200000000200 RSI: 0000200000000240 RDI: 00007f07f2df4eb0 [ 76.201331][ T5310] RBP: 0000200000000200 R08: 00007f07f2df4ef0 R09: 0000000000000000 [ 76.204688][ T5310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000240 [ 76.208233][ T5310] R13: 00007f07f2df4eb0 R14: 00000000000001f0 R15: 0000200000000280 [ 76.211728][ T5310] [ 76.213423][ T5310] Kernel Offset: disabled [ 76.215330][ T5310] Rebooting in 86400 seconds..