program:
syz_mount_image$hfs(&(0x7f0000000140), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x8b, 0x2b9, &(0x7f0000000700)="$eJzs3T9v00AYx/Hf2WmS0lIMLUJCDKhQwYTasiCWSqjiNbCAgCZIFVErSpGAhYgZ8QLYWXgBvAgmhMQMExMvoJvROZfm3Nhxk6p2K74fKY1j35/nHMe+J1JqAfhv3Vv/9fn2H/swUqhQ0l0psJuuqibpoi41X23tbu522q1RDYVSU8nDSElNM1RmY6udVdXWS2o4kX1V06y/DscjjuP4d9VBoEpN9xxmbQykhvt0hn7h02TqwOtuKHUriuWkMHva02vNVR0HAKBapnd9D9x1ftbN34NAWnKXff/6//NsxfEezQ3tVR1Cxbzrf5Jlxca+v+eSTYN8L0nh7PagnyWO24+dPNbVO7JSE0yTziqHk8UklmD62WanfWtju9MK9F5rjldsQdKaWi5ndVLRDje9mLEura681sYyk4xhyo5hNSf++axOJ++xmPlmvptHJtIntfbnf7XY+GN279T9qUH8y3nNbb94aJ+jXqmcUZ5POrmc3rEjRxnmZSRyeyoOlf6CIErHWc+sVdeBWr3RreT15NqZz6y1WlBrwdb64tUaHM35NY+b+WgemEX91Vete/P/wO7tJQ1/MrMbSUq6I6M/nszcsJaUjPxV3SuZbQaTjQdjGOzjD3qqO5p7+ebt8yedTnun7AUbQ+mdstBb6B8EJyWeyRbsOdZfo6i9Uyun9/qRd11TRWUafuH0SA8u9D/Wh+i9f5IujLDkMxMqMXjT88u8KzMglM2ePEwv//PyleUkRbJ/ohHz9Lho2ua1uJKRGzT2C57xWjLu+/n8DGgmM4Praoyc69pN6bq3siDninRBmh451tPErOuHHvP9PwAAAAAAAAAAAAAAAAAAwGlTxq81vO74jz4AAAAAAAAAAAAAAAAAAAAAAEwg//6/TR3j/X9TvwM49P1/G0cYKIAh/wIAAP//7nlzRQ==")
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0)
syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file1\x00', 0x50, &(0x7f0000000280), 0x1, 0x3dd, &(0x7f00000008c0)="$eJzs3M1uG0UcAPD/bj5K0g8HiQMqHCyBIAiI60CAIiQKVz4uwANYSVoq3KZqjERLDgVx4sQBcePQF+DAA1QVQkLiFXgBVKlCaQ5wC1p713FjO8SKHdPk95NGnlmPO/Pf3a5mNrsTwLFVjogLETEREYsRUcq3p3mKW62U1XuwubG8tbmxnMT29kd/JZHk24p/K8k/T+aF+TQi/SbiqVvd7a7fuPlZrV5fvZ6XK40r1yrrN26+fPlK7dLqpdWr1dfPV6tLi29UXx1arD88+8L5iXcvnP3xj9Ldpenpmay/p/LvOuMYlnKU2/tkt6VhNzZm0+PuAAAA+5LmY//J5vi/FBPNXEspKhtj7RwAAAAwFNtv558AAADAEZaY+wMAAMARVzwH8GBzY7lIY3wc4dDdfyci5nbebd5qxz8Zj+V1pkb4fms5Iq49l5SyFCN6DxkAoNPdbPxzrtf4L40nO+qdiGiOh2aG3H55V7l7/JPeG3KTD8nGf29FxFbX+C8tqsxN5KXTzaHiVHLxcn31XESciYj5mDqRlat7tPHe3z992O+7LP5fk9NnipS1n33u1EjvTZ54+DcrtUbtIDF3uv9VxNnJXvEn7fFvEhGzB2hj4svbb/b77r/jH63t2xHP9zz+Oyv3JHuvT1Rpng+V4qzo9s/XP3/Qr/1xx58d/9m9459LOtdrWh+8jTuf/v50M9Mjqs75zyDn/3TycTNfzMu+qDUa16sR08n73dsXd35blIv6Wfzzz/T+/19c/5J8TatT+TVgUN9+98tLe9doxZ+lrP1iLngYsvhXBjr+g2deu/PbJ/3a7zz+vePPjn9rDbD5fMt+rn/77eBB9h0AAAA8KtLmfY0kXWjn03RhoXW/44mYTetr640XL659fnWldf9jLqbS4k5XqeN+aLX1Z/R2eXFX+ZWIeDwivi/NNMsLy2v1lXEHDwAAAMfEyT7z/8yfh/YUAgAAADByc+PuAAAAADBy5v8AAABwpB1kXb/jm8n23P+gGzIyI8uM+8oEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwaPs3AAD//9oMtCQ=")
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
rename(&(0x7f0000000040)='./file1\x00', &(0x7f0000000180)='./file0/file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000004240)=0x40000008, 0x4)
recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0), 0x8)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x83, 0x0)
[ 68.691713][ T4669] Bluetooth: hci0: command tx timeout
[ 68.716312][ T5330] loop0: detected capacity change from 0 to 64
[ 68.809602][ T5330] ==================================================================
[ 68.812636][ T5330] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read+0x16a/0x200
[ 68.815574][ T5330] Write of size 94 at addr ffff888040c8d580 by task syz.0.0/5330
[ 68.818597][ T5330]
[ 68.819573][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
[ 68.819588][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 68.819597][ T5330] Call Trace:
[ 68.819604][ T5330]
[ 68.819609][ T5330] dump_stack_lvl+0x241/0x360
[ 68.819631][ T5330] ? __pfx_dump_stack_lvl+0x10/0x10
[ 68.819646][ T5330] ? rcu_is_watching+0x15/0xb0
[ 68.819662][ T5330] ? __virt_addr_valid+0x183/0x530
[ 68.819678][ T5330] ? lock_release+0x4e/0x3e0
[ 68.819715][ T5330] ? __virt_addr_valid+0x183/0x530
[ 68.819731][ T5330] ? __virt_addr_valid+0x183/0x530
[ 68.819748][ T5330] print_report+0x16e/0x5b0
[ 68.819765][ T5330] ? __virt_addr_valid+0x183/0x530
[ 68.819780][ T5330] ? __virt_addr_valid+0x183/0x530
[ 68.819796][ T5330] ? __virt_addr_valid+0x45f/0x530
[ 68.819811][ T5330] ? __phys_addr+0xba/0x170
[ 68.819827][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 68.819838][ T5330] kasan_report+0x143/0x180
[ 68.819854][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 68.819868][ T5330] kasan_check_range+0x28f/0x2a0
[ 68.819884][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 68.819894][ T5330] __asan_memcpy+0x40/0x70
[ 68.819907][ T5330] hfs_bnode_read+0x16a/0x200
[ 68.819919][ T5330] hfs_bnode_read_key+0x174/0x240
[ 68.819930][ T5330] ? __pfx_hfs_bnode_read_key+0x10/0x10
[ 68.819941][ T5330] ? do_raw_spin_unlock+0x58/0x8b0
[ 68.819958][ T5330] hfs_brec_insert+0x7f7/0xbe0
[ 68.819976][ T5330] ? __pfx_hfs_brec_insert+0x10/0x10
[ 68.819990][ T5330] hfs_cat_create+0x3de/0x760
[ 68.820005][ T5330] ? __pfx_hfs_cat_create+0x10/0x10
[ 68.820022][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 68.820070][ T5330] ? hfs_new_inode+0x8df/0xba0
[ 68.820087][ T5330] hfs_mkdir+0x6c/0xe0
[ 68.820101][ T5330] vfs_mkdir+0x2f9/0x500
[ 68.820128][ T5330] do_mkdirat+0x273/0x3f0
[ 68.820143][ T5330] ? __pfx_do_mkdirat+0x10/0x10
[ 68.820157][ T5330] ? getname_flags+0x1e2/0x530
[ 68.820176][ T5330] __x64_sys_mkdirat+0x87/0xa0
[ 68.820191][ T5330] do_syscall_64+0xf3/0x230
[ 68.820206][ T5330] ? clear_bhb_loop+0x45/0xa0
[ 68.820218][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.820232][ T5330] RIP: 0033:0x7f625d58d169
[ 68.820244][ T5330] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 68.820255][ T5330] RSP: 002b:00007f625e330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 68.820269][ T5330] RAX: ffffffffffffffda RBX: 00007f625d7a5fa0 RCX: 00007f625d58d169
[ 68.820277][ T5330] RDX: 0000000000000000 RSI: 0000200000000340 RDI: ffffffffffffff9c
[ 68.820286][ T5330] RBP: 00007f625d60e990 R08: 0000000000000000 R09: 0000000000000000
[ 68.820294][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 68.820301][ T5330] R13: 0000000000000000 R14: 00007f625d7a5fa0 R15: 00007ffc331e09d8
[ 68.820313][ T5330]
[ 68.820318][ T5330]
[ 68.933682][ T5330] Allocated by task 5330:
[ 68.935462][ T5330] kasan_save_track+0x3f/0x80
[ 68.937242][ T5330] __kasan_kmalloc+0x9d/0xb0
[ 68.938971][ T5330] __kmalloc_noprof+0x28e/0x4d0
[ 68.940867][ T5330] hfs_find_init+0x92/0x1f0
[ 68.942776][ T5330] hfs_cat_create+0x181/0x760
[ 68.944736][ T5330] hfs_mkdir+0x6c/0xe0
[ 68.946266][ T5330] vfs_mkdir+0x2f9/0x500
[ 68.947932][ T5330] do_mkdirat+0x273/0x3f0
[ 68.949664][ T5330] __x64_sys_mkdirat+0x87/0xa0
[ 68.951451][ T5330] do_syscall_64+0xf3/0x230
[ 68.953183][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.955446][ T5330]
[ 68.956449][ T5330] The buggy address belongs to the object at ffff888040c8d580
[ 68.956449][ T5330] which belongs to the cache kmalloc-96 of size 96
[ 68.961775][ T5330] The buggy address is located 0 bytes inside of
[ 68.961775][ T5330] allocated 78-byte region [ffff888040c8d580, ffff888040c8d5ce)
[ 68.966918][ T5330]
[ 68.967929][ T5330] The buggy address belongs to the physical page:
[ 68.970404][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40c8d
[ 68.973706][ T5330] anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 68.976629][ T5330] page_type: f5(slab)
[ 68.978200][ T5330] raw: 04fff00000000000 ffff88801b041280 0000000000000000 dead000000000001
[ 68.981422][ T5330] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[ 68.984710][ T5330] page dumped because: kasan: bad access detected
[ 68.987181][ T5330] page_owner tracks the page as allocated
[ 68.989400][ T5330] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 13, tgid 13 (kworker/u4:1), ts 68760525990, free_ts 66959831648
[ 68.996399][ T5330] post_alloc_hook+0x1f4/0x240
[ 68.998235][ T5330] get_page_from_freelist+0x352b/0x36c0
[ 69.000328][ T5330] __alloc_frozen_pages_noprof+0x211/0x5b0
[ 69.002508][ T5330] allocate_slab+0x66/0x3a0
[ 69.004345][ T5330] ___slab_alloc+0xc3b/0x1500
[ 69.006133][ T5330] __slab_alloc+0x58/0xa0
[ 69.007999][ T5330] __kmalloc_node_noprof+0x2f4/0x4d0
[ 69.010139][ T5330] allocate_slab+0x179/0x3a0
[ 69.012046][ T5330] ___slab_alloc+0xc3b/0x1500
[ 69.013847][ T5330] __slab_alloc+0x58/0xa0
[ 69.015521][ T5330] kmem_cache_alloc_noprof+0x270/0x390
[ 69.017610][ T5330] dst_alloc+0x12b/0x190
[ 69.019173][ T5330] icmp6_dst_alloc+0x77/0x420
[ 69.021050][ T5330] mld_sendpack+0x6aa/0xdc0
[ 69.022748][ T5330] ipv6_mc_dad_complete+0x88/0x490
[ 69.024775][ T5330] addrconf_dad_completed+0x714/0xcd0
[ 69.026821][ T5330] page last free pid 5323 tgid 5323 stack trace:
[ 69.029396][ T5330] __free_frozen_pages+0xde8/0x10a0
[ 69.031371][ T5330] __slab_free+0x2c6/0x390
[ 69.033103][ T5330] qlist_free_all+0x9a/0x140
[ 69.034872][ T5330] kasan_quarantine_reduce+0x14f/0x170
[ 69.036951][ T5330] __kasan_slab_alloc+0x23/0x80
[ 69.038884][ T5330] kmem_cache_alloc_noprof+0x1e1/0x390
[ 69.041160][ T5330] getname_flags+0xb6/0x530
[ 69.042952][ T5330] do_sys_openat2+0xbf/0x1d0
[ 69.044772][ T5330] __x64_sys_openat+0x249/0x2a0
[ 69.046618][ T5330] do_syscall_64+0xf3/0x230
[ 69.048377][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.050512][ T5330]
[ 69.051424][ T5330] Memory state around the buggy address:
[ 69.053555][ T5330] ffff888040c8d480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 69.056524][ T5330] ffff888040c8d500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 69.059496][ T5330] >ffff888040c8d580: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[ 69.062462][ T5330] ^
[ 69.064913][ T5330] ffff888040c8d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 69.067900][ T5330] ffff888040c8d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 69.070919][ T5330] ==================================================================
[ 69.091164][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 69.094084][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
[ 69.098645][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.102875][ T5330] Call Trace:
[ 69.104250][ T5330]
[ 69.105470][ T5330] dump_stack_lvl+0x241/0x360
[ 69.107333][ T5330] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.109394][ T5330] ? __pfx__printk+0x10/0x10
[ 69.111187][ T5330] ? vscnprintf+0x5d/0x90
[ 69.112888][ T5330] panic+0x349/0x880
[ 69.114392][ T5330] ? check_panic_on_warn+0x21/0xb0
[ 69.116210][ T5330] ? __pfx_panic+0x10/0x10
[ 69.117952][ T5330] ? _raw_spin_unlock_irqrestore+0x134/0x140
[ 69.120344][ T5330] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 69.122801][ T5330] ? print_report+0x519/0x5b0
[ 69.124474][ T5330] check_panic_on_warn+0x86/0xb0
[ 69.126313][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 69.128143][ T5330] end_report+0x77/0x160
[ 69.129794][ T5330] kasan_report+0x154/0x180
[ 69.131532][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 69.133472][ T5330] kasan_check_range+0x28f/0x2a0
[ 69.135361][ T5330] ? hfs_bnode_read+0x16a/0x200
[ 69.137260][ T5330] __asan_memcpy+0x40/0x70
[ 69.138927][ T5330] hfs_bnode_read+0x16a/0x200
[ 69.140704][ T5330] hfs_bnode_read_key+0x174/0x240
[ 69.142678][ T5330] ? __pfx_hfs_bnode_read_key+0x10/0x10
[ 69.144783][ T5330] ? do_raw_spin_unlock+0x58/0x8b0
[ 69.146740][ T5330] hfs_brec_insert+0x7f7/0xbe0
[ 69.148576][ T5330] ? __pfx_hfs_brec_insert+0x10/0x10
[ 69.150674][ T5330] hfs_cat_create+0x3de/0x760
[ 69.152495][ T5330] ? __pfx_hfs_cat_create+0x10/0x10
[ 69.154436][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 69.156378][ T5330] ? hfs_new_inode+0x8df/0xba0
[ 69.158229][ T5330] hfs_mkdir+0x6c/0xe0
[ 69.159721][ T5330] vfs_mkdir+0x2f9/0x500
[ 69.161334][ T5330] do_mkdirat+0x273/0x3f0
[ 69.163063][ T5330] ? __pfx_do_mkdirat+0x10/0x10
[ 69.164994][ T5330] ? getname_flags+0x1e2/0x530
[ 69.166794][ T5330] __x64_sys_mkdirat+0x87/0xa0
[ 69.168675][ T5330] do_syscall_64+0xf3/0x230
[ 69.170417][ T5330] ? clear_bhb_loop+0x45/0xa0
[ 69.172113][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.174322][ T5330] RIP: 0033:0x7f625d58d169
[ 69.176032][ T5330] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 69.183175][ T5330] RSP: 002b:00007f625e330038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 69.186673][ T5330] RAX: ffffffffffffffda RBX: 00007f625d7a5fa0 RCX: 00007f625d58d169
[ 69.189406][ T5330] RDX: 0000000000000000 RSI: 0000200000000340 RDI: ffffffffffffff9c
[ 69.192340][ T5330] RBP: 00007f625d60e990 R08: 0000000000000000 R09: 0000000000000000
[ 69.195436][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 69.198396][ T5330] R13: 0000000000000000 R14: 00007f625d7a5fa0 R15: 00007ffc331e09d8
[ 69.201535][ T5330]
[ 69.203115][ T5330] Kernel Offset: disabled
[ 69.204911][ T5330] Rebooting in 86400 seconds..