program: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x8, 0x7fff7ffc}]}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) (async) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) (async) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) (async, rerun: 32) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) (rerun: 32) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f00000007c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x7, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000000)='.\x02\x00', 0x4810, &(0x7f0000000180)=ANY=[], 0x3, 0x2e4, &(0x7f0000001900)="$eJzs3b9PFEEUwPE3e3dwCMEVMCSWKImVUWyMDcbwR1ioEbkzIVwwAUzERmJtjJ0/Ogs7a2NjaU+0NlpZ2UO3Zn4sLHIzu8fCLej3k9yx3M7Mvtnd231zyd0IgP/Wzbkf76/+0g8lUpOaiFwXiUSkKVIXkbMy2Xy0vLa41mm3Qg3VTA39UGJrqn1lFpbb3arqeqaGE+v/6jKSfQ1HI0mS5Oe3WrjM6b6Fg4qYd3/GoPsb2cW6uPXNSqI7fBtVB1AxtS3b8lhGq44DAFAtff9v2MRf3+dHXP4eRSLT7rZ/wu7/4ax1u3+BHEuZ+78ZZSVKH1+zy9TueM8M4fT6KB0lBlr0rhkQm0juSTBVzqjSNhcNPVjstC8tPOy0Inkms06m3IR5btlTN5UT7VQg2C7y++5jehw1dB9mPPGPH2SLr3oPZcdWojbVXRXLW2nt5H/1xOwRc6RiE3e8U8HGf9nf4rB+UsqU8vTyjNnIObcF+fShQC+b4h2WDrg27an71L4Yp3G+HAjUGpO9HyvY3l3x987UGu9aayan1kS2lrtyurPZX/PgPN3+i3qhbqkp+S0fZS6T/0d6b0+bAuluDwSpTEl3ZgT7Uzcl4wKBRYXCR1GN4Nrncl+uyejq+pOl+U6nvVJ04fP3Hgof1sKbd3ahVqadtOf7VtWlbISJ+7jkqHZC+QiLLKQnTB8PbnpM+n5GVbwgpdupyaAspdfMQwvMHY6NpfmOXeqeKA2VuS7hGMlcHidvVx0MqqCvIcqO/0wmb7O6G2adfvvHJk9vSLc8Pclr3LT4+s6mHT5kxga7yeqYeT7V0whu2D+Cy/QhOOY6f1HkQmCLX/Y2G7s4/xFqTr7KPT7/BwAAAAAAAAAAAAAAAAAAOGlyvxiwlaysrqe/BlLuizcAAAAAAAAAAAAAAAAAAAAAAOBgQvP/mjkyc+b/Tb8Z4J//N/Or3vnz/87qhjzz/4YnqQXQsz8BAAD//wZ3b1g=") r6 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r6, &(0x7f0000000200)=""/55, 0x37) (async) connect$rose(r5, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @null}, 0x1c) (async, rerun: 32) connect$rose(r5, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) (async, rerun: 32) fcntl$addseals(r2, 0x409, 0x9) (async) syz_mount_image$squashfs(&(0x7f0000000040), &(0x7f0000000240)='./file2\x00', 0x800, &(0x7f0000000440)=ANY=[], 0x1, 0x1d0, &(0x7f0000001ec0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfIFoPRCKF1xS3vdmlN+Z0566motk2VmaPXUlkcWk0vtMXKTXMwjwcwQmnpkUXFlVXZiTk5qUTELQ8WtJRtOB55gYLluf02lWYLT4Y88h0OSpoMO0xEfj6wZjSWck6Q0xdjYMhXOnrnOwMCgcYTh0QrmjXWeeY11halT89LykqqyqrLmTZy4cWZjZ2Pjyol1UWl+qxhbUlw2NXUyMjlsURPYzGyoPslGe8K79lUPkxxYezz8mvczMDCkMl8yXlgkdWpF1cwJX5T+MBp+Z7jDU7ZCQkPDSeKKhEWDCcOROvYGV4aKW8kpDQxpCmGMSWpsYm1bzswJYeZnc1sAClGm0KMcS2dKWBwQqjr501LzrUOi24xtTx3YzvAcPs6zpqBP0Oi4BIPTQsH/MiBjEhoayjTWMi21XfClSOOvhBcng1MGg7s907JmaECyNIDIlVCeLFhPQvIKDx1NTaOU5ISGTbFfGBgKDJUZtu7hXC3QwIAUbSoMDAzbGWFxCwHXYIxRMApGwSgYBaNgFIyCUTAKRsEoGAUjAgACAAD//9Jwk6s=") (async, rerun: 64) close_range(r0, 0xffffffffffffffff, 0x0) (rerun: 64) [ 75.784148][ T4687] Bluetooth: hci0: command tx timeout [ 75.911219][ T5340] loop0: detected capacity change from 0 to 64 [ 75.999725][ T5342] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 76.004988][ T5342] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 76.008692][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.012463][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.016854][ T5342] RIP: 0010:rose_transmit_link+0x32/0x740 [ 76.019387][ T5342] Code: 56 41 55 41 54 53 48 83 ec 18 48 89 f5 49 89 fc 49 be 00 00 00 00 00 fc ff df e8 79 8a 74 f7 4c 8d 7d 36 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 6e 05 00 00 41 0f b6 1f 31 ff 89 de e8 [ 76.027183][ T5342] RSP: 0018:ffffc9000a5977d0 EFLAGS: 00010207 [ 76.029632][ T5342] RAX: 0000000000000006 RBX: 0000000000000000 RCX: ffff8880003a8000 [ 76.033086][ T5342] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888042e43500 [ 76.036331][ T5342] RBP: 0000000000000000 R08: ffff8880003a8000 R09: 0000000000000008 [ 76.039559][ T5342] R10: 000000000000000f R11: 0000000000000000 R12: ffff888042e43500 [ 76.042768][ T5342] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000036 [ 76.046143][ T5342] FS: 0000000000000000(0000) GS:ffff88808d414000(0000) knlGS:0000000000000000 [ 76.049954][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.052677][ T5342] CR2: 000056060dbe6008 CR3: 0000000037e6f000 CR4: 0000000000352ef0 [ 76.055939][ T5342] Call Trace: [ 76.057397][ T5342] [ 76.058643][ T5342] ? skb_put+0x11b/0x210 [ 76.060481][ T5342] rose_write_internal+0x11dc/0x1ac0 [ 76.062699][ T5342] ? __pfx_rose_write_internal+0x10/0x10 [ 76.065047][ T5342] ? __timer_delete+0x5d/0x390 [ 76.067080][ T5342] rose_release+0x25b/0x510 [ 76.069014][ T5342] sock_close+0xc3/0x240 [ 76.070844][ T5342] ? __pfx_sock_close+0x10/0x10 [ 76.072867][ T5342] __fput+0x44c/0xa70 [ 76.074689][ T5342] task_work_run+0x1d4/0x260 [ 76.076668][ T5342] ? __pfx_task_work_run+0x10/0x10 [ 76.078826][ T5342] ? kmem_cache_free+0x197/0x620 [ 76.080753][ T5342] ? do_exit+0x68f/0x22f0 [ 76.082593][ T5342] do_exit+0x694/0x22f0 [ 76.084368][ T5342] ? count_memcg_event_mm+0x21/0x260 [ 76.086511][ T5342] ? __pfx_do_exit+0x10/0x10 [ 76.088430][ T5342] do_group_exit+0x21c/0x2d0 [ 76.090351][ T5342] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.092507][ T5342] get_signal+0x1285/0x1340 [ 76.094192][ T5342] arch_do_signal_or_restart+0x9a/0x7a0 [ 76.096258][ T5342] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 76.098601][ T5342] ? do_user_addr_fault+0xc85/0x1380 [ 76.100763][ T5342] irqentry_exit+0x178/0x670 [ 76.102605][ T5342] ? trace_irq_disable+0x37/0x100 [ 76.104593][ T5342] asm_exc_page_fault+0x26/0x30 [ 76.106606][ T5342] RIP: 0033:0x7f958f450943 [ 76.108450][ T5342] Code: Unable to access opcode bytes at 0x7f958f450919. [ 76.111381][ T5342] RSP: 002b:00007f958b9d34a0 EFLAGS: 00010202 [ 76.113951][ T5342] RAX: 0000000000000000 RBX: 00007f958f910020 RCX: 00007f9583400000 [ 76.117306][ T5342] RDX: 00007f958f9100a0 RSI: 0000000000000005 RDI: 00007f958b9d35e0 [ 76.120645][ T5342] RBP: 00007f958b9d35e0 R08: 0000000000000008 R09: 0000000000000000 [ 76.123862][ T5342] R10: 0000000000000030 R11: 00007f958f910020 R12: 000000000000002a [ 76.127119][ T5342] R13: 00007f958f62fc40 R14: 0000000000000068 R15: 00007f958b9d35e0 [ 76.130406][ T5342] [ 76.131828][ T5342] Modules linked in: [ 76.134016][ T5342] ---[ end trace 0000000000000000 ]--- [ 76.181093][ T5342] RIP: 0010:rose_transmit_link+0x32/0x740 [ 76.183466][ T5342] Code: 56 41 55 41 54 53 48 83 ec 18 48 89 f5 49 89 fc 49 be 00 00 00 00 00 fc ff df e8 79 8a 74 f7 4c 8d 7d 36 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 6e 05 00 00 41 0f b6 1f 31 ff 89 de e8 [ 76.192387][ T5342] RSP: 0018:ffffc9000a5977d0 EFLAGS: 00010207 [ 76.195880][ T5342] RAX: 0000000000000006 RBX: 0000000000000000 RCX: ffff8880003a8000 [ 76.199111][ T5342] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888042e43500 [ 76.203159][ T5342] RBP: 0000000000000000 R08: ffff8880003a8000 R09: 0000000000000008 [ 76.211018][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.213980][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.217624][ T5342] R10: 000000000000000f R11: 0000000000000000 R12: ffff888042e43500 [ 76.220688][ T5342] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000036 [ 76.224489][ T5342] FS: 0000000000000000(0000) GS:ffff88808d414000(0000) knlGS:0000000000000000 [ 76.228370][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.231064][ T5342] CR2: 000056062993d168 CR3: 000000001131f000 CR4: 0000000000352ef0 [ 76.235195][ T5342] Kernel panic - not syncing: Fatal exception [ 76.237991][ T5342] Kernel Offset: disabled [ 76.239781][ T5342] Rebooting in 86400 seconds..