syz.0.0 (5318) used greatest stack depth: 14544 b[ 68.190231][ T48] Bluetooth: hci0: command tx timeout UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list loop0: detected capacity change from 0 to 64 loop0: detected capacity change from 64 to 11 Dev loop0: unable to read RDB block 11 loop0: unable to read partition table loop0: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop0 (ï5ŸA;¹8R÷ÖÑÎ])Ãî^\©) failed (rc=-5) Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:bfs_move_block fs/bfs/file.c:43 [inline] RIP: 0010:bfs_move_blocks fs/bfs/file.c:57 [inline] RIP: 0010:bfs_get_block+0xa75/0xb70 fs/bfs/file.c:126 Code: 00 41 8b 0f b8 77 7f ff ff 21 c1 81 c9 08 80 00 00 4c 89 ef 4c 89 f6 e8 a9 3d ac ff 49 89 c5 48 8d 68 28 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 dc 3a 87 ff 4c 8b 75 00 48 8d 7b RSP: 0018:ffffc9000d3e7870 EFLAGS: 00010206 RAX: 0000000000000005 RBX: ffff888052c102b8 RCX: 0000000000100000 RDX: ffffc9000e83a000 RSI: 00000000000003c3 RDI: 00000000000003c4 RBP: 0000000000000028 R08: ffffffff822f6087 R09: 1ffffd40002666ae R10: dffffc0000000000 R11: fffff940002666af R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000014 R15: ffff888031cbce68 FS: 00007f0eab3426c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc125e98e8 CR3: 0000000033b0c000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __block_write_begin_int+0x50c/0x1a70 fs/buffer.c:2116 block_write_begin+0x8f/0x120 fs/buffer.c:2226 bfs_write_begin+0x35/0xd0 fs/bfs/file.c:179 generic_perform_write+0x344/0x6d0 mm/filemap.c:4055 generic_file_write_iter+0xae/0x310 mm/filemap.c:4182 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0eaa57ff19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0eab342058 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f0eaa745fa0 RCX: 00007f0eaa57ff19 RDX: 000000000000fecc RSI: 0000000020000100 RDI: 000000000000000d RBP: 00007f0eaa5f3986 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f0eaa745fa0 R15: 00007ffdbcd27f98 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bfs_move_block fs/bfs/file.c:43 [inline] RIP: 0010:bfs_move_blocks fs/bfs/file.c:57 [inline] RIP: 0010:bfs_get_block+0xa75/0xb70 fs/bfs/file.c:126 Code: 00 41 8b 0f b8 77 7f ff ff 21 c1 81 c9 08 80 00 00 4c 89 ef 4c 89 f6 e8 a9 3d ac ff 49 89 c5 48 8d 68 28 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 dc 3a 87 ff 4c 8b 75 00 48 8d 7b RSP: 0018:ffffc9000d3e7870 EFLAGS: 00010206 RAX: 0000000000000005 RBX: ffff888052c102b8 RCX: 0000000000100000 RDX: ffffc9000e83a000 RSI: 00000000000003c3 RDI: 00000000000003c4 RBP: 0000000000000028 R08: ffffffff822f6087 R09: 1ffffd40002666ae R10: dffffc0000000000 R11: fffff940002666af R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000014 R15: ffff888031cbce68 FS: 00007f0eab3426c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0eab320fe0 CR3: 0000000033b0c000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 41 8b 0f mov (%r15),%ecx 3: b8 77 7f ff ff mov $0xffff7f77,%eax 8: 21 c1 and %eax,%ecx a: 81 c9 08 80 00 00 or $0x8008,%ecx 10: 4c 89 ef mov %r13,%rdi 13: 4c 89 f6 mov %r14,%rsi 16: e8 a9 3d ac ff call 0xffac3dc4 1b: 49 89 c5 mov %rax,%r13 1e: 48 8d 68 28 lea 0x28(%rax),%rbp 22: 48 89 e8 mov %rbp,%rax 25: 48 c1 e8 03 shr $0x3,%rax * 29: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 48 89 ef mov %rbp,%rdi 33: e8 dc 3a 87 ff call 0xff873b14 38: 4c 8b 75 00 mov 0x0(%rbp),%r14 3c: 48 rex.W 3d: 8d .byte 0x8d 3e: 7b .byte 0x7b