program: openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000091fd5724d5cb9f12ae30829c6a272f00000000002acc5efd03000000000000000000"], 0x96) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg$inet(r2, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000002dc0)="46798883787253b0caa0c08bd60674662bf97a9cffc1100362360ba9303d93c27f101f990c7b50713d1006a9e41f5cc2a90be150b4d0b41b1c5a69a05468c6d4ae6747c83fc0aedea2564c5b5c4fc3162d2bae0edbb0d3efe08b9885f57dc43a44dc61aa9b64367bc6631f07f66747766c26b5cfb027a8560364e8095180549d5432a608ac7d166e87031969429ef9367ebcca57ab533019cde8d045ca1f69ebecb93b0e1e0acc7ccedc7ac65b0e14d8454d3efed95d9151f25a540b96bcb659a9593afc38b66fb362f548264a544f9cc4ac74c98a48c4c372763b84cb59240261f5c62f2719ba14f2d6e537f0556b793ff9c067020b9041b3c5aa1a606e381219f2762b9ab55277a9d8764f2d8ef10334bd4211e41431faa8a58cd122bd53b3b43340d9d2545642e386fb3f966b7364c2b842ae336fedfc941f479e024d5f795ead5c559abbfe4e5a8aaabf140dfb7231a4d5c8de7bf97b31b0c5a1453bde4b4b4014455adb248c86bde77671be3ea6f72d74e7f129699b512b117f917fedcdfe21bfc25b94a3ea217514d5208d48203bd0797297db3bfd391853a787b76f2ea0f13492e71671ac9a48c66002b853bb4d7fdeba5b972ea30182e86a618197e0648e9fdb575940c69571f096bfae5ae18c60f3d2041e4bcbd4ccb1af229f7fc4b1a5c1006e340af6cdaf7b876b60da879edcdee201c5882b0b42cce4a0744a1f21b494e66f2b6e64368c1e78a1d6e61e1fa3f5a568f8fa11a522828ad2e4ab7350c563a275f86d26dfabbdbe931b72d7c0cced8160ecd888ed7c4220612b979bf3239c273c1f1b501396adf2e66084d88df29083c66bedc7c70dfa0b338fd742ecb9284e3a312cc41cf23c9ca7baa10a44c6dd13066bde87c2916618b40581beb716c78062429ba7ab58d4f69eee4196d9df7173920fb0c0458a16683de762f788", 0x2a1}], 0x1}}], 0x2, 0x0) (async, rerun: 64) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="7638300c000000000000e9000000", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r4 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x80000) (async) r5 = socket(0x2, 0x1, 0x0) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r4, 0xab00, r5) (async) ioctl$NBD_DO_IT(r6, 0xab03) (async) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x100000000) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000080)='udf\x00', 0x2008087, 0x0) (async, rerun: 32) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, &(0x7f0000000180)) (rerun: 32) [ 75.159446][ T47] Bluetooth: hci0: command tx timeout [ 75.332534][ T47] block nbd0: Receive control failed (result -107) [ 75.365825][ T5322] ------------[ cut here ]------------ [ 75.368443][ T5322] WARNING: CPU: 0 PID: 5322 at fs/buffer.c:1125 bdev_getblk+0x580/0x660 [ 75.372426][ T5322] Modules linked in: [ 75.374292][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.378008][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.383040][ T5322] RIP: 0010:bdev_getblk+0x580/0x660 [ 75.385396][ T5322] Code: 26 fb ff ff e8 d1 9e 75 ff 48 c7 c7 a0 28 7a 8b 48 c7 c6 88 13 76 8d 4c 89 fa 4c 89 e9 e8 68 1a dd fe eb bd e8 b1 9e 75 ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 48 89 [ 75.394149][ T5322] RSP: 0018:ffffc9000d4df670 EFLAGS: 00010293 [ 75.396707][ T5322] RAX: ffffffff824a777f RBX: ffff888031d85098 RCX: ffff88803ee40000 [ 75.400323][ T5322] RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000 [ 75.403692][ T5322] RBP: 0000000000000200 R08: 0000000000000000 R09: ffffffff8219626d [ 75.407023][ T5322] R10: 0000000000000406 R11: 0000000000000000 R12: ffff888031d859f0 [ 75.410574][ T5322] R13: ffff888031d85080 R14: 0000000000000200 R15: 1ffff110063b0a13 [ 75.413924][ T5322] FS: 00007f692e9a56c0(0000) GS:ffff88808d732000(0000) knlGS:0000000000000000 [ 75.417739][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.420658][ T5322] CR2: 00007effe6957d00 CR3: 0000000041ccf000 CR4: 0000000000352ef0 [ 75.423978][ T5322] Call Trace: [ 75.425428][ T5322] [ 75.426693][ T5322] __bread_gfp+0x89/0x3c0 [ 75.428520][ T5322] udf_read_tagged+0xad/0xe00 [ 75.430675][ T5322] ? udf_check_anchor_block+0x80/0x550 [ 75.432975][ T5322] udf_check_anchor_block+0x99/0x550 [ 75.435143][ T5322] ? __phys_addr+0xd3/0x180 [ 75.437185][ T5322] ? udf_get_last_block+0x286/0x360 [ 75.439262][ T5322] ? __pfx_udf_check_anchor_block+0x10/0x10 [ 75.441745][ T5322] ? __bread_gfp+0x340/0x3c0 [ 75.443765][ T5322] udf_load_vrs+0x6e3/0xf20 [ 75.446151][ T5322] ? __pfx_udf_load_vrs+0x10/0x10 [ 75.448400][ T5322] ? udf_get_last_session+0x100/0x200 [ 75.451510][ T5322] ? __pfx_udf_get_last_session+0x10/0x10 [ 75.454486][ T5322] udf_fill_super+0x5ad/0x17a0 [ 75.456619][ T5322] ? __pfx_udf_fill_super+0x10/0x10 [ 75.458926][ T5322] ? set_blocksize+0x21e/0x500 [ 75.461137][ T5322] ? sb_set_blocksize+0x104/0x180 [ 75.463252][ T5322] ? setup_bdev_super+0x4c1/0x5b0 [ 75.465343][ T5322] get_tree_bdev_flags+0x40e/0x4d0 [ 75.467422][ T5322] ? __pfx_udf_fill_super+0x10/0x10 [ 75.469560][ T5322] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 75.471797][ T5322] vfs_get_tree+0x92/0x2b0 [ 75.473529][ T5322] do_new_mount+0x302/0xa10 [ 75.475310][ T5322] ? apparmor_capable+0x137/0x1b0 [ 75.477332][ T5322] ? __pfx_do_new_mount+0x10/0x10 [ 75.479253][ T5322] ? ns_capable+0x8a/0xf0 [ 75.481049][ T5322] ? kmem_cache_free+0x19b/0x690 [ 75.482950][ T5322] __se_sys_mount+0x313/0x410 [ 75.485024][ T5322] ? __pfx___se_sys_mount+0x10/0x10 [ 75.487094][ T5322] ? do_syscall_64+0xbe/0xfa0 [ 75.489060][ T5322] ? __x64_sys_mount+0x20/0xc0 [ 75.491180][ T5322] do_syscall_64+0xfa/0xfa0 [ 75.493189][ T5322] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.495387][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.498123][ T5322] ? clear_bhb_loop+0x60/0xb0 [ 75.500422][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.502878][ T5322] RIP: 0033:0x7f692db8f6c9 [ 75.504811][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.512971][ T5322] RSP: 002b:00007f692e9a5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 75.516259][ T5322] RAX: ffffffffffffffda RBX: 00007f692dde5fa0 RCX: 00007f692db8f6c9 [ 75.519571][ T5322] RDX: 0000200000000080 RSI: 0000200000004a00 RDI: 0000200000000000 [ 75.522786][ T5322] RBP: 00007f692dc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 75.526019][ T5322] R10: 0000000002008087 R11: 0000000000000246 R12: 0000000000000000 [ 75.529928][ T5322] R13: 00007f692dde6038 R14: 00007f692dde5fa0 R15: 00007ffddbb88a18 [ 75.532781][ T5322] [ 75.533993][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 75.536928][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.540576][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.545125][ T5322] Call Trace: [ 75.546501][ T5322] [ 75.547681][ T5322] dump_stack_lvl+0x99/0x250 [ 75.549474][ T5322] ? __asan_memcpy+0x40/0x70 [ 75.551316][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.553484][ T5322] ? __pfx__printk+0x10/0x10 [ 75.555414][ T5322] vpanic+0x237/0x6d0 [ 75.556836][ T5322] ? __pfx_vpanic+0x10/0x10 [ 75.558562][ T5322] panic+0xb9/0xc0 [ 75.560067][ T5322] ? __pfx_panic+0x10/0x10 [ 75.561862][ T5322] __warn+0x31b/0x4b0 [ 75.563407][ T5322] ? bdev_getblk+0x580/0x660 [ 75.565167][ T5322] ? bdev_getblk+0x580/0x660 [ 75.566985][ T5322] report_bug+0x2be/0x4f0 [ 75.568726][ T5322] ? bdev_getblk+0x580/0x660 [ 75.570535][ T5322] ? bdev_getblk+0x580/0x660 [ 75.572317][ T5322] ? bdev_getblk+0x582/0x660 [ 75.574274][ T5322] handle_bug+0x84/0x160 [ 75.575775][ T5322] exc_invalid_op+0x1a/0x50 [ 75.577317][ T5322] asm_exc_invalid_op+0x1a/0x20 [ 75.579081][ T5322] RIP: 0010:bdev_getblk+0x580/0x660 [ 75.581037][ T5322] Code: 26 fb ff ff e8 d1 9e 75 ff 48 c7 c7 a0 28 7a 8b 48 c7 c6 88 13 76 8d 4c 89 fa 4c 89 e9 e8 68 1a dd fe eb bd e8 b1 9e 75 ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 48 89 [ 75.587816][ T5322] RSP: 0018:ffffc9000d4df670 EFLAGS: 00010293 [ 75.589933][ T5322] RAX: ffffffff824a777f RBX: ffff888031d85098 RCX: ffff88803ee40000 [ 75.592735][ T5322] RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000 [ 75.595463][ T5322] RBP: 0000000000000200 R08: 0000000000000000 R09: ffffffff8219626d [ 75.598510][ T5322] R10: 0000000000000406 R11: 0000000000000000 R12: ffff888031d859f0 [ 75.601215][ T5322] R13: ffff888031d85080 R14: 0000000000000200 R15: 1ffff110063b0a13 [ 75.604127][ T5322] ? fs_reclaim_acquire+0x7d/0x100 [ 75.606145][ T5322] ? bdev_getblk+0x57f/0x660 [ 75.607838][ T5322] __bread_gfp+0x89/0x3c0 [ 75.609497][ T5322] udf_read_tagged+0xad/0xe00 [ 75.611330][ T5322] ? udf_check_anchor_block+0x80/0x550 [ 75.613660][ T5322] udf_check_anchor_block+0x99/0x550 [ 75.615754][ T5322] ? __phys_addr+0xd3/0x180 [ 75.617762][ T5322] ? udf_get_last_block+0x286/0x360 [ 75.619802][ T5322] ? __pfx_udf_check_anchor_block+0x10/0x10 [ 75.622188][ T5322] ? __bread_gfp+0x340/0x3c0 [ 75.624108][ T5322] udf_load_vrs+0x6e3/0xf20 [ 75.626023][ T5322] ? __pfx_udf_load_vrs+0x10/0x10 [ 75.628040][ T5322] ? udf_get_last_session+0x100/0x200 [ 75.630074][ T5322] ? __pfx_udf_get_last_session+0x10/0x10 [ 75.632045][ T5322] udf_fill_super+0x5ad/0x17a0 [ 75.634287][ T5322] ? __pfx_udf_fill_super+0x10/0x10 [ 75.636691][ T5322] ? set_blocksize+0x21e/0x500 [ 75.639052][ T5322] ? sb_set_blocksize+0x104/0x180 [ 75.640896][ T5322] ? setup_bdev_super+0x4c1/0x5b0 [ 75.642475][ T5322] get_tree_bdev_flags+0x40e/0x4d0 [ 75.644107][ T5322] ? __pfx_udf_fill_super+0x10/0x10 [ 75.645746][ T5322] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 75.647476][ T5322] vfs_get_tree+0x92/0x2b0 [ 75.649108][ T5322] do_new_mount+0x302/0xa10 [ 75.651290][ T5322] ? apparmor_capable+0x137/0x1b0 [ 75.653120][ T5322] ? __pfx_do_new_mount+0x10/0x10 [ 75.655085][ T5322] ? ns_capable+0x8a/0xf0 [ 75.656783][ T5322] ? kmem_cache_free+0x19b/0x690 [ 75.658851][ T5322] __se_sys_mount+0x313/0x410 [ 75.661081][ T5322] ? __pfx___se_sys_mount+0x10/0x10 [ 75.663687][ T5322] ? do_syscall_64+0xbe/0xfa0 [ 75.665632][ T5322] ? __x64_sys_mount+0x20/0xc0 [ 75.667682][ T5322] do_syscall_64+0xfa/0xfa0 [ 75.669683][ T5322] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.671875][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.674302][ T5322] ? clear_bhb_loop+0x60/0xb0 [ 75.676064][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.678688][ T5322] RIP: 0033:0x7f692db8f6c9 [ 75.680597][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.688941][ T5322] RSP: 002b:00007f692e9a5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 75.692612][ T5322] RAX: ffffffffffffffda RBX: 00007f692dde5fa0 RCX: 00007f692db8f6c9 [ 75.695850][ T5322] RDX: 0000200000000080 RSI: 0000200000004a00 RDI: 0000200000000000 [ 75.699270][ T5322] RBP: 00007f692dc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 75.702833][ T5322] R10: 0000000002008087 R11: 0000000000000246 R12: 0000000000000000 [ 75.705882][ T5322] R13: 00007f692dde6038 R14: 00007f692dde5fa0 R15: 00007ffddbb88a18 [ 75.709214][ T5322] [ 75.710990][ T5322] Kernel Offset: disabled [ 75.712768][ T5322] Rebooting in 86400 seconds..