program: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)=0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYRES16=r0], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='cpuhp_enter\x00', r1, 0x0, 0x7b}, 0x18) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000280)={0x6, 0x412, 0x3}) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r2, &(0x7f0000001240)=""/102400, 0x19000, 0x2000000700) chdir(&(0x7f0000000340)='./file0\x00') r3 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10, &(0x7f0000000400)={[{@orlov}, {}, {@nogrpid}], [{@hash}, {@mask={'mask', 0x3d, 'MAY_EXEC'}}, {@audit}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@audit}, {@smackfsfloor}]}, 0xfd, 0x244, &(0x7f0000000900)="$eJzs3T9oJFUcB/DvzO565m6RUxtB/AMiooFwdoJNbBQCEoKIoEJExEZJhJhgl1jZWGitksomiJ3RUtIEG0WwipoiNoIGC4OFFiu7k0hMVqNu3Dkynw9MZibz3vzesPN9u83sBmisq0mmk7SSTCbpJCmON7i7Wq4e7q5PbM8nvd4TPxWDdtV+5ajflSRrSR5KslUWeamdrGw+s/fLzmP3vbncuff9zacnxnqRh/b3dh8/eG/2jY9mHlz54qsfZotMp/un6zp/xZD/tYvklv+j2HWiaNc9Av6Judc+/Lqf+1uT3DPIfydlqhfvraUbtjp54N2/6vv2j1/ePs6xAuev1+v03wPXekDjlEm6KcqpJNV2WU5NVZ/hv2ldLl9eXHp18sXF5YUX6p6pgPPSTXYf/eTSx1dO5P/7VpV/4OLq5//JuY1v+9sHrbpHA4zFHdWqn//J51bvj/xD48g/NJf8Q3PJPzSX/ENzyT80l/zDBdb5+8PyD80l/9Bc8g/NdTz/AECz9C7V/QQyUJe65x8AAAAAAAAAAAAAAAAAAOC09Ynt+aNlXDU/eyfZfyRJe1j91uD3iJMbB38v/1z0m/2hqLqN5Nm7RjzBiD6o+enrm76rt/7nd9Zbf3UhWXs9ybV2+/T9Vxzef//dzWcc7zw/YoF/qTix//BT461/0m8b9daf2Uk+7c8/14bNP2VuG6yHzz/ds79i+Uyv/DriCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABib3wMAAP//+kBtTA==") madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'netdevsim0\x00'}) syz_clone(0x100180, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x8) ioctl$PPPIOCSACTIVE(r3, 0x40107446, &(0x7f0000000580)={0x4, &(0x7f0000000540)=[{0x126e, 0x7, 0x81, 0x200}, {0x6, 0x6, 0x7f, 0x3}, {0x6, 0xff, 0x7, 0xf36a}, {0x4, 0x8, 0x3, 0x4a9}]}) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x3, 0x7}]}}]}, 0x38}}, 0x0) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', 0x444, &(0x7f0000000ac0)=ANY=[@ANYBLOB="75746638006d61703d6f983c756661703d6e6f726d616c2c6909000000f2ff00003dda5de4d586f0df206d65656b416d6f64653d3078303030303010303071303030303030302c73657373696f6e3d307830faffffff30303030303030f4e4b4f82c6d61736b3d4d4159574b50be30c8486470722677b93165cfe6f62127553b2017754598752d977369672c7063723d303030303030303030303030303030303030332c64566e745f6d6561737572652c00000000000000006bbf4d6406b59dbc529c00000000000000fada265ab14119997600a2299d2c35a2efc1bf037787a0d801f26d335ef2ba9ac2423a358ccbb776b21e1d3b", @ANYRES64, @ANYRESHEX], 0xfe, 0x667, &(0x7f0000000d40)="$eJzs3U1v28gdx/EfZfmxQFC0xSIIsvFs0gUcNFUkeeOFkR7KUpTNrSQKJF3Yp0W6sRdB5GybpEDjy9aXPgDtG+htL3voiyjQc899Az0WWLS3Ar2oIClKskRZip+Sdr8fI9GI/JPzJ4fRhBY5FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkOXUyuWKpYbX2tk1kzm1wG+eMj9d27zupoW7U+uVrPiPlpZ0PZ10/TuD2e/Ef93WzfTdTS3FL0s6+sY733z47WIhW/6UhM5Cr7vCF6+Onj7qdPafn622rnWW5S7FWCYqzLDUltvyQt9r2luu8ULfbG5slO9v10NT9xpuuBdGbtM4gVuI/MCsOXdNZXNz3bilPX+ntVWzG2428cPvV8vlDfPRYq/5739UCp1tr9HwWltJTDw7jlnsHyGu3TTm4Elnf31aknFQZZag6rSgarlarVSq1crGg80HH5bLxbEJ5REaixgctG9P4+MqXdAnN3B+hbj//7slNbSklna0K5P746imQL6aE+b3ZP3/+/fdU+sd7v+zXv76YPYNJf3/rfTdrUn9/4RcjEyyQN4ca8L0s/280Csd6akeqaOO9vX8Yta7enEZXu7PllSUPIXy5akpW1tyZXpTjDa1oQ2V9bG2VVcoo7o8NeQq1J5CRXLVTNokkCtbkXwFMlqTo7syqmhTm1qXkauS9uRrRy1tqSZb/+52uwd6kuz39VNyVBZUmSWo2D8Gx4Mm9f8//Txd4vX6f/z/6R87M8QAb1y3d/4/2VzexNXLywgAAAAAAFw0K/ntu5V8d/+upK7qXsMtv+m0AAAAAADABUq++b8Zv8zHpXdlTTj/7159bgAAAAAA4GJYyT12lqSV5KJ+a3An1CwXAeTeHAAAAAAAAN4uyff/txakbjK02qqs1zr/BwAAAAAA/wN+OzTGfjEbY7ebfa1fkBS2F60//3NRwbx13N79rnVox3Psw17M2BUAUf2GVVQ6UG8yXu+CpOSd4960euMD9wbBtNKBfaWvDqaN9W8FIwkszGW/vshJ4NrRUAIbxd47/V7vpTHv9ep9fFRQMietZaXuNdyS4zceVmTb1wqRuxv94tmTX0pBfzsPnnT2S5981nmc5HIcTzo+jPP4/EQ6hWm5vEzGW0juucjb4mXVsyp/12quWEm95Wz752QfFoYrmm37f63bacztlfR15ShrAVm/6hUqpaTJBlufjA5hDbKojG55XkNMyGIpyeJOGnNn7U76kuWXtsLS9+akamm8DYLhLKrDWUzfF9a/xvbFlCziY2E9zuIv8YomZLH+elmMtQgAvCkHg14oGcR8fIz90X73LJ9y03v3H56s5eUfu+kNh3NSsffdRHoT4qR+RfEn+loatpCO4l68kfOJXu71K0ua8IlePkfvFtf1p8EzkHpp9+YU+1n8p9vtPqwk9f5hpFf9Il7gi4n1ho3qXLwL7788/FkyAH7s0/1P959Vq+sb5Q/K5QdVzSeb0Xuh7wEA5Jj+jJ2TEUuD/qzfd3/QP6t+/I/309KJfvdb/UsKSvpEn6mjx7qXPUJgNb/elaHLEO6Nn7XGscvSaGxF9yae1SV96VBstR87r2yRk/9fGMSuX3YzAABwpW5P6YdH+/+8c/d72Xn32o3c8+6TffnoE4InxVaueE8AAPD14QZfWSvRb6wg8NofVzY3K3a07ZrAd35sAq+25RqvFbmBs223tlzTDvzId/yGaQda9GpuaMKddtsPIlP3A9P2Q283efK76T36PXSbdivynLDdcO3QNY7fimwnMjUvdEx750cNL9x2g2ThsO06Xt1z7MjzWyb0l+W4JWNC1x0K9GpuK/LqXlxsmXbgNe1gz/zEb+w0XVNzQyfw2pGfrjCry2vV/aCZrLak7mkPOgQA4Gvjxaujp486nf3npxSOlRay69FOCV7IW+Eb3kQAADCCXhoAAAAAAAAAAAAAAAAAAAAAgLffLPf/nVrIbgrMpswrJ1jqT/n5tZnWbGkw5cu/nSvDMxQKo1N6I+12py/+17RQzItZjgsLkjrZ7h+OOb7QrVidKVhpoXjx+3BZyjsSLq3wg4OTx+FYTDwzd9Zivy2K5//nkFd49uWEWdOPqMWT+3DhtA08WShKer5wjia4+s8iAFfrvwEAAP//pJI9bA==") open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 79.418249][ T5307] Bluetooth: hci0: command tx timeout [ 79.421548][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 79.423890][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 79.614438][ T25] audit: type=1326 audit(1743832271.727:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.643774][ T25] audit: type=1326 audit(1743832271.737:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.656624][ T5323] loop0: detected capacity change from 0 to 128 [ 79.688344][ T5323] EXT4-fs: Ignoring removed orlov option [ 79.690362][ T5323] ext4: Unknown parameter 'hash' [ 79.693726][ T25] audit: type=1326 audit(1743832271.737:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.728135][ T25] audit: type=1326 audit(1743832271.737:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.779241][ T25] audit: type=1326 audit(1743832271.737:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.805679][ T25] audit: type=1326 audit(1743832271.737:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.832078][ T25] audit: type=1326 audit(1743832271.737:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.863562][ T25] audit: type=1326 audit(1743832271.737:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.890817][ T25] audit: type=1326 audit(1743832271.737:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6612f8d169 code=0x7ffc0000 [ 79.914636][ T5323] loop0: detected capacity change from 0 to 164 [ 79.923395][ T25] audit: type=1326 audit(1743832271.747:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5322 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6612f8bad0 code=0x7ffc0000 [ 79.944523][ T5323] ======================================================= [ 79.944523][ T5323] WARNING: The mand mount option has been deprecated and [ 79.944523][ T5323] and is ignored by this kernel. Remove the mand [ 79.944523][ T5323] option from the mount to silence this warning. [ 79.944523][ T5323] ======================================================= [ 80.053399][ T5323] Unable to read rock-ridge attributes [ 80.070465][ T5323] Unable to read rock-ridge attributes [ 80.075993][ T5323] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 [ 80.088297][ T5323] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5323, name: syz.0.0 [ 80.092307][ T5323] preempt_count: 0, expected: 0 [ 80.094245][ T5323] RCU nest depth: 1, expected: 0 [ 80.096160][ T5323] 4 locks held by syz.0.0/5323: [ 80.116448][ T5323] #0: ffff888000cce2b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 [ 80.120376][ T5323] #1: ffff8880526f8148 (&type->i_mutex_dir_key#9){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 [ 80.123793][ T5323] #2: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 [ 80.147552][ T5323] #3: ffff888036ec65e0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 80.161429][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-13423-ga8662bcd2ff1 #0 PREEMPT(full) [ 80.161452][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 80.161459][ T5323] Call Trace: [ 80.161465][ T5323] [ 80.161470][ T5323] dump_stack_lvl+0x241/0x360 [ 80.161495][ T5323] ? __pfx_dump_stack_lvl+0x10/0x10 [ 80.161521][ T5323] __might_resched+0x558/0x6c0 [ 80.161538][ T5323] ? down_read_trylock+0xd5/0x3c0 [ 80.161554][ T5323] ? __pfx___might_resched+0x10/0x10 [ 80.161573][ T5323] ? __alloc_frozen_pages_noprof+0x162/0x5b0 [ 80.161597][ T5323] prepare_alloc_pages+0x1eb/0x610 [ 80.161614][ T5323] __alloc_frozen_pages_noprof+0x162/0x5b0 [ 80.161630][ T5323] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 80.161642][ T5323] ? __update_page_owner_handle+0x5a/0x550 [ 80.161669][ T5323] alloc_pages_mpol+0x339/0x690 [ 80.161688][ T5323] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 80.161700][ T5323] ? __page_table_check_zero+0xb8/0x510 [ 80.161719][ T5323] vma_alloc_folio_noprof+0x12d/0x260 [ 80.161735][ T5323] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 80.161757][ T5323] folio_prealloc+0x2e/0x170 [ 80.161768][ T5323] handle_pte_fault+0x2e45/0x61c0 [ 80.161792][ T5323] ? __pfx_handle_pte_fault+0x10/0x10 [ 80.161805][ T5323] ? rcu_is_watching+0x15/0xb0 [ 80.161827][ T5323] ? rcu_is_watching+0x15/0xb0 [ 80.161839][ T5323] ? lock_release+0x4e/0x3e0 [ 80.161849][ T5323] ? lock_release+0x4e/0x3e0 [ 80.161870][ T5323] ? mtree_range_walk+0x700/0x8e0 [ 80.161933][ T5323] handle_mm_fault+0x1129/0x1bf0 [ 80.161950][ T5323] ? mt_find+0x28a/0x8f0 [ 80.161981][ T5323] ? __pfx_handle_mm_fault+0x10/0x10 [ 80.162012][ T5323] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 80.162028][ T5323] exc_page_fault+0x2bb/0x920 [ 80.162045][ T5323] asm_exc_page_fault+0x26/0x30 [ 80.162056][ T5323] RIP: 0010:filldir+0x2c4/0x6a0 [ 80.162077][ T5323] Code: 87 55 02 00 00 0f 01 cb 0f ae e8 48 8b 44 24 30 49 89 46 08 48 8b 4c 24 10 48 8b 44 24 60 48 89 01 48 8b 44 24 18 8b 6c 24 3c <66> 89 41 10 48 98 40 88 6c 01 ff 48 89 44 24 30 4d 63 f5 42 c6 44 [ 80.162088][ T5323] RSP: 0018:ffffc9000d567be0 EFLAGS: 00050283 [ 80.162100][ T5323] RAX: 0000000000000020 RBX: 0000200000002010 RCX: 0000200000001ff0 [ 80.162108][ T5323] RDX: ffffc9000e292000 RSI: 0000200000001fd8 RDI: 0000200000002010 [ 80.162116][ T5323] RBP: 0000000000000004 R08: ffffffff8245358d R09: 1ffff110000e1910 [ 80.162124][ T5323] R10: dffffc0000000000 R11: ffffed10000e1911 R12: ffff888045eee801 [ 80.162131][ T5323] R13: 0000000000000005 R14: 0000200000001fd8 R15: 00007ffffffff000 [ 80.162143][ T5323] ? filldir+0x28d/0x6a0 [ 80.162171][ T5323] afs_dynroot_readdir+0x814/0xbe0 [ 80.162185][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 80.162199][ T5323] ? afs_dynroot_readdir+0x466/0xbe0 [ 80.162215][ T5323] ? __pfx_afs_dynroot_readdir+0x10/0x10 [ 80.162229][ T5323] ? common_file_perm+0x1a6/0x210 [ 80.162252][ T5323] iterate_dir+0x5a9/0x760 [ 80.162268][ T5323] __se_sys_getdents+0x1ff/0x4e0 [ 80.162287][ T5323] ? __pfx___se_sys_getdents+0x10/0x10 [ 80.162299][ T5323] ? __pfx_filldir+0x10/0x10 [ 80.162314][ T5323] ? __secure_computing+0xef/0x2f0 [ 80.162335][ T5323] do_syscall_64+0xf3/0x230 [ 80.162349][ T5323] ? clear_bhb_loop+0x45/0xa0 [ 80.162361][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.162371][ T5323] RIP: 0033:0x7f6612f8d169 [ 80.162381][ T5323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 80.162389][ T5323] RSP: 002b:00007f6613e96038 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 80.162405][ T5323] RAX: ffffffffffffffda RBX: 00007f66131a5fa0 RCX: 00007f6612f8d169 [ 80.162412][ T5323] RDX: 00000000000000b8 RSI: 0000200000001fc0 RDI: 0000000000000005 [ 80.162419][ T5323] RBP: 00007f661300e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 80.162425][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.162431][ T5323] R13: 0000000000000000 R14: 00007f66131a5fa0 R15: 00007ffc0ef757b8 [ 80.162449][ T5323]