program: syz_mount_image$nilfs2(&(0x7f0000000dc0), &(0x7f0000000180)='./file1\x00', 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="646973636172642c6f726465723d7374726963742c6e6f626172726965722c6e6f646973636172642c646973636172642c00d6e70e577a93402ea7d4fba8845b7ff04836b8a79af2dc53fe9bcf07dccea1c41a0edf7f02b5275e782f1886d630f4afad1edb570424e325d43ea5d134962866aa0bd3"], 0x3, 0xdab, &(0x7f0000000e00)="$eJzs3UtvXFcdAPBzx544rxKncYkJIQkNpeYRu0kNZYcrhUWFVCH1E1QhLSlueaQsWqUi6YItkap+AKruEeKZRaWoq6BuQHyBqis2oapUIEJqB9k+Zzz+Z6Z3xnE8Hs/vJ505c+//zD3nzOPOzH2dBIytxurt4uJsldKbN944f+fk5H9X5pxslzi1ejuZp5ZSSs3241KaDstbmlrLP/noyoXO/NOcV+lcqlLVnp+evt1+7IG9KV1Np9LNNJ2e+fDo9Rfee2r5nSPXjpx/be7W/ek9AACMlzvff/tnf330e1cO/++3J5bSVHt++X2+lKcP5t/9S9XadM7a/wOqjrzqmC72hHKTOTVCuYku5TrraYZykz3q3xOW2+xRbqqm/omOed36DaNs/X981ZjfMN1ozM+ndCBPvz+xp5p/6dLyc5eH1FBgy318Mm/ikyRp7FLr0LDXQABr4n7Du1yNWxbuTXtpk/3Vf/vJRvfHwxbY7ve/+ker/revWeOwdXbru6n0q3yODubpuB9hMjxu0M9/WV7cH9Hss5299iOMyv6FXu2c2OZ2bFav9sf3xW71pZyX5+FEiHd+fuJrOiqvMdDdHdv/JWlsU2vYKyBgx4rHzbWyEo/H9cX4VE18b018X018f038QE0cxtnvX/51ul6t/8+P/+kH3R5WtrM9kPPPDdieuD1y0Prjcb+Dutf64/HEsKPN/ef4x7+4+bd4/P+n4fj/0/m7dDqvIMr2wrhdvX3sfzgxuNGj3IOhOQ90Kb96f2ZjuWpmfTmpYz1zVztmNz7uUK9yxzeWmw7l9uffIntDe+Pvk/3hceX3R1mvludrMvS3GfqxJ7SjvDKHc7439Odwr36FDdl7QrlmTkdCv2ZCvx4Kj/t86Fc1u7Ffcft5ac/RMD/uJynlwst21/dSfC3ieRkP5/z1nL+V83dz/kGXesdReT/2Ov6/vD9nU7N67tLyxcfydHmf3ppoTq3MP7vN7QbuXb/n/8ymjef/HGzPbzY61wuH1udXneuF6TD/XI/5j+fp8n32o4l9q/PnL/xk+Ydb3XkYc5dfefXHzy4vX/y5O+64Mz53vpVqygx7zQTcbwsvv/jThcuvvHrm0ovPPn/x+YsvnX3sO99+/IknFhdWf9UvdP62B3aX9S/9YbcEAAAAAAAAAAAA6Fu1r/vsnNdd37acT17OT4/nxzMayutW3g3lOgbl/M9e13Up528e3oY2svW245SjYfcR6O5frv8rSWObWi1X8Qd2hmGP/1eue1jyg2f+cXgllWK3n9y4vozXL4R7sdPHn1P/7hr/rz3+Vd/rvzBi1vTm6v3DnX1/76g2Heu3/tj/ch3YmcHq/2Ouv/TmkdRf/a3fhPrjhUr79KdQ//4+67+r/8c3V/+fc/3laZs73W/9ay2uGhvbEbcbl+sAxu3GxV9C/8u1/Qbu/yYHaruR64dxNirjTA5qVMb/7KUst6wH8+q5vZ+uXH87jncwaPvLdb/L98BDYflVzfeb8T9HW934n+X9t2D8T9h13t+m/X+/2wH7OiRJ2phardZQhz4Z13FXdophP//D/g057PqH/fzXieN/xv9LcfzPGI/jf8Z4HP8zxuP4WjEex/+Mz2cc/zPGj4blxvFBZ2viX6iJH6uJf7EmfrwmHv+/xfipmviJmvjJmviDNfGHa+Kna+JfqYk/UhN/tCY+VxPf7b6c83HtP4yzOG6kzz+Mj7L/p9fnf6YmDoyuOK5z/Hx/tSYOjK5ynIfPN4yhqvsVO+L29rId9/Wcv5Xzd3P+wX1rINvhazn/es6/kfNv5vxMzudzvpBzY0OOtl/989iJ69X6cX6HQrzf40nj+QDxOjFn+2xP3D836PGsR/us5zPrb7Vav9xk/Zs8HQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgZDRWbxcXZ6uU3rzxxvl/z3z3BytzTrZLnFq9ncxTSymlZkqpytOTYXlXp9byTz66cqFbXqVzq7dlOj19u/3YAyuPT6fSzTSdnvnw6PUX3ntq+Z0j146cf23u1v3pPQAAAIyH/wcAAP//Q2rpPw==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r0, 0x40786e88, &(0x7f0000000640)={{0x0, 0x0, 0x40, 0xd, 0xe2}, {0x0, 0x0, 0x10, 0x20c, 0xfffffffffffffff8}, {0x0, 0x0, 0x8, 0x1, 0x2}, {0x0, 0x0, 0x28, 0x0, 0xffffffffffffff2d}, {&(0x7f0000000840)=[0x9, 0xd], 0x2, 0x8, 0x98f, 0x7f1f}}) (async) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r0, 0x40786e88, &(0x7f0000000640)={{0x0, 0x0, 0x40, 0xd, 0xe2}, {0x0, 0x0, 0x10, 0x20c, 0xfffffffffffffff8}, {0x0, 0x0, 0x8, 0x1, 0x2}, {0x0, 0x0, 0x28, 0x0, 0xffffffffffffff2d}, {&(0x7f0000000840)=[0x9, 0xd], 0x2, 0x8, 0x98f, 0x7f1f}}) socket$inet_smc(0x2b, 0x1, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) io_uring_setup(0x17b6, &(0x7f00000002c0)={0x0, 0xa, 0x100, 0x1, 0x393}) (async) r2 = io_uring_setup(0x17b6, &(0x7f00000002c0)={0x0, 0xa, 0x100, 0x1, 0x393}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_ifreq(r3, 0x89f0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) (async) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) recvmmsg(r4, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000300)=""/80, 0x50}], 0x1}}], 0x2, 0x102, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x304}, "4d1e32ce4fc262db", "cb97bbf0b09ffbbbd8de76519b478499", "b158e376", "4facbd0641ba0dc4"}, 0x28) close_range(r2, 0xffffffffffffffff, 0x0) (async) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045520, &(0x7f0000000040)=0xfffffffc) syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x4c2000) (async) syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x4c2000) [ 118.267321][ T4666] Bluetooth: hci0: command tx timeout [ 118.381827][ T5332] loop0: detected capacity change from 0 to 4096 [ 118.414846][ T5332] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 118.427033][ T5332] NILFS (loop0): mounting unchecked fs [ 118.452614][ T5307] udevd[5307]: incorrect nilfs2 checksum on /dev/loop0 [ 118.462783][ T5332] NILFS (loop0): recovery complete [ 118.478195][ T5334] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 118.485929][ T5333] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 118.492140][ T5333] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 118.496013][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 118.500240][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.504661][ T5333] RIP: 0010:nilfs_mdt_save_to_shadow_map+0x141/0x1c0 [ 118.508245][ T5333] Code: 3f 4c 8d 63 d8 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7 e8 9e 74 84 fe 4d 8b 24 24 49 83 c4 30 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 80 74 84 fe 49 8b 34 24 4c 89 ff [ 118.517951][ T5333] RSP: 0018:ffffc9000e04f708 EFLAGS: 00010206 [ 118.520874][ T5333] RAX: 0000000000000006 RBX: ffff888046fec7a8 RCX: 0000000000000000 [ 118.524434][ T5333] RDX: ffff888011d724c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 118.528391][ T5333] RBP: 0000000000000000 R08: ffff888011d724c0 R09: 0000000000000003 [ 118.532659][ T5333] R10: 0000000000000406 R11: 0000000000000000 R12: 0000000000000030 [ 118.536406][ T5333] R13: dffffc0000000000 R14: ffff888012bff540 R15: ffff888046febc48 [ 118.540052][ T5333] FS: 00007f05516956c0(0000) GS:ffff88808ca49000(0000) knlGS:0000000000000000 [ 118.544587][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.548520][ T5333] CR2: 00007f674ab909c0 CR3: 00000000375eb000 CR4: 0000000000352ef0 [ 118.552110][ T5333] Call Trace: [ 118.553514][ T5333] [ 118.554827][ T5333] nilfs_clean_segments+0x162/0xa50 [ 118.557197][ T5333] ? nilfs_ioctl_move_blocks+0x94b/0xda0 [ 118.559710][ T5333] ? __pfx_nilfs_clean_segments+0x10/0x10 [ 118.562584][ T5333] ? _copy_from_user+0x94/0xb0 [ 118.565459][ T5333] nilfs_ioctl+0x261f/0x2780 [ 118.568066][ T5333] ? __pfx_nilfs_ioctl+0x10/0x10 [ 118.570247][ T5333] ? kasan_save_track+0x4f/0x80 [ 118.572402][ T5333] ? kasan_save_track+0x3e/0x80 [ 118.574329][ T5333] ? kasan_save_free_info+0x46/0x50 [ 118.576393][ T5333] ? __kasan_slab_free+0x5c/0x80 [ 118.578549][ T5333] ? kfree+0x1c1/0x630 [ 118.580462][ T5333] ? tomoyo_path_number_perm+0x501/0x630 [ 118.583003][ T5333] ? security_file_ioctl+0xc3/0x2a0 [ 118.585342][ T5333] ? __se_sys_ioctl+0x47/0x170 [ 118.587920][ T5333] ? do_syscall_64+0x14d/0xf80 [ 118.590641][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.593563][ T5333] ? kasan_quarantine_put+0xbb/0x1f0 [ 118.595952][ T5333] ? tomoyo_path_number_perm+0x219/0x630 [ 118.598442][ T5333] ? tomoyo_path_number_perm+0x219/0x630 [ 118.600964][ T5333] ? do_vfs_ioctl+0x1166/0x1530 [ 118.604601][ T5333] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 118.608261][ T5333] ? do_futex+0x333/0x420 [ 118.610391][ T5333] ? __fget_files+0x2a/0x420 [ 118.612611][ T5333] ? __fget_files+0x2a/0x420 [ 118.614818][ T5333] ? __fget_files+0x3a0/0x420 [ 118.617024][ T5333] ? __fget_files+0x2a/0x420 [ 118.619216][ T5333] ? bpf_lsm_file_ioctl+0x9/0x20 [ 118.621486][ T5333] ? __pfx_nilfs_ioctl+0x10/0x10 [ 118.623795][ T5333] __se_sys_ioctl+0xfc/0x170 [ 118.626037][ T5333] do_syscall_64+0x14d/0xf80 [ 118.628991][ T5333] ? trace_irq_disable+0x3b/0x150 [ 118.632501][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.635731][ T5333] ? clear_bhb_loop+0x40/0x90 [ 118.637934][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.640614][ T5333] RIP: 0033:0x7f055079c819 [ 118.642531][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.652152][ T5333] RSP: 002b:00007f0551694fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 118.656407][ T5333] RAX: ffffffffffffffda RBX: 00007f0550a16090 RCX: 00007f055079c819 [ 118.660086][ T5333] RDX: 0000200000000640 RSI: 0000000040786e88 RDI: 0000000000000004 [ 118.663720][ T5333] RBP: 00007f0550832c91 R08: 0000000000000000 R09: 0000000000000000 [ 118.667570][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.671046][ T5333] R13: 00007f0550a16128 R14: 00007f0550a16090 R15: 00007ffd22095358 [ 118.674782][ T5333] [ 118.676452][ T5333] Modules linked in: [ 118.678836][ T5333] ---[ end trace 0000000000000000 ]--- [ 118.697319][ T5333] RIP: 0010:nilfs_mdt_save_to_shadow_map+0x141/0x1c0 [ 118.700788][ T5333] Code: 3f 4c 8d 63 d8 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7 e8 9e 74 84 fe 4d 8b 24 24 49 83 c4 30 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 80 74 84 fe 49 8b 34 24 4c 89 ff [ 118.711082][ T5333] RSP: 0018:ffffc9000e04f708 EFLAGS: 00010206 [ 118.715626][ T5333] RAX: 0000000000000006 RBX: ffff888046fec7a8 RCX: 0000000000000000 [ 118.719907][ T5333] RDX: ffff888011d724c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 118.723700][ T5333] RBP: 0000000000000000 R08: ffff888011d724c0 R09: 0000000000000003 [ 118.728232][ T5333] R10: 0000000000000406 R11: 0000000000000000 R12: 0000000000000030 [ 118.732072][ T5333] R13: dffffc0000000000 R14: ffff888012bff540 R15: ffff888046febc48 [ 118.736995][ T5333] FS: 00007f05516956c0(0000) GS:ffff88808ca49000(0000) knlGS:0000000000000000 [ 118.741585][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.744574][ T5333] CR2: 00005562a555b718 CR3: 00000000375eb000 CR4: 0000000000352ef0 [ 118.749012][ T5333] Kernel panic - not syncing: Fatal exception [ 118.752673][ T5333] Kernel Offset: disabled [ 118.754703][ T5333] Rebooting in 86400 seconds..