program: syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x108) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000bc0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x20442, 0x36) r3 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000300)={0x0, {}, 0x0, {}, 0x20007, 0x0, 0x200000, 0xd, "22536af39b7c7cb7435b0a43852dbc3a9ada34cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "0410b1617b6217917d72322c0c5aa9263626c0240010f9db74161ccff2c5cf5e", [0x3, 0x800]}) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xe7c) [ 85.641336][ T4676] Bluetooth: hci0: command tx timeout [ 85.748724][ T5332] loop0: detected capacity change from 0 to 64 [ 85.942911][ T5332] loop0: detected capacity change from 64 to 11 [ 85.964995][ T5333] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI [ 85.969868][ T5333] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 85.973476][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.977332][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.981990][ T5333] RIP: 0010:bfs_get_block+0x589/0xae0 [ 85.984548][ T5333] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 c0 73 8b ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 94 73 8b ff 4c 89 ef [ 85.992800][ T5333] RSP: 0018:ffffc9000e92f638 EFLAGS: 00010206 [ 85.995521][ T5333] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 85.998881][ T5333] RDX: ffffc90020eb2000 RSI: 00000000000005ab RDI: ffff88801c4a6848 [ 86.002172][ T5333] RBP: ffff888032034e70 R08: ffffea0001568037 R09: 1ffffd40002ad006 [ 86.005436][ T5333] R10: dffffc0000000000 R11: fffff940002ad007 R12: 0000000000000028 [ 86.008584][ T5333] R13: ffff88801c4a6828 R14: 0000000000000000 R15: 000000000000000a [ 86.012072][ T5333] FS: 00007f19979bf6c0(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000 [ 86.015752][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.018643][ T5333] CR2: 00007f19979befc8 CR3: 00000000122a6000 CR4: 0000000000352ef0 [ 86.022076][ T5333] Call Trace: [ 86.023633][ T5333] [ 86.024972][ T5333] __block_write_begin_int+0x6b5/0x1900 [ 86.027353][ T5333] ? __pfx_bfs_get_block+0x10/0x10 [ 86.029540][ T5333] ? __pfx___block_write_begin_int+0x10/0x10 [ 86.032201][ T5333] ? __pfx_bfs_get_block+0x10/0x10 [ 86.034337][ T5333] block_write_begin+0x8d/0x120 [ 86.036468][ T5333] ? bfs_write_begin+0x1e/0xd0 [ 86.038639][ T5333] bfs_write_begin+0x35/0xd0 [ 86.040721][ T5333] generic_perform_write+0x2c5/0x900 [ 86.043170][ T5333] ? __pfx_generic_perform_write+0x10/0x10 [ 86.045866][ T5333] ? file_update_time_flags+0x2cb/0x4e0 [ 86.048366][ T5333] ? __generic_file_write_iter+0xf9/0x230 [ 86.051101][ T5333] ? generic_file_write_iter+0x103/0x550 [ 86.053572][ T5333] generic_file_write_iter+0x117/0x550 [ 86.055949][ T5333] ? __pfx_generic_file_write_iter+0x10/0x10 [ 86.058523][ T5333] ? __lock_acquire+0x6b6/0x2cf0 [ 86.060696][ T5333] ? __pfx_aa_file_perm+0x10/0x10 [ 86.063124][ T5333] ? rcu_read_lock_any_held+0xb3/0x120 [ 86.065876][ T5333] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 86.068472][ T5333] vfs_write+0x5c9/0xb30 [ 86.070428][ T5333] ? __pfx_generic_file_write_iter+0x10/0x10 [ 86.073399][ T5333] ? __pfx_vfs_write+0x10/0x10 [ 86.075792][ T5333] ? __fget_files+0x2a/0x420 [ 86.078072][ T5333] __x64_sys_pwrite64+0x193/0x220 [ 86.080600][ T5333] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 86.083030][ T5333] ? do_syscall_64+0xbe/0xf80 [ 86.085166][ T5333] do_syscall_64+0xfa/0xf80 [ 86.087320][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.089930][ T5333] ? clear_bhb_loop+0x60/0xb0 [ 86.091959][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.094932][ T5333] RIP: 0033:0x7f1996b8f7c9 [ 86.097083][ T5333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.105544][ T5333] RSP: 002b:00007f19979bf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 86.109092][ T5333] RAX: ffffffffffffffda RBX: 00007f1996de6090 RCX: 00007f1996b8f7c9 [ 86.112469][ T5333] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000006 [ 86.116080][ T5333] RBP: 00007f1996c13f91 R08: 0000000000000000 R09: 0000000000000000 [ 86.119966][ T5333] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 86.123343][ T5333] R13: 00007f1996de6128 R14: 00007f1996de6090 R15: 00007ffeac6f4b38 [ 86.126753][ T5333] [ 86.128122][ T5333] Modules linked in: [ 86.130272][ T5333] ---[ end trace 0000000000000000 ]--- [ 86.163993][ T5333] RIP: 0010:bfs_get_block+0x589/0xae0 [ 86.166380][ T5333] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 c0 73 8b ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 94 73 8b ff 4c 89 ef [ 86.178105][ T5332] Dev loop0: unable to read RDB block 11 [ 86.180780][ T5332] loop0: unable to read partition table [ 86.192232][ T5332] loop0: partition table beyond EOD, truncated [ 86.207329][ T5332] loop_reread_partitions: partition scan of loop0 ("Sj||C[ [ 86.207329][ T5332] C-:4̗O̡WH2S l/5C YđM7JyG--) failed (rc=-5) [ 86.214170][ T5333] RSP: 0018:ffffc9000e92f638 EFLAGS: 00010206 [ 86.217718][ T5333] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 86.220932][ T5333] RDX: ffffc90020eb2000 RSI: 00000000000005ab RDI: ffff88801c4a6848 [ 86.228148][ T5333] RBP: ffff888032034e70 R08: ffffea0001568037 R09: 1ffffd40002ad006 [ 86.231470][ T5333] R10: dffffc0000000000 R11: fffff940002ad007 R12: 0000000000000028 [ 86.236359][ T5333] R13: ffff88801c4a6828 R14: 0000000000000000 R15: 000000000000000a [ 86.239814][ T5333] FS: 00007f19979bf6c0(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000 [ 86.286616][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.289701][ T5333] CR2: 00007f10579d9000 CR3: 00000000122a6000 CR4: 0000000000352ef0 [ 86.293559][ T5333] Kernel panic - not syncing: Fatal exception [ 86.296581][ T5333] Kernel Offset: disabled [ 86.298501][ T5333] Rebooting in 86400 seconds..