program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='\x00', 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_mount_image$udf(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x18410, &(0x7f0000000180)=ANY=[@ANYRES8=0x0, @ANYRES64=0x0], 0x1, 0x4b1, &(0x7f0000001d00)="$eJzs201sVNUbx/HfM3c6TIf+/5YXCxgCTTSxgkBfsEBqYnix0YQXLVQj8SWVTrHSdkinKCUgLNWdC5Yu3bpwZdwaEpfGhcEYFibIxs2sxB3m3LlvM5TOjG1nKP1+CJx7zzx3OOc8c+ecM5kRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQjrx6uLfPWt0KAADQTCdPj/QOMP8DALCmnGH/DwAAsJaYPP0u054LJTvhn5dlj0/OXLo8emx44cvaTaaUPD/e/c329Q/sf2nwwMGwXPz65bZNp06fOdx9tDB9cTZfLObHu0dnJs8VxvN1P8NSr6+2yx+A7ukLl8YnJord/XsHKh6+3Hlv3fquzqHB945mwtjRY8PDpxMx6bb//L8/5FEr/Iw8vSDTx99/ayclpbT0sajx2llp7X4ndvmdGD027HdkanJsZs49aKkgKlU5JplwjJqQiyVJSa5dllmePVubPP0g05F9JTslyQvHYbf/wXBd7WmFtNu6SurRKsjZY2ydPH0g0619nXojGFc//xnpaqsbhxWXDu7/gpXsTf/9wN1P7m3z+Fvdr89MFBKxlgruqNU+PzTTY/7elJWnU/4dX7IR7Wx1c9Bk7fI0LVPmq0/8dYX8delTQwd27DyUXGFsqfE8LnZvcHPVMye3BUsHS7k/y98v1Cdrnv6U6f5vWf+8J5wDpBsPFrvwj6Y0DyvNPE3J9M+1klnVvtRL7O8jq33uX9n2t2ePFi7Oz06e/2huwcdz2cMfFudmx84t/HB57+ola2rtY6ulGtuS5ay84/v801J0XbAH+F/5LG7NN1fj10JPVRlKvn7qOa57F9vAOsq1yczTXZkm3t9anmeUa3hs1gKX/2GZiqWfLcx0kP90+SyR/5fj8ctaZRnxc/v/8uda4Vpi29nNj6pfify7Nrn8vyPTkb+3Bp9plPPvVcW6uC6Z3r25PYhLZVxcOuxO+RknJqfyvS72gUwbfwpj5cfmgthNcWyfiy3K9MWtytj1QezmOLbfxd6W6c6vC8c+HccOuNh5l6873WFszsXuCGK74ti95wpT47WG1eW/X6a3r79mYZ8fmf/E/X+jqow8lPPFj5cr/52JuhtBXs8G+U/XyP+XMs3/tT3stz/24ctqg/9vnH+3Vv7uZmVsuKHcGMf21dutVnP53yDTvVduR30O+hacxhlK5v+ZdGUZjWuL8r8hUdcZtCvT4FisRcX5KxfGpqbysxxwwAEH0UGr35nQDG7+H3Gz+qBn4TommP87ymfxiun+Z/H8P1RVRlo0/29M1A0Fq5a2tJSdm77YtkXKFuev7JmcHjufP5+fGdg/2Nt/aH/vwMG2TLi4i4/qHrsngcv/bpmu/fhLtI+pXP8tvP7PVZWRFuV/U7JPFeuauodiTXL575Bp8O7taL+52Po/3P/3PFtZRvdfi/K/OVHXGbSro8GxAAAAAAAAAAAAAAAAAIDVJGeenpPp8siLFv6GqJ7v/41XlZHl//5X+YfJNb7/1ZWoG2/S7xoaGmgAAAAAAAAAAIAmScnT1zI9r5JddxUd0olkiSfavwEAAP//G6xIAA==") r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) ftruncate(r1, 0x81fd) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x4000, 0xa00}]) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) swapon(&(0x7f0000000000)='./file0\x00', 0x27fff) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x100, 0x7, 0x2, 0x1001, 0xe, 0x5, 0x79, 0x2, 0x80008, 0x8, 0xffffffff, 0x1, 0x7, 0x1, 0x100, 0xfd, 0xfffffff9, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0x7, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b5, 0x0, 0xfffffff8]}) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r4, &(0x7f0000000200)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test/cgroup.procs\x00', 0x1202, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x17f) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000540), 0x44800, 0x0) sendfile(r6, r7, 0x0, 0xfffe82) write(r5, &(0x7f0000000280)='0', 0x1) [ 94.038088][ T44] Bluetooth: hci0: command tx timeout [ 94.213023][ T5312] loop0: detected capacity change from 0 to 128 [ 94.255128][ T5312] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 94.315883][ T5312] UDF-fs: error (device loop0): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 94.365131][ T25] audit: type=1800 audit(1786813917.578:2): pid=5312 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=94 res=0 errno=0 [ 94.378668][ T5312] UDF-fs: error (device loop0): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 94.396961][ T5312] ------------[ cut here ]------------ [ 94.399295][ T5312] byte_offset [ 94.399306][ T5312] WARNING: fs/udf/truncate.c:224 at udf_truncate_extents+0xd79/0xef0, CPU#0: syz.0.0/5312 [ 94.404973][ T5312] Modules linked in: [ 94.407365][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.411670][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.416014][ T5312] RIP: 0010:udf_truncate_extents+0xd79/0xef0 [ 94.418469][ T5312] Code: db 0b 10 48 3b 84 24 80 01 00 00 75 7a 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 be 23 75 08 cc e8 b8 cc 64 fe 90 <0f> 0b 90 e9 67 ff ff ff 44 89 f9 80 e1 07 38 c1 0f 8c f3 f3 ff ff [ 94.425890][ T5312] RSP: 0018:ffffc9000eee7400 EFLAGS: 00010283 [ 94.428354][ T5312] RAX: ffffffff83624528 RBX: 000000000000000a RCX: 0000000000100000 [ 94.431536][ T5312] RDX: ffffc9000f5e9000 RSI: 0000000000001774 RDI: 0000000000001775 [ 94.434714][ T5312] RBP: ffffc9000eee75d8 R08: ffff88801c32ca80 R09: 0000000000000002 [ 94.437830][ T5312] R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a [ 94.440942][ T5312] R13: 1ffff11002479670 R14: 0000000000000000 R15: 0000000000000000 [ 94.444148][ T5312] FS: 00007f5db05536c0(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 94.447516][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.450025][ T5312] CR2: 00007f0ba4786c80 CR3: 0000000042ef9000 CR4: 0000000000352ef0 [ 94.454488][ T5312] Call Trace: [ 94.455965][ T5312] [ 94.457216][ T5312] ? udf_write_failed+0xcd/0x1b0 [ 94.459150][ T5312] ? udf_write_failed+0xcd/0x1b0 [ 94.461147][ T5312] ? __pfx_udf_truncate_extents+0x10/0x10 [ 94.463563][ T5312] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.465664][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 94.467745][ T5312] udf_write_failed+0x168/0x1b0 [ 94.469760][ T5312] udf_write_begin+0x215/0x270 [ 94.471986][ T5312] generic_perform_write+0x2d5/0x8f0 [ 94.474779][ T5312] ? __pfx_generic_perform_write+0x10/0x10 [ 94.477480][ T5312] ? generic_file_direct_write+0x17d/0x3f0 [ 94.480043][ T5312] __generic_file_write_iter+0x1ae/0x230 [ 94.482424][ T5312] udf_file_write_iter+0x2e8/0x6c0 [ 94.484689][ T5312] iter_file_splice_write+0xa31/0x1240 [ 94.487055][ T5312] ? __pfx_iter_file_splice_write+0x10/0x10 [ 94.489657][ T5312] ? __pfx_iter_file_splice_write+0x10/0x10 [ 94.492484][ T5312] direct_splice_actor+0x101/0x160 [ 94.494926][ T5312] splice_direct_to_actor+0x57b/0xcb0 [ 94.497331][ T5312] ? __pfx_direct_splice_actor+0x10/0x10 [ 94.499854][ T5312] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 94.502423][ T5312] do_splice_direct+0x195/0x290 [ 94.504679][ T5312] ? __pfx_do_splice_direct+0x10/0x10 [ 94.506979][ T5312] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 94.509505][ T5312] ? rw_verify_area+0x203/0x4c0 [ 94.511608][ T5312] do_sendfile+0x52e/0x7c0 [ 94.513765][ T5312] ? __pfx_do_sendfile+0x10/0x10 [ 94.515960][ T5312] ? __se_sys_futex+0x3a8/0x450 [ 94.518132][ T5312] __se_sys_sendfile64+0x144/0x1a0 [ 94.520347][ T5312] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 94.522909][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.525590][ T5312] do_syscall_64+0x174/0x580 [ 94.527591][ T5312] ? trace_irq_disable+0x3b/0x140 [ 94.529690][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 94.531760][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.534366][ T5312] RIP: 0033:0x7f5daf59e0d9 [ 94.536260][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.544237][ T5312] RSP: 002b:00007f5db0552fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 94.547560][ T5312] RAX: ffffffffffffffda RBX: 00007f5daf825fa0 RCX: 00007f5daf59e0d9 [ 94.550718][ T5312] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 94.554025][ T5312] RBP: 00007f5daf635024 R08: 0000000000000000 R09: 0000000000000000 [ 94.557232][ T5312] R10: 0000000000fffe82 R11: 0000000000000246 R12: 0000000000000000 [ 94.560193][ T5312] R13: 00007f5daf826038 R14: 00007f5daf825fa0 R15: 00007ffefba50f18 [ 94.563551][ T5312] [ 94.564891][ T5312] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.567746][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.571513][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.575765][ T5312] Call Trace: [ 94.577212][ T5312] [ 94.578513][ T5312] vpanic+0x56c/0xa60 [ 94.580225][ T5312] ? __pfx__printk+0x10/0x10 [ 94.582240][ T5312] ? __pfx_vpanic+0x10/0x10 [ 94.584173][ T5312] ? is_bpf_text_address+0x292/0x2b0 [ 94.586319][ T5312] ? is_bpf_text_address+0x26/0x2b0 [ 94.588482][ T5312] panic+0xc5/0xd0 [ 94.590100][ T5312] ? __pfx_panic+0x10/0x10 [ 94.591955][ T5312] __warn+0x315/0x4c0 [ 94.593618][ T5312] ? udf_truncate_extents+0xd79/0xef0 [ 94.595811][ T5312] ? udf_truncate_extents+0xd79/0xef0 [ 94.598000][ T5312] __report_bug+0x276/0x570 [ 94.599926][ T5312] ? udf_truncate_extents+0xd79/0xef0 [ 94.602126][ T5312] ? __pfx___report_bug+0x10/0x10 [ 94.604277][ T5312] ? udf_get_filelongad+0x6e/0x1b0 [ 94.606226][ T5312] ? udf_current_aext+0x6c3/0xc50 [ 94.608105][ T5312] ? udf_next_aext+0x404/0x4f0 [ 94.610077][ T5312] ? udf_truncate_extents+0xd79/0xef0 [ 94.612329][ T5312] report_bug+0x16a/0x220 [ 94.614010][ T5312] ? udf_truncate_extents+0xd79/0xef0 [ 94.616312][ T5312] ? udf_truncate_extents+0xd7b/0xef0 [ 94.618599][ T5312] handle_bug+0x9c/0x200 [ 94.620448][ T5312] exc_invalid_op+0x1a/0x50 [ 94.622442][ T5312] asm_exc_invalid_op+0x1a/0x20 [ 94.624273][ T5312] RIP: 0010:udf_truncate_extents+0xd79/0xef0 [ 94.626566][ T5312] Code: db 0b 10 48 3b 84 24 80 01 00 00 75 7a 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 be 23 75 08 cc e8 b8 cc 64 fe 90 <0f> 0b 90 e9 67 ff ff ff 44 89 f9 80 e1 07 38 c1 0f 8c f3 f3 ff ff [ 94.634653][ T5312] RSP: 0018:ffffc9000eee7400 EFLAGS: 00010283 [ 94.637301][ T5312] RAX: ffffffff83624528 RBX: 000000000000000a RCX: 0000000000100000 [ 94.640722][ T5312] RDX: ffffc9000f5e9000 RSI: 0000000000001774 RDI: 0000000000001775 [ 94.643802][ T5312] RBP: ffffc9000eee75d8 R08: ffff88801c32ca80 R09: 0000000000000002 [ 94.646711][ T5312] R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a [ 94.649952][ T5312] R13: 1ffff11002479670 R14: 0000000000000000 R15: 0000000000000000 [ 94.653387][ T5312] ? udf_truncate_extents+0xd78/0xef0 [ 94.655728][ T5312] ? udf_write_failed+0xcd/0x1b0 [ 94.657905][ T5312] ? udf_write_failed+0xcd/0x1b0 [ 94.660122][ T5312] ? __pfx_udf_truncate_extents+0x10/0x10 [ 94.662588][ T5312] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.664831][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 94.667222][ T5312] udf_write_failed+0x168/0x1b0 [ 94.669243][ T5312] udf_write_begin+0x215/0x270 [ 94.671360][ T5312] generic_perform_write+0x2d5/0x8f0 [ 94.673579][ T5312] ? __pfx_generic_perform_write+0x10/0x10 [ 94.675897][ T5312] ? generic_file_direct_write+0x17d/0x3f0 [ 94.678451][ T5312] __generic_file_write_iter+0x1ae/0x230 [ 94.680792][ T5312] udf_file_write_iter+0x2e8/0x6c0 [ 94.682935][ T5312] iter_file_splice_write+0xa31/0x1240 [ 94.685204][ T5312] ? __pfx_iter_file_splice_write+0x10/0x10 [ 94.687717][ T5312] ? __pfx_iter_file_splice_write+0x10/0x10 [ 94.690034][ T5312] direct_splice_actor+0x101/0x160 [ 94.692253][ T5312] splice_direct_to_actor+0x57b/0xcb0 [ 94.695127][ T5312] ? __pfx_direct_splice_actor+0x10/0x10 [ 94.697815][ T5312] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 94.700200][ T5312] do_splice_direct+0x195/0x290 [ 94.702248][ T5312] ? __pfx_do_splice_direct+0x10/0x10 [ 94.704497][ T5312] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 94.706891][ T5312] ? rw_verify_area+0x203/0x4c0 [ 94.708931][ T5312] do_sendfile+0x52e/0x7c0 [ 94.710864][ T5312] ? __pfx_do_sendfile+0x10/0x10 [ 94.712707][ T5312] ? __se_sys_futex+0x3a8/0x450 [ 94.714790][ T5312] __se_sys_sendfile64+0x144/0x1a0 [ 94.717028][ T5312] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 94.719368][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.721840][ T5312] do_syscall_64+0x174/0x580 [ 94.723616][ T5312] ? trace_irq_disable+0x3b/0x140 [ 94.725609][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 94.727480][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.729933][ T5312] RIP: 0033:0x7f5daf59e0d9 [ 94.732041][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.740215][ T5312] RSP: 002b:00007f5db0552fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 94.743810][ T5312] RAX: ffffffffffffffda RBX: 00007f5daf825fa0 RCX: 00007f5daf59e0d9 [ 94.747355][ T5312] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 94.750661][ T5312] RBP: 00007f5daf635024 R08: 0000000000000000 R09: 0000000000000000 [ 94.754132][ T5312] R10: 0000000000fffe82 R11: 0000000000000246 R12: 0000000000000000 [ 94.757470][ T5312] R13: 00007f5daf826038 R14: 00007f5daf825fa0 R15: 00007ffefba50f18 [ 94.760921][ T5312] [ 94.762702][ T5312] Kernel Offset: disabled [ 94.764591][ T5312] Rebooting in 86400 seconds..