program: syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000340)='.\x00', 0xa50003d1) rmdir(&(0x7f0000000000)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) socket(0x2b, 0x800, 0x10) syz_mount_image$udf(&(0x7f0000000400), &(0x7f0000000500)='./bus\x00', 0x10418, &(0x7f0000000440)=ANY=[@ANYRES8=0x0, @ANYRESOCT], 0xfe, 0x4b1, &(0x7f0000001d00)="$eJzs201sVNUbx/HfM3c6TIf+/5YXCxgCTTSxgkBfsEBqYnix0YQXLVQj8SWVTrHSdkinKCUgLNWdC5Yu3bpwZdwaEpfGhcEYFibIxs2sxB3m3LlvM5TOjG1nKP1+CJx7zzx3OOc8c+ecM5kRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQjrx6uLfPWt0KAADQTCdPj/QOMP8DALCmnGH/DwAAsJaYPP0u054LJTvhn5dlj0/OXLo8emx44cvaTaaUPD/e/c329Q/sf2nwwMGwXPz65bZNp06fOdx9tDB9cTZfLObHu0dnJs8VxvN1P8NSr6+2yx+A7ukLl8YnJord/XsHKh6+3Hlv3fquzqHB945mwtjRY8PDpxMx6bb//L8/5FEr/Iw8vSDTx99/ayclpbT0sajx2llp7X4ndvmdGD027HdkanJsZs49aKkgKlU5JplwjJqQiyVJSa5dllmePVubPP0g05F9JTslyQvHYbf/wXBd7WmFtNu6SurRKsjZY2ydPH0g0619nXojGFc//xnpaqsbhxWXDu7/gpXsTf/9wN1P7m3z+Fvdr89MFBKxlgruqNU+PzTTY/7elJWnU/4dX7IR7Wx1c9Bk7fI0LVPmq0/8dYX8delTQwd27DyUXGFsqfE8LnZvcHPVMye3BUsHS7k/y98v1Cdrnv6U6f5vWf+8J5wDpBsPFrvwj6Y0DyvNPE3J9M+1klnVvtRL7O8jq33uX9n2t2ePFi7Oz06e/2huwcdz2cMfFudmx84t/HB57+ola2rtY6ulGtuS5ay84/v801J0XbAH+F/5LG7NN1fj10JPVRlKvn7qOa57F9vAOsq1yczTXZkm3t9anmeUa3hs1gKX/2GZiqWfLcx0kP90+SyR/5fj8ctaZRnxc/v/8uda4Vpi29nNj6pfify7Nrn8vyPTkb+3Bp9plPPvVcW6uC6Z3r25PYhLZVxcOuxO+RknJqfyvS72gUwbfwpj5cfmgthNcWyfiy3K9MWtytj1QezmOLbfxd6W6c6vC8c+HccOuNh5l6873WFszsXuCGK74ti95wpT47WG1eW/X6a3r79mYZ8fmf/E/X+jqow8lPPFj5cr/52JuhtBXs8G+U/XyP+XMs3/tT3stz/24ctqg/9vnH+3Vv7uZmVsuKHcGMf21dutVnP53yDTvVduR30O+hacxhlK5v+ZdGUZjWuL8r8hUdcZtCvT4FisRcX5KxfGpqbysxxwwAEH0UGr35nQDG7+H3Gz+qBn4TommP87ymfxiun+Z/H8P1RVRlo0/29M1A0Fq5a2tJSdm77YtkXKFuev7JmcHjufP5+fGdg/2Nt/aH/vwMG2TLi4i4/qHrsngcv/bpmu/fhLtI+pXP8tvP7PVZWRFuV/U7JPFeuauodiTXL575Bp8O7taL+52Po/3P/3PFtZRvdfi/K/OVHXGbSro8GxAAAAAAAAAAAAAAAAAIDVJGeenpPp8siLFv6GqJ7v/41XlZHl//5X+YfJNb7/1ZWoG2/S7xoaGmgAAAAAAAAAAIAmScnT1zI9r5JddxUd0olkiSfavwEAAP//G6xIAA==") r2 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x80) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r2, 0xc058534b, &(0x7f0000001280)={0x64, 0x4, 0x749c, 0x7, 0xf, 0x3}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeb, 0x8, 0x0, 0xffffffffffffffff}}, 0x10) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r3, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) ftruncate(r3, 0x81fd) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000, 0xa00}]) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x108) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000bc0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x20442, 0x36) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x400000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4d489}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40850}, 0x0) pwrite64(r6, &(0x7f0000000140)='2', 0xfdef, 0xe7c) [ 85.642008][ T5340] loop0: detected capacity change from 0 to 64 [ 85.752868][ T5340] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI [ 85.757524][ T5340] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 85.761069][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.764850][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.769398][ T5340] RIP: 0010:bfs_get_block+0x589/0xae0 [ 85.771827][ T5340] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 e0 37 8c ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 b4 37 8c ff 4c 89 ef [ 85.780239][ T5340] RSP: 0018:ffffc9000d3f7638 EFLAGS: 00010206 [ 85.783127][ T5340] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 85.786645][ T5340] RDX: ffffc9000f382000 RSI: 0000000000000633 RDI: ffff888043311678 [ 85.790005][ T5340] RBP: ffff888032064e70 R08: ffffea000133fbf7 R09: 1ffffd4000267f7e [ 85.793289][ T5340] R10: dffffc0000000000 R11: fffff94000267f7f R12: 0000000000000028 [ 85.796326][ T5340] R13: ffff888043311658 R14: 0000000000000000 R15: 000000000000002f [ 85.799326][ T5340] FS: 00007f327bfcf6c0(0000) GS:ffff88808d68a000(0000) knlGS:0000000000000000 [ 85.802783][ T5340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.805531][ T5340] CR2: 000055641ce6ef70 CR3: 000000001ff0b000 CR4: 0000000000352ef0 [ 85.808823][ T5340] Call Trace: [ 85.810304][ T5340] [ 85.811723][ T5340] __block_write_begin_int+0x6b5/0x1900 [ 85.814351][ T5340] ? filemap_get_entry+0xad/0x2f0 [ 85.816822][ T5340] ? __pfx_bfs_get_block+0x10/0x10 [ 85.819273][ T5340] ? __pfx___block_write_begin_int+0x10/0x10 [ 85.822091][ T5340] ? __filemap_get_folio+0x79f/0xaf0 [ 85.824678][ T5340] ? __pfx_bfs_get_block+0x10/0x10 [ 85.827120][ T5340] block_write_begin+0x8a/0x120 [ 85.829326][ T5340] ? bfs_write_begin+0x1e/0xd0 [ 85.831476][ T5340] bfs_write_begin+0x35/0xd0 [ 85.833512][ T5340] generic_perform_write+0x2c5/0x900 [ 85.835830][ T5340] ? __pfx_generic_perform_write+0x10/0x10 [ 85.838302][ T5340] ? file_update_time_flags+0x2cb/0x4e0 [ 85.840718][ T5340] ? __generic_file_write_iter+0xf9/0x230 [ 85.842940][ T5340] ? generic_file_write_iter+0x103/0x550 [ 85.845357][ T5340] generic_file_write_iter+0x117/0x550 [ 85.847701][ T5340] ? __pfx_generic_file_write_iter+0x10/0x10 [ 85.850217][ T5340] ? __lock_acquire+0x6b6/0x2cf0 [ 85.852285][ T5340] ? __pfx_aa_file_perm+0x10/0x10 [ 85.854486][ T5340] ? rcu_read_lock_any_held+0xb3/0x120 [ 85.856793][ T5340] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 85.859359][ T5340] vfs_write+0x5c9/0xb30 [ 85.861196][ T5340] ? __pfx_generic_file_write_iter+0x10/0x10 [ 85.863828][ T5340] ? __pfx_vfs_write+0x10/0x10 [ 85.865769][ T5340] ? __fget_files+0x2a/0x420 [ 85.867703][ T5340] __x64_sys_pwrite64+0x193/0x220 [ 85.869682][ T5340] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 85.871868][ T5340] ? do_syscall_64+0xbe/0xf80 [ 85.873824][ T5340] do_syscall_64+0xfa/0xf80 [ 85.875640][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.878114][ T5340] ? clear_bhb_loop+0x60/0xb0 [ 85.880169][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.882692][ T5340] RIP: 0033:0x7f327b18f7c9 [ 85.884615][ T5340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.892472][ T5340] RSP: 002b:00007f327bfcf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 85.896017][ T5340] RAX: ffffffffffffffda RBX: 00007f327b3e5fa0 RCX: 00007f327b18f7c9 [ 85.899373][ T5340] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000009 [ 85.902781][ T5340] RBP: 00007f327b213f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.906213][ T5340] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 85.909687][ T5340] R13: 00007f327b3e6038 R14: 00007f327b3e5fa0 R15: 00007fffd5740e28 [ 85.913165][ T5340] [ 85.914557][ T5340] Modules linked in: [ 85.916995][ T5340] ---[ end trace 0000000000000000 ]--- [ 85.937140][ T5340] RIP: 0010:bfs_get_block+0x589/0xae0 [ 85.939781][ T5340] Code: f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 e0 37 8c ff 49 8b 5d 20 4d 8d 66 28 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 48 8b 6c 24 18 74 08 4c 89 e7 e8 b4 37 8c ff 4c 89 ef [ 85.948354][ T5340] RSP: 0018:ffffc9000d3f7638 EFLAGS: 00010206 [ 85.950868][ T5340] RAX: 0000000000000005 RBX: 0000000000000200 RCX: dffffc0000000000 [ 85.954016][ T5340] RDX: ffffc9000f382000 RSI: 0000000000000633 RDI: ffff888043311678 [ 85.958021][ T5340] RBP: ffff888032064e70 R08: ffffea000133fbf7 R09: 1ffffd4000267f7e [ 85.961800][ T5340] R10: dffffc0000000000 R11: fffff94000267f7f R12: 0000000000000028 [ 85.966988][ T5340] R13: ffff888043311658 R14: 0000000000000000 R15: 000000000000002f [ 85.970541][ T5340] FS: 00007f327bfcf6c0(0000) GS:ffff88808d68a000(0000) knlGS:0000000000000000 [ 85.974600][ T5340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.977879][ T5340] CR2: 000056334f384168 CR3: 000000001ff0b000 CR4: 0000000000352ef0 [ 85.981407][ T5340] Kernel panic - not syncing: Fatal exception [ 85.984412][ T5340] Kernel Offset: disabled [ 85.986340][ T5340] Rebooting in 86400 seconds..