program: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x30000c6, &(0x7f0000000080), 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f00000001c0)={r1, 0x1, 0x2}) ioctl$sock_bt_bnep_BNEPCONNDEL(r2, 0x400442c9, &(0x7f0000000100)={0x0, @broadcast}) chdir(&(0x7f00000000c0)='./bus\x00') r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000180)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xff}]}) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(0xffffffffffffffff, &(0x7f0000000340)="41000000010001", 0x7) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) [ 74.029260][ T45] Bluetooth: hci0: command tx timeout [ 74.099791][ T5314] loop0: detected capacity change from 0 to 1024 [ 74.116531][ T5314] ======================================================= [ 74.116531][ T5314] WARNING: The mand mount option has been deprecated and [ 74.116531][ T5314] and is ignored by this kernel. Remove the mand [ 74.116531][ T5314] option from the mount to silence this warning. [ 74.116531][ T5314] ======================================================= [ 74.173209][ T5314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 74.217642][ T5314] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:4224: comm syz.0.0: Allocating blocks 481-513 which overlap fs metadata [ 74.273802][ T5314] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:4224: comm syz.0.0: Allocating blocks 497-513 which overlap fs metadata [ 74.296127][ T5314] overlayfs: failed to create directory ./file0/index (errno: 117); mounting read-only [ 74.300611][ T5314] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 74.322199][ T24] audit: type=1326 audit(1771472271.396:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5313 comm="syz.0.0" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa04159c629 code=0x0 [ 74.386680][ T5314] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI [ 74.391852][ T5314] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 74.395428][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.399203][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.403355][ T5314] RIP: 0010:klist_remove+0x156/0x340 [ 74.405946][ T5314] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 1d f6 8b f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 fe f5 8b f6 49 8b 44 24 58 48 89 44 24 08 [ 74.414270][ T5314] RSP: 0018:ffffc9000e0b7960 EFLAGS: 00010202 [ 74.416915][ T5314] RAX: 000000000000000b RBX: ffff88801f794900 RCX: 0000000000000000 [ 74.420324][ T5314] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 74.423808][ T5314] RBP: ffffc9000e0b7a60 R08: ffffffff8ff809a3 R09: 1ffffffff1ff0134 [ 74.427218][ T5314] R10: dffffc0000000000 R11: fffffbfff1ff0135 R12: 0000000000000000 [ 74.430725][ T5314] R13: 1ffff110081d720c R14: ffff888040eb9060 R15: dffffc0000000000 [ 74.434253][ T5314] FS: 00007fa0423b66c0(0000) GS:ffff88808ca5b000(0000) knlGS:0000000000000000 [ 74.438156][ T5314] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.440983][ T5314] CR2: 0000000000000000 CR3: 00000000436d0000 CR4: 0000000000352ef0 [ 74.444423][ T5314] Call Trace: [ 74.445858][ T5314] [ 74.447278][ T5314] ? __pfx_klist_remove+0x10/0x10 [ 74.449472][ T5314] ? kobject_move+0x5de/0x720 [ 74.451625][ T5314] ? __pfx_kobject_move+0x10/0x10 [ 74.453822][ T5314] ? do_raw_spin_unlock+0x4d/0x210 [ 74.456057][ T5314] ? get_device_parent+0x366/0x3a0 [ 74.458264][ T5314] device_move+0x193/0x730 [ 74.460354][ T5314] hci_conn_del_sysfs+0xb8/0x1a0 [ 74.462567][ T5314] hci_conn_del+0xc36/0x1230 [ 74.464541][ T5314] hci_conn_hash_flush+0x191/0x260 [ 74.466714][ T5314] hci_dev_close_sync+0x821/0x10e0 [ 74.468992][ T5314] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 74.471528][ T5314] ? lockdep_hardirqs_on+0x7a/0x110 [ 74.473803][ T5314] ? enable_work+0x1fd/0x230 [ 74.475844][ T5314] hci_dev_close+0x108/0x260 [ 74.477794][ T5314] sock_do_ioctl+0x101/0x320 [ 74.479687][ T5314] ? __pfx_sock_do_ioctl+0x10/0x10 [ 74.481763][ T5314] ? do_futex+0x395/0x420 [ 74.483705][ T5314] sock_ioctl+0x5c6/0x7f0 [ 74.485537][ T5314] ? __pfx_sock_ioctl+0x10/0x10 [ 74.487622][ T5314] ? __fget_files+0x2a/0x420 [ 74.489749][ T5314] ? __fget_files+0x3a0/0x420 [ 74.491825][ T5314] ? __fget_files+0x2a/0x420 [ 74.493791][ T5314] ? bpf_lsm_file_ioctl+0x9/0x20 [ 74.495842][ T5314] ? __pfx_sock_ioctl+0x10/0x10 [ 74.497928][ T5314] __se_sys_ioctl+0xfc/0x170 [ 74.499883][ T5314] do_syscall_64+0x14d/0xf80 [ 74.501910][ T5314] ? trace_irq_disable+0x3b/0x150 [ 74.504079][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.506736][ T5314] ? clear_bhb_loop+0x40/0x90 [ 74.508515][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.510955][ T5314] RIP: 0033:0x7fa04159c629 [ 74.512848][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.521097][ T5314] RSP: 002b:00007fa0423b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 74.524636][ T5314] RAX: ffffffffffffffda RBX: 00007fa041815fa0 RCX: 00007fa04159c629 [ 74.528047][ T5314] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000004 [ 74.531526][ T5314] RBP: 00007fa041632b39 R08: 0000000000000000 R09: 0000000000000000 [ 74.535013][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.538329][ T5314] R13: 00007fa041816038 R14: 00007fa041815fa0 R15: 00007ffc64eda0c8 [ 74.542155][ T5314] [ 74.543444][ T5314] Modules linked in: [ 74.545547][ T5314] ---[ end trace 0000000000000000 ]--- [ 74.634247][ T5314] RIP: 0010:klist_remove+0x156/0x340 [ 74.643020][ T5314] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 1d f6 8b f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 fe f5 8b f6 49 8b 44 24 58 48 89 44 24 08 [ 74.652449][ T5314] RSP: 0018:ffffc9000e0b7960 EFLAGS: 00010202 [ 74.657024][ T5314] RAX: 000000000000000b RBX: ffff88801f794900 RCX: 0000000000000000 [ 74.660751][ T5314] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 74.665002][ T5314] RBP: ffffc9000e0b7a60 R08: ffffffff8ff809a3 R09: 1ffffffff1ff0134 [ 74.668505][ T5314] R10: dffffc0000000000 R11: fffffbfff1ff0135 R12: 0000000000000000 [ 74.671986][ T5314] R13: 1ffff110081d720c R14: ffff888040eb9060 R15: dffffc0000000000 [ 74.675865][ T5314] FS: 00007fa0423b66c0(0000) GS:ffff88808ca5b000(0000) knlGS:0000000000000000 [ 74.679756][ T5314] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.682883][ T5314] CR2: 00007ffc4f9df3d8 CR3: 00000000436d0000 CR4: 0000000000352ef0 [ 74.687255][ T5314] Kernel panic - not syncing: Fatal exception [ 74.690233][ T5314] Kernel Offset: disabled [ 74.692365][ T5314] Rebooting in 86400 seconds..