program: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x30, r7, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {}, {0x14, 0x13, @l2={'ib', 0x3a, 'team_slave_1\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000040}, 0x80) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000200)={0x64, r4, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x12, 0x13, [{0xc}, {0x1, 0x1}, {}, {0x2, 0x1}, {0x12, 0x1}, {0x24}, {0x12, 0x1}, {0xb, 0x1}, {0x1b}, {0x1b, 0x1}, {0x6, 0x1}, {0x1b}, {0x36, 0x1}, {0x60}]}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x17, 0x13, [{0x4d}, {0x36}, {0x18, 0x1}, {0x0, 0x1}, {0x60}, {0x3}, {0x1b}, {0x48}, {0x6}, {0x1b, 0x1}, {0x2, 0x1}, {0x36, 0x1}, {0xb, 0x1}, {0x60, 0x1}, {0x60, 0x1}, {0x2, 0x1}, {0x78}, {0xc, 0x1}, {0x12}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x8084}, 0x2000e050) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x34}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0x9}}, 0xe8) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000140)=0x4) sendmmsg(r1, &(0x7f0000000480), 0x21, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r3) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r8, @ANYBLOB="000128bd7000fddbdf250300000034000980080002000100000008000180ff0f000008000200010001000800020001ffffff08000200001000000800010006000000380007800c00030000100000000000000c0003008000000000000000080002000500000008000100020000000c0004000400000000000000"], 0x80}, 0x1, 0x0, 0x0, 0x400c010}, 0x40810) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") r10 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r10, 0x4c09, 0x8000) r11 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r12 = eventfd(0x0) writev(r12, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) writev(r12, &(0x7f0000000040)=[{&(0x7f0000000000)="aba732e9970a72a4", 0x8}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) mount(&(0x7f0000000400)=@filename='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f0000000000)='qnx4\x00', 0x1800000, 0x0) sendmsg$nl_xfrm(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@flushpolicy={0x10, 0x12, 0x105}, 0x10}}, 0x20040080) [ 75.961337][ T46] Bluetooth: hci0: command tx timeout [ 76.095242][ T5337] loop0: detected capacity change from 0 to 2048 [ 76.144846][ T5337] loop0: p2 p3 < > p4 < p5 > [ 76.147155][ T5337] loop0: partition table partially beyond EOD, truncated [ 76.154328][ T5337] loop0: p3 start 4225 is beyond EOD, truncated [ 76.192598][ T5313] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.197308][ T5313] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.200406][ T5313] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.204882][ T5313] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.208671][ T5313] Buffer I/O error on dev loop0, logical block 0, async page read [ 76.225994][ T5313] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 76.234303][ T5311] Buffer I/O error on dev loop0p5, logical block 0, async page read [ 76.244840][ T5310] Buffer I/O error on dev loop0p4, logical block 0, async page read [ 76.255946][ T5338] qnx4: block size(32768) > page size(4096) not supported by filesystem [ 76.277382][ T5310] Buffer I/O error on dev loop0p4, logical block 0, async page read [ 76.280848][ T5310] Buffer I/O error on dev loop0p4, logical block 0, async page read [ 76.286091][ T5338] ------------[ cut here ]------------ [ 76.288498][ T5338] kernel BUG at fs/buffer.c:1582! [ 76.290576][ T5338] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 76.293366][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.297697][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.302723][ T5338] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 76.305206][ T5338] Code: 4c 89 e2 e8 66 6a 83 02 e9 42 ff ff ff e8 dc bd 72 ff 48 89 df 48 c7 c6 c0 b4 9e 8b e8 bd 1d d8 fe 90 0f 0b e8 c5 bd 72 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 76.313723][ T5338] RSP: 0018:ffffc90009ba79d0 EFLAGS: 00010287 [ 76.316344][ T5338] RAX: ffffffff824fea9b RBX: ffffea0000483800 RCX: 0000000000100000 [ 76.319279][ T5338] RDX: ffffc90021913000 RSI: 000000000000125f RDI: 0000000000001260 [ 76.322374][ T5338] RBP: dffffc0000000000 R08: ffffea0000483807 R09: 1ffffd4000090700 [ 76.325764][ T5338] R10: dffffc0000000000 R11: fffff94000090701 R12: 0000000000000003 [ 76.329324][ T5338] R13: 0000000000008000 R14: ffff888047693658 R15: 0000000000008000 [ 76.332871][ T5338] FS: 00007f5daf2df6c0(0000) GS:ffff88808cf1d000(0000) knlGS:0000000000000000 [ 76.336910][ T5338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.339929][ T5338] CR2: 00007f5daf2ff700 CR3: 000000001f4af000 CR4: 0000000000352ef0 [ 76.343440][ T5338] Call Trace: [ 76.344986][ T5338] [ 76.346329][ T5338] folio_alloc_buffers+0x39f/0x640 [ 76.348540][ T5338] bdev_getblk+0x2cb/0x6e0 [ 76.350221][ T5338] __bread_gfp+0x89/0x3b0 [ 76.351928][ T5338] qnx4_fill_super+0x1c6/0x770 [ 76.353849][ T5338] get_tree_bdev_flags+0x431/0x4f0 [ 76.355749][ T5338] ? __pfx_qnx4_fill_super+0x10/0x10 [ 76.357800][ T5338] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 76.359974][ T5338] vfs_get_tree+0x92/0x2a0 [ 76.361831][ T5338] do_new_mount+0x329/0xa50 [ 76.363717][ T5338] ? apparmor_capable+0x137/0x1a0 [ 76.365773][ T5338] ? __pfx_do_new_mount+0x10/0x10 [ 76.367881][ T5338] ? ns_capable+0x89/0xe0 [ 76.369679][ T5338] ? kmem_cache_free+0x195/0x610 [ 76.371800][ T5338] __se_sys_mount+0x31d/0x420 [ 76.373700][ T5338] ? __pfx___se_sys_mount+0x10/0x10 [ 76.375776][ T5338] ? __x64_sys_mount+0x20/0xc0 [ 76.377819][ T5338] do_syscall_64+0xe2/0xf80 [ 76.379958][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.382709][ T5338] ? trace_irq_disable+0x37/0x100 [ 76.385015][ T5338] ? clear_bhb_loop+0x60/0xb0 [ 76.387229][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.389673][ T5338] RIP: 0033:0x7f5dae39acb9 [ 76.391429][ T5338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.399267][ T5338] RSP: 002b:00007f5daf2df028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 76.402853][ T5338] RAX: ffffffffffffffda RBX: 00007f5dae616090 RCX: 00007f5dae39acb9 [ 76.406540][ T5338] RDX: 0000200000000000 RSI: 0000200000000480 RDI: 0000200000000400 [ 76.410110][ T5338] RBP: 00007f5dae408bf7 R08: 0000000000000000 R09: 0000000000000000 [ 76.413944][ T5338] R10: 0000000001800000 R11: 0000000000000246 R12: 0000000000000000 [ 76.417315][ T5338] R13: 00007f5dae616128 R14: 00007f5dae616090 R15: 00007ffe1365ef38 [ 76.420688][ T5338] [ 76.422075][ T5338] Modules linked in: [ 76.424547][ T5338] ---[ end trace 0000000000000000 ]--- [ 76.475205][ T5338] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 76.477973][ T5338] Code: 4c 89 e2 e8 66 6a 83 02 e9 42 ff ff ff e8 dc bd 72 ff 48 89 df 48 c7 c6 c0 b4 9e 8b e8 bd 1d d8 fe 90 0f 0b e8 c5 bd 72 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 76.487100][ T5338] RSP: 0018:ffffc90009ba79d0 EFLAGS: 00010287 [ 76.490387][ T5338] RAX: ffffffff824fea9b RBX: ffffea0000483800 RCX: 0000000000100000 [ 76.494882][ T5338] RDX: ffffc90021913000 RSI: 000000000000125f RDI: 0000000000001260 [ 76.498568][ T5338] RBP: dffffc0000000000 R08: ffffea0000483807 R09: 1ffffd4000090700 [ 76.502916][ T5338] R10: dffffc0000000000 R11: fffff94000090701 R12: 0000000000000003 [ 76.506503][ T5338] R13: 0000000000008000 R14: ffff888047693658 R15: 0000000000008000 [ 76.510188][ T5338] FS: 00007f5daf2df6c0(0000) GS:ffff88808cf1d000(0000) knlGS:0000000000000000 [ 76.514550][ T5338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.517401][ T5338] CR2: 00007f5dae5e5558 CR3: 000000001f4af000 CR4: 0000000000352ef0 [ 76.521599][ T5338] Kernel panic - not syncing: Fatal exception [ 76.524476][ T5338] Kernel Offset: disabled [ 76.526343][ T5338] Rebooting in 86400 seconds..