program: syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200010, &(0x7f0000000680)=ANY=[@ANYRES64=0x0], 0x1, 0x25a, &(0x7f0000000240)="$eJzs2s9rI2UYB/Bn6sqmXbqp+ItdEF/0oF6Gbc8edpEKYkFRK6yC7KydauyYlE4oRMT2pFf/BM/i0Zsge/TSi3+BB2+99LgHcSRNWtOysIs/mqX7+RySh3nnm7zzvmF4ErL/6refb6zX+XrRj5ksi5nrsRt3s1iImTiyG6+8dPOX5969+cGbN1ZWWuOjSymly8///OGXP7xwp3/p/R8v/3Qx9hY+2j9Y+n3vmb0r+3++92mnTp06dXv9VKTbvV6/uF2Vaa1Tb+QpvV2VRV2mTrcut06Mr1e9zc1BKrpr83ObW2Vdp6I7SBvlIPV7qb81SMUnRaeb8jxP83PBv7H6/d2miYPm8VvRNM3sd3HpTsz/Fu3InkjZk9ezp29lz+5mVw6apn06OjudGfPf+sf7z7kwvqkvv5NSK6L6Znt1e3X0PBxtxY316EQVZVyL2fgjhh+TsVH9+hsry9fSoYX4utoZ53e2Vx87fP3j/GK0Y+He+cVRPh3lL0bE8HFuMr8U7Xjq3vmlU/nR+7fi5Rcn8nm049ePoxdVrMUwGzvjJVj+ajGl195aOZW/engeAMB5k6djw/5t2LSd6N/y/MT4RH80yk/0h+379Ien+qsLcfXCdK+diHrwxUZRVeXW8AveYXF85FEtZieX5UGKo59C/r+JzZzYs4dloRTnuYj4bCp3JM7S35t+31NbZzIhAAAAAAAAAAAAHshZ/J1w2tcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA83P4KAAD//8scwHs=") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124) write$P9_RREADDIR(r0, &(0x7f00000001c0)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7, 0x7, 0xf45b3bccc711007a, './file0'}]}}, 0xfffffceb) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1b, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000050000008500000007000000038498cb070000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0x100000001}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)=r2}, 0x20) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000004c0)={'gre0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x700, 0x8000, 0x0, 0xfffffffe, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xc, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast2, {[@end]}}}}}) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000500), 0x4) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x3}, 0x50) r9 = syz_open_dev$mouse(&(0x7f0000000640), 0xfffffffffffffffe, 0x8500) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000680)={0xffffffffffffffff, 0x10001}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x25, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x3c}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='GPL\x00', 0x6, 0x7, &(0x7f0000000440)=""/7, 0xee8946b01aa8993, 0x0, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000540)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x3, 0x6, 0x1}, 0x10, 0x0, 0x0, 0x8, &(0x7f00000006c0)=[r8, r9, r10], &(0x7f0000000700)=[{0x0, 0x1, 0x7, 0xa}, {0x0, 0x4, 0x3}, {0x2, 0x5, 0xc, 0x2}, {0x1, 0x2, 0x1, 0xb}, {0x5, 0x4, 0x9, 0xc}, {0x5, 0x2, 0x8, 0x2}, {0x5, 0x2, 0xd, 0xc}, {0x5, 0x4, 0x2, 0x5}], 0x10, 0x4}, 0x94) [ 109.458043][ T5289] Bluetooth: hci0: command tx timeout [ 109.534281][ T5325] loop0: detected capacity change from 0 to 128 [ 109.739777][ T5326] loop0: detected capacity change from 128 to 0 [ 109.741869][ T37] I/O error, dev loop0, sector 1 op 0x1:(WRITE) flags 0x800000 phys_seg 1 prio class 2 [ 109.741994][ T37] Buffer I/O error on dev loop0, logical block 1, lost sync page write [ 109.760634][ T5325] ------------[ cut here ]------------ [ 109.760643][ T5325] !buffer_uptodate(bh) [ 109.760646][ T5325] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5325 [ 109.770563][ T5325] Modules linked in: [ 109.772581][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 109.776288][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.780823][ T5325] RIP: 0010:mark_buffer_dirty+0x299/0x410 [ 109.783303][ T5325] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff [ 109.792183][ T5325] RSP: 0018:ffffc9000db87438 EFLAGS: 00010283 [ 109.795025][ T5325] RAX: ffffffff8261a678 RBX: ffff8880426ab0e0 RCX: 0000000000100000 [ 109.798652][ T5325] RDX: ffffc9000e7ea000 RSI: 0000000000021b4b RDI: 0000000000021b4c [ 109.802259][ T5325] RBP: dffffc0000000001 R08: ffff8880426ab0e7 R09: 1ffff110084d561c [ 109.805723][ T5325] R10: dffffc0000000000 R11: ffffed10084d561d R12: dffffc0000000000 [ 109.809345][ T5325] R13: 1ffff92001b70ebe R14: ffffc9000db875f0 R15: ffff888042780788 [ 109.812728][ T5325] FS: 00007f745062d6c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000 [ 109.816521][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.819849][ T5325] CR2: 00007f1e12b909c0 CR3: 0000000011fe4000 CR4: 0000000000352ef0 [ 109.823381][ T5325] Call Trace: [ 109.824878][ T5325] [ 109.826456][ T5325] mmb_mark_buffer_dirty+0x2c/0x1f0 [ 109.829066][ T5325] fat12_ent_put+0x1b7/0x2f0 [ 109.833335][ T5325] fat_ent_write+0xb8/0x190 [ 109.835291][ T5325] fat_chain_add+0x409/0x8e0 [ 109.837400][ T5325] ? __pfx_fat_chain_add+0x10/0x10 [ 109.839800][ T5325] ? clean_bdev_aliases+0x62e/0x750 [ 109.842054][ T5325] ? fat_bmap+0x487/0x5a0 [ 109.843849][ T5325] fat_get_block+0x768/0xae0 [ 109.845680][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 109.847684][ T5325] ? do_raw_spin_unlock+0x4d/0x200 [ 109.849879][ T5325] ? _raw_spin_unlock+0x28/0x50 [ 109.851925][ T5325] ? create_empty_buffers+0x460/0x520 [ 109.854323][ T5325] __block_write_begin_int+0x6c2/0x1900 [ 109.856688][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 109.859023][ T5325] ? __pfx___block_write_begin_int+0x10/0x10 [ 109.861593][ T5325] cont_write_begin+0x71b/0xac0 [ 109.863721][ T5325] ? __pfx_cont_write_begin+0x10/0x10 [ 109.866066][ T5325] ? do_raw_spin_unlock+0x4d/0x200 [ 109.868276][ T5325] ? _raw_spin_unlock+0x28/0x50 [ 109.870844][ T5325] fat_write_begin+0x7a/0x150 [ 109.872968][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 109.875202][ T5325] generic_perform_write+0x2d5/0x8f0 [ 109.877551][ T5325] ? __pfx_generic_perform_write+0x10/0x10 [ 109.880209][ T5325] ? file_update_time_flags+0x3ab/0x440 [ 109.882664][ T5325] ? __generic_file_write_iter+0xf9/0x230 [ 109.885092][ T5325] ? generic_file_write_iter+0x9a/0x330 [ 109.887458][ T5325] generic_file_write_iter+0xae/0x330 [ 109.889931][ T5325] vfs_write+0x612/0xba0 [ 109.891763][ T5325] ? __pfx_vfs_write+0x10/0x10 [ 109.893812][ T5325] ? __fget_files+0x2a/0x420 [ 109.895754][ T5325] ksys_write+0x150/0x270 [ 109.897651][ T5325] ? __pfx_ksys_write+0x10/0x10 [ 109.899974][ T5325] do_syscall_64+0x166/0x520 [ 109.901965][ T5325] ? trace_irq_disable+0x3b/0x140 [ 109.904057][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.906805][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 109.908833][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.911292][ T5325] RIP: 0033:0x7f744f79e159 [ 109.913205][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.921614][ T5325] RSP: 002b:00007f745062cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.924947][ T5325] RAX: ffffffffffffffda RBX: 00007f744fa25fa0 RCX: 00007f744f79e159 [ 109.928167][ T5325] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000005 [ 109.931758][ T5325] RBP: 00007f744f83506b R08: 0000000000000000 R09: 0000000000000000 [ 109.935075][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.938349][ T5325] R13: 00007f744fa26038 R14: 00007f744fa25fa0 R15: 00007fffb22df598 [ 109.941787][ T5325] [ 109.943105][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 109.946016][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 109.949799][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.954052][ T5325] Call Trace: [ 109.955490][ T5325] [ 109.956840][ T5325] vpanic+0x56d/0xa60 [ 109.958597][ T5325] ? __pfx__printk+0x10/0x10 [ 109.960605][ T5325] ? __pfx_vpanic+0x10/0x10 [ 109.962558][ T5325] ? is_bpf_text_address+0x292/0x2b0 [ 109.964866][ T5325] ? is_bpf_text_address+0x26/0x2b0 [ 109.967081][ T5325] panic+0xc5/0xd0 [ 109.968744][ T5325] ? __pfx_panic+0x10/0x10 [ 109.970635][ T5325] __warn+0x315/0x4c0 [ 109.972284][ T5325] ? mark_buffer_dirty+0x299/0x410 [ 109.974286][ T5325] ? mark_buffer_dirty+0x299/0x410 [ 109.976263][ T5325] __report_bug+0x276/0x570 [ 109.978209][ T5325] ? __pfx___schedule+0x10/0x10 [ 109.980453][ T5325] ? mark_buffer_dirty+0x299/0x410 [ 109.982620][ T5325] ? __pfx___report_bug+0x10/0x10 [ 109.984822][ T5325] ? schedule+0x90/0x2b0 [ 109.986709][ T5325] ? __lock_acquire+0x747/0x2de0 [ 109.988875][ T5325] ? mark_buffer_dirty+0x299/0x410 [ 109.991177][ T5325] report_bug+0x16b/0x220 [ 109.993035][ T5325] ? mark_buffer_dirty+0x299/0x410 [ 109.995175][ T5325] ? mark_buffer_dirty+0x29b/0x410 [ 109.997415][ T5325] handle_bug+0x9c/0x200 [ 109.999206][ T5325] exc_invalid_op+0x1a/0x50 [ 110.001160][ T5325] asm_exc_invalid_op+0x1a/0x20 [ 110.003294][ T5325] RIP: 0010:mark_buffer_dirty+0x299/0x410 [ 110.005681][ T5325] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff [ 110.013976][ T5325] RSP: 0018:ffffc9000db87438 EFLAGS: 00010283 [ 110.016679][ T5325] RAX: ffffffff8261a678 RBX: ffff8880426ab0e0 RCX: 0000000000100000 [ 110.019962][ T5325] RDX: ffffc9000e7ea000 RSI: 0000000000021b4b RDI: 0000000000021b4c [ 110.023272][ T5325] RBP: dffffc0000000001 R08: ffff8880426ab0e7 R09: 1ffff110084d561c [ 110.026413][ T5325] R10: dffffc0000000000 R11: ffffed10084d561d R12: dffffc0000000000 [ 110.029702][ T5325] R13: 1ffff92001b70ebe R14: ffffc9000db875f0 R15: ffff888042780788 [ 110.033255][ T5325] ? mark_buffer_dirty+0x298/0x410 [ 110.035578][ T5325] ? mark_buffer_dirty+0x298/0x410 [ 110.037851][ T5325] mmb_mark_buffer_dirty+0x2c/0x1f0 [ 110.040150][ T5325] fat12_ent_put+0x1b7/0x2f0 [ 110.042237][ T5325] fat_ent_write+0xb8/0x190 [ 110.044255][ T5325] fat_chain_add+0x409/0x8e0 [ 110.046143][ T5325] ? __pfx_fat_chain_add+0x10/0x10 [ 110.048073][ T5325] ? clean_bdev_aliases+0x62e/0x750 [ 110.050311][ T5325] ? fat_bmap+0x487/0x5a0 [ 110.052148][ T5325] fat_get_block+0x768/0xae0 [ 110.054240][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 110.056298][ T5325] ? do_raw_spin_unlock+0x4d/0x200 [ 110.058584][ T5325] ? _raw_spin_unlock+0x28/0x50 [ 110.060795][ T5325] ? create_empty_buffers+0x460/0x520 [ 110.063162][ T5325] __block_write_begin_int+0x6c2/0x1900 [ 110.065607][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 110.067838][ T5325] ? __pfx___block_write_begin_int+0x10/0x10 [ 110.070527][ T5325] cont_write_begin+0x71b/0xac0 [ 110.072716][ T5325] ? __pfx_cont_write_begin+0x10/0x10 [ 110.075093][ T5325] ? do_raw_spin_unlock+0x4d/0x200 [ 110.077401][ T5325] ? _raw_spin_unlock+0x28/0x50 [ 110.079571][ T5325] fat_write_begin+0x7a/0x150 [ 110.081651][ T5325] ? __pfx_fat_get_block+0x10/0x10 [ 110.083658][ T5325] generic_perform_write+0x2d5/0x8f0 [ 110.085744][ T5325] ? __pfx_generic_perform_write+0x10/0x10 [ 110.088270][ T5325] ? file_update_time_flags+0x3ab/0x440 [ 110.090748][ T5325] ? __generic_file_write_iter+0xf9/0x230 [ 110.093285][ T5325] ? generic_file_write_iter+0x9a/0x330 [ 110.095745][ T5325] generic_file_write_iter+0xae/0x330 [ 110.098152][ T5325] vfs_write+0x612/0xba0 [ 110.100034][ T5325] ? __pfx_vfs_write+0x10/0x10 [ 110.108252][ T5325] ? __fget_files+0x2a/0x420 [ 110.110270][ T5325] ksys_write+0x150/0x270 [ 110.112158][ T5325] ? __pfx_ksys_write+0x10/0x10 [ 110.114105][ T5325] do_syscall_64+0x166/0x520 [ 110.116155][ T5325] ? trace_irq_disable+0x3b/0x140 [ 110.118408][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.121039][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 110.123166][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.125744][ T5325] RIP: 0033:0x7f744f79e159 [ 110.127759][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.135958][ T5325] RSP: 002b:00007f745062cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 110.141627][ T5325] RAX: ffffffffffffffda RBX: 00007f744fa25fa0 RCX: 00007f744f79e159 [ 110.145193][ T5325] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000005 [ 110.148746][ T5325] RBP: 00007f744f83506b R08: 0000000000000000 R09: 0000000000000000 [ 110.152050][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.155366][ T5325] R13: 00007f744fa26038 R14: 00007f744fa25fa0 R15: 00007fffb22df598 [ 110.158690][ T5325] [ 110.160365][ T5325] Kernel Offset: disabled [ 110.162145][ T5325] Rebooting in 86400 seconds..