program:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200010, &(0x7f0000000680)=ANY=[@ANYRES64=0x0], 0x1, 0x25a, &(0x7f0000000240)="$eJzs2s9rI2UYB/Bn6sqmXbqp+ItdEF/0oF6Gbc8edpEKYkFRK6yC7KydauyYlE4oRMT2pFf/BM/i0Zsge/TSi3+BB2+99LgHcSRNWtOysIs/mqX7+RySh3nnm7zzvmF4ErL/6refb6zX+XrRj5ksi5nrsRt3s1iImTiyG6+8dPOX5969+cGbN1ZWWuOjSymly8///OGXP7xwp3/p/R8v/3Qx9hY+2j9Y+n3vmb0r+3++92mnTp06dXv9VKTbvV6/uF2Vaa1Tb+QpvV2VRV2mTrcut06Mr1e9zc1BKrpr83ObW2Vdp6I7SBvlIPV7qb81SMUnRaeb8jxP83PBv7H6/d2miYPm8VvRNM3sd3HpTsz/Fu3InkjZk9ezp29lz+5mVw6apn06OjudGfPf+sf7z7kwvqkvv5NSK6L6Znt1e3X0PBxtxY316EQVZVyL2fgjhh+TsVH9+hsry9fSoYX4utoZ53e2Vx87fP3j/GK0Y+He+cVRPh3lL0bE8HFuMr8U7Xjq3vmlU/nR+7fi5Rcn8nm049ePoxdVrMUwGzvjJVj+ajGl195aOZW/engeAMB5k6djw/5t2LSd6N/y/MT4RH80yk/0h+379Ien+qsLcfXCdK+diHrwxUZRVeXW8AveYXF85FEtZieX5UGKo59C/r+JzZzYs4dloRTnuYj4bCp3JM7S35t+31NbZzIhAAAAAAAAAAAAHshZ/J1w2tcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA83P4KAAD//8scwHs=")
r0 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0xfdfffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94)
bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8)
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1000, 0x1, 0x400, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r0}, &(0x7f00000005c0), &(0x7f0000000700)=r3}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x15, &(0x7f0000000780)=@raw=[@generic={0x62, 0xa, 0x0, 0xfffc, 0xfffffffc}, @map_fd={0x18, 0x1, 0x1, 0x0, r4}, @generic={0xbf, 0x2, 0xa}, @initr0={0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x62b0}, @call={0x85, 0x0, 0x0, 0x80}, @generic={0x7, 0x0, 0x0, 0x0, 0xfcc}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @generic={0xb7, 0x2, 0x8, 0x0, 0x6}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @generic={0xb7, 0x0, 0x0, 0x0, 0x4}, @cb_func={0x18, 0x3}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1}, @generic={0x1, 0xd, 0x8, 0x3, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0xc6, 0x0, 0x0, 0x0, 0x1a86}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_open_dev$tty1(0xc, 0x4, 0x3)
r5 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124)
write$P9_RREADDIR(r5, &(0x7f00000001c0)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7, 0x7, 0xf45b3bccc711007a, './file0'}]}}, 0xfffffceb)
mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0)
r6 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97)
ioctl$LOOP_SET_STATUS64(r6, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]})
getsockname$tipc(r5, &(0x7f00000004c0)=@id, &(0x7f0000000500)=0x10)
[ 86.323111][ T4645] Bluetooth: hci0: command tx timeout
[ 86.429487][ T5323] loop0: detected capacity change from 0 to 128
[ 86.880309][ T9] cfg80211: failed to load regulatory.db
[ 87.068153][ T1052] I/O error, dev loop0, sector 1 op 0x1:(WRITE) flags 0x800000 phys_seg 1 prio class 2
[ 87.068593][ T1052] Buffer I/O error on dev loop0, logical block 1, lost sync page write
[ 87.069079][ T5324] ------------[ cut here ]------------
[ 87.069089][ T5324] !buffer_uptodate(bh)
[ 87.069094][ T5324] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5324
[ 87.111916][ T5324] Modules linked in:
[ 87.114915][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.121842][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.131225][ T5324] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 87.136208][ T5324] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 87.155495][ T5324] RSP: 0018:ffffc9000ddd7438 EFLAGS: 00010283
[ 87.158688][ T5324] RAX: ffffffff8261a678 RBX: ffff8880426ccd20 RCX: 0000000000100000
[ 87.168653][ T5324] RDX: ffffc9000f489000 RSI: 0000000000021290 RDI: 0000000000021291
[ 87.178569][ T5324] RBP: dffffc0000000001 R08: ffff8880426ccd27 R09: 1ffff110084d99a4
[ 87.187087][ T5324] R10: dffffc0000000000 R11: ffffed10084d99a5 R12: dffffc0000000000
[ 87.197763][ T5324] R13: 1ffff92001bbaebe R14: ffffc9000ddd75f0 R15: ffff8880427ec788
[ 87.202267][ T5324] FS: 00007ffb3ef2c6c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 87.217893][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.228438][ T5324] CR2: 00007ffb3eee9fe8 CR3: 00000000355a6000 CR4: 0000000000352ef0
[ 87.240442][ T5324] Call Trace:
[ 87.255403][ T5324]
[ 87.257493][ T5324] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 87.260703][ T5324] fat12_ent_put+0x1b7/0x2f0
[ 87.263437][ T5324] fat_ent_write+0xb8/0x190
[ 87.265669][ T5324] fat_chain_add+0x409/0x8e0
[ 87.268163][ T5324] ? __pfx_fat_chain_add+0x10/0x10
[ 87.271106][ T5324] ? clean_bdev_aliases+0x62e/0x750
[ 87.288639][ T5324] ? fat_bmap+0x487/0x5a0
[ 87.290470][ T5324] fat_get_block+0x768/0xae0
[ 87.292844][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.294998][ T5324] ? do_raw_spin_unlock+0x4d/0x200
[ 87.298518][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.301768][ T5324] ? create_empty_buffers+0x460/0x520
[ 87.318063][ T5324] __block_write_begin_int+0x6c2/0x1900
[ 87.321294][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.324113][ T5324] ? __pfx___block_write_begin_int+0x10/0x10
[ 87.328134][ T5324] cont_write_begin+0x71b/0xac0
[ 87.330387][ T5324] ? __pfx_cont_write_begin+0x10/0x10
[ 87.344427][ T5324] ? do_raw_spin_unlock+0x4d/0x200
[ 87.347017][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.349436][ T5324] fat_write_begin+0x7a/0x150
[ 87.353322][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.364143][ T5324] generic_perform_write+0x2d5/0x8f0
[ 87.367063][ T5324] ? __pfx_generic_perform_write+0x10/0x10
[ 87.370439][ T5324] ? file_update_time_flags+0x3ab/0x440
[ 87.383449][ T5324] ? __generic_file_write_iter+0xf9/0x230
[ 87.387089][ T5324] ? generic_file_write_iter+0x9a/0x330
[ 87.390196][ T5324] generic_file_write_iter+0xae/0x330
[ 87.403869][ T5324] vfs_write+0x612/0xba0
[ 87.408831][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 87.411421][ T5324] ? __fget_files+0x2a/0x420
[ 87.423886][ T5324] ksys_write+0x150/0x270
[ 87.426853][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 87.430004][ T5324] do_syscall_64+0x166/0x520
[ 87.451725][ T5324] ? trace_irq_disable+0x3b/0x140
[ 87.471229][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.474771][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 87.477612][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.482858][ T5324] RIP: 0033:0x7ffb3df9e159
[ 87.495386][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.533032][ T5324] RSP: 002b:00007ffb3ef2bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.536912][ T5324] RAX: ffffffffffffffda RBX: 00007ffb3e226090 RCX: 00007ffb3df9e159
[ 87.553852][ T5324] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 000000000000000a
[ 87.558862][ T5324] RBP: 00007ffb3e03506b R08: 0000000000000000 R09: 0000000000000000
[ 87.564557][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.577029][ T5324] R13: 00007ffb3e226128 R14: 00007ffb3e226090 R15: 00007ffefa3e96b8
[ 87.583290][ T5324]
[ 87.593942][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.598043][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.613010][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.622955][ T5324] Call Trace:
[ 87.634124][ T5324]
[ 87.635633][ T5324] vpanic+0x56d/0xa60
[ 87.637864][ T5324] ? __pfx__printk+0x10/0x10
[ 87.640458][ T5324] ? __pfx_vpanic+0x10/0x10
[ 87.642854][ T5324] ? is_bpf_text_address+0x292/0x2b0
[ 87.657794][ T5324] ? is_bpf_text_address+0x26/0x2b0
[ 87.660960][ T5324] panic+0xc5/0xd0
[ 87.676056][ T5324] ? __pfx_panic+0x10/0x10
[ 87.678426][ T5324] __warn+0x315/0x4c0
[ 87.680544][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.685714][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.689621][ T5324] __report_bug+0x276/0x570
[ 87.704660][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.707182][ T5324] ? __pfx___report_bug+0x10/0x10
[ 87.709567][ T5324] ? irqentry_exit+0x218/0x910
[ 87.712642][ T5324] ? trace_irq_disable+0x3b/0x140
[ 87.724252][ T5324] ? mark_buffer_dirty+0x29b/0x410
[ 87.728587][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.733212][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.736276][ T5324] report_bug+0x16b/0x220
[ 87.738224][ T5324] ? mark_buffer_dirty+0x299/0x410
[ 87.740465][ T5324] ? mark_buffer_dirty+0x29b/0x410
[ 87.752946][ T5324] handle_bug+0x9c/0x200
[ 87.755300][ T5324] exc_invalid_op+0x1a/0x50
[ 87.757335][ T5324] asm_exc_invalid_op+0x1a/0x20
[ 87.759561][ T5324] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 87.762228][ T5324] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 87.790025][ T5324] RSP: 0018:ffffc9000ddd7438 EFLAGS: 00010283
[ 87.799870][ T5324] RAX: ffffffff8261a678 RBX: ffff8880426ccd20 RCX: 0000000000100000
[ 87.804986][ T5324] RDX: ffffc9000f489000 RSI: 0000000000021290 RDI: 0000000000021291
[ 87.816515][ T5324] RBP: dffffc0000000001 R08: ffff8880426ccd27 R09: 1ffff110084d99a4
[ 87.822825][ T5324] R10: dffffc0000000000 R11: ffffed10084d99a5 R12: dffffc0000000000
[ 87.836001][ T5324] R13: 1ffff92001bbaebe R14: ffffc9000ddd75f0 R15: ffff8880427ec788
[ 87.840614][ T5324] ? mark_buffer_dirty+0x298/0x410
[ 87.854169][ T5324] ? mark_buffer_dirty+0x298/0x410
[ 87.857170][ T5324] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 87.860670][ T5324] fat12_ent_put+0x1b7/0x2f0
[ 87.864294][ T5324] fat_ent_write+0xb8/0x190
[ 87.875432][ T5324] fat_chain_add+0x409/0x8e0
[ 87.879318][ T5324] ? __pfx_fat_chain_add+0x10/0x10
[ 87.883075][ T5324] ? clean_bdev_aliases+0x62e/0x750
[ 87.895183][ T5324] ? fat_bmap+0x487/0x5a0
[ 87.899044][ T5324] fat_get_block+0x768/0xae0
[ 87.902442][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.904785][ T5324] ? do_raw_spin_unlock+0x4d/0x200
[ 87.907234][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.909541][ T5324] ? create_empty_buffers+0x460/0x520
[ 87.932225][ T5324] __block_write_begin_int+0x6c2/0x1900
[ 87.937646][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.952579][ T5324] ? __pfx___block_write_begin_int+0x10/0x10
[ 87.956261][ T5324] cont_write_begin+0x71b/0xac0
[ 87.959206][ T5324] ? __pfx_cont_write_begin+0x10/0x10
[ 87.962104][ T5324] ? do_raw_spin_unlock+0x4d/0x200
[ 87.977118][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.979593][ T5324] fat_write_begin+0x7a/0x150
[ 87.989412][ T5324] ? __pfx_fat_get_block+0x10/0x10
[ 87.995922][ T5324] generic_perform_write+0x2d5/0x8f0
[ 87.998150][ T5324] ? __pfx_generic_perform_write+0x10/0x10
[ 88.017516][ T5324] ? file_update_time_flags+0x3ab/0x440
[ 88.033273][ T5324] ? __generic_file_write_iter+0xf9/0x230
[ 88.035933][ T5324] ? generic_file_write_iter+0x9a/0x330
[ 88.038559][ T5324] generic_file_write_iter+0xae/0x330
[ 88.041323][ T5324] vfs_write+0x612/0xba0
[ 88.055545][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 88.057814][ T5324] ? __fget_files+0x2a/0x420
[ 88.060205][ T5324] ksys_write+0x150/0x270
[ 88.075981][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 88.078408][ T5324] do_syscall_64+0x166/0x520
[ 88.081141][ T5324] ? trace_irq_disable+0x3b/0x140
[ 88.085666][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.094373][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 88.097222][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.105850][ T5324] RIP: 0033:0x7ffb3df9e159
[ 88.113561][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.140961][ T5324] RSP: 002b:00007ffb3ef2bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 88.154741][ T5324] RAX: ffffffffffffffda RBX: 00007ffb3e226090 RCX: 00007ffb3df9e159
[ 88.159006][ T5324] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 000000000000000a
[ 88.174626][ T5324] RBP: 00007ffb3e03506b R08: 0000000000000000 R09: 0000000000000000
[ 88.180590][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.188256][ T5324] R13: 00007ffb3e226128 R14: 00007ffb3e226090 R15: 00007ffefa3e96b8
[ 88.196067][ T5324]
[ 88.198506][ T5324] Kernel Offset: disabled
[ 88.201450][ T5324] Rebooting in 86400 seconds..