program:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008890)
syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x10, &(0x7f0000001680)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee01, @ANYBLOB=',umask=000000000000000001,\x00\x00\x00\x00\x00\x00'], 0x1, 0x542, &(0x7f0000000b40)="$eJzs2s9qE1EUB+BjE9MiglmLiwE3rkL1CQySQnFAiMxCceFA4yYjwsxmklUfxCfweXySrLqLtBPaxn8bm05jvg+Ge5jfDJzLwNy7uB+ffJ6efKk+ffj+NQ5eJtGNiL2ziH7sRSca91bj3kXdi+tOAwDYNuNxPmy7BzarLIf5+R5u/5ck+9ZKQwAAAAAAAAAAAPwz5/8BYPc4////K8th3lvt39Y5/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC052y5fLT8y9V2fwDAzbP+A8Dusf4DwO6x/gPA7nn77v3rYZqOxklyELE4rbM6a8YmPzpOR4fJhf7VW4u6zjqX+fMmT9bz+/Fglb/4bd6LZ0+b/Dx79Sb9Kd+Pk81PHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhmkFzqX91d1HXWafLBn/KmOjpOR4erB9bzbjzu3to0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBtQzebTvCgmpWKLi8HD5mvelX4U21+0/WcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADaUs3m07woJmXVdicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF1RzebTvCgm5QaLtucIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA7fsRAAD//7BtjrY=")
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
open(&(0x7f0000000080)='./bus\x00', 0x1c92fe, 0x147)
r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124)
write$P9_RREADDIR(r1, &(0x7f00000001c0)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7, 0x7, 0xf45b3bccc711007a, './file0'}]}}, 0xfffffceb) (fail_nth: 15)
mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97)
ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]})
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x44, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x840}, 0x0)
sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x38, 0xb, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}}, 0x4800)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x40441, 0x106)
fallocate(r4, 0x8, 0x0, 0x10000)
mmap$snddsp_status(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x4, 0x11, r4, 0x82000000)
[ 101.657109][ T5329] loop0: detected capacity change from 0 to 2048
[ 101.658437][ T4650] Bluetooth: hci0: command tx timeout
[ 101.843310][ T5330] loop0: detected capacity change from 2048 to 0
[ 101.844298][ T179] I/O error, dev loop0, sector 128 op 0x1:(WRITE) flags 0x800000 phys_seg 1 prio class 2
[ 101.844509][ T179] Buffer I/O error on dev loop0, logical block 32, lost sync page write
[ 101.845033][ T5329] ------------[ cut here ]------------
[ 101.845059][ T5329] !buffer_uptodate(bh)
[ 101.845093][ T5329] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5329
[ 101.865057][ T5329] Modules linked in:
[ 101.867188][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 101.871134][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.875752][ T5329] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 101.878288][ T5329] Code: 4c 89 f7 e8 d9 01 d8 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 4f 63 66 ff eb 8c e8 48 63 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 3a 63 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 101.886553][ T5329] RSP: 0018:ffffc9000f68f470 EFLAGS: 00010293
[ 101.889250][ T5329] RAX: ffffffff82617318 RBX: ffff888044224700 RCX: ffff888033fd8000
[ 101.892958][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 101.896445][ T5329] RBP: dffffc0000000001 R08: ffff888044224707 R09: 1ffff110088448e0
[ 101.899906][ T5329] R10: dffffc0000000000 R11: ffffed10088448e1 R12: ffffffff8c28ac40
[ 101.903603][ T5329] R13: ffff8880369f4248 R14: dffffc0000000000 R15: ffff888013258788
[ 101.907174][ T5329] FS: 00007f0c82a646c0(0000) GS:ffff88808c2ca000(0000) knlGS:0000000000000000
[ 101.911023][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 101.914128][ T5329] CR2: 00007f42faa18000 CR3: 0000000012faf000 CR4: 0000000000352ef0
[ 101.917642][ T5329] Call Trace:
[ 101.919214][ T5329]
[ 101.920533][ T5329] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 101.923007][ T5329] fat_ent_write+0xb8/0x190
[ 101.925085][ T5329] fat_chain_add+0x409/0x8e0
[ 101.927160][ T5329] ? __pfx_fat_chain_add+0x10/0x10
[ 101.929368][ T5329] ? fat_bmap+0x487/0x5a0
[ 101.931460][ T5329] fat_get_block+0x768/0xae0
[ 101.933556][ T5329] ? lock_acquire+0x115/0x350
[ 101.935705][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 101.938018][ T5329] ? do_raw_spin_unlock+0x4d/0x200
[ 101.940274][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 101.942642][ T5329] ? create_empty_buffers+0x460/0x520
[ 101.945013][ T5329] __block_write_begin_int+0x6c2/0x1900
[ 101.947471][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 101.949655][ T5329] ? __pfx___block_write_begin_int+0x10/0x10
[ 101.952458][ T5329] cont_write_begin+0x71b/0xac0
[ 101.954715][ T5329] ? __pfx_cont_write_begin+0x10/0x10
[ 101.957102][ T5329] ? do_raw_spin_unlock+0x4d/0x200
[ 101.959561][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 101.961887][ T5329] fat_write_begin+0x7a/0x150
[ 101.963957][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 101.966190][ T5329] generic_perform_write+0x2d5/0x8f0
[ 101.968938][ T5329] ? __pfx_generic_perform_write+0x10/0x10
[ 101.971918][ T5329] ? file_update_time_flags+0x3ab/0x440
[ 101.974336][ T5329] ? __generic_file_write_iter+0xf9/0x230
[ 101.976754][ T5329] ? generic_file_write_iter+0x9a/0x330
[ 101.979174][ T5329] generic_file_write_iter+0xae/0x330
[ 101.981604][ T5329] vfs_write+0x612/0xba0
[ 101.983498][ T5329] ? __pfx_vfs_write+0x10/0x10
[ 101.985617][ T5329] ? __fget_files+0x2a/0x420
[ 101.987671][ T5329] ksys_write+0x150/0x270
[ 101.989518][ T5329] ? __pfx_ksys_write+0x10/0x10
[ 101.991820][ T5329] do_syscall_64+0x166/0x520
[ 101.993879][ T5329] ? trace_irq_disable+0x3b/0x140
[ 101.996045][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.998854][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 102.000884][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.003488][ T5329] RIP: 0033:0x7f0c81b9e159
[ 102.005437][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.013600][ T5329] RSP: 002b:00007f0c82a63fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.017143][ T5329] RAX: ffffffffffffffda RBX: 00007f0c81e25fa0 RCX: 00007f0c81b9e159
[ 102.020504][ T5329] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000006
[ 102.023894][ T5329] RBP: 00007f0c82a64050 R08: 0000000000000000 R09: 0000000000000000
[ 102.027203][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 102.030646][ T5329] R13: 00007f0c81e26038 R14: 00007f0c81e25fa0 R15: 00007ffe2fb1fcd8
[ 102.034051][ T5329]
[ 102.035401][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 102.038881][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.042880][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.046894][ T5329] Call Trace:
[ 102.048315][ T5329]
[ 102.049587][ T5329] vpanic+0x56d/0xa60
[ 102.051290][ T5329] ? __pfx__printk+0x10/0x10
[ 102.053354][ T5329] ? __pfx_vpanic+0x10/0x10
[ 102.055268][ T5329] ? is_bpf_text_address+0x292/0x2b0
[ 102.057451][ T5329] ? is_bpf_text_address+0x26/0x2b0
[ 102.059590][ T5329] panic+0xc5/0xd0
[ 102.061119][ T5329] ? __pfx_panic+0x10/0x10
[ 102.062903][ T5329] __warn+0x315/0x4c0
[ 102.064508][ T5329] ? mark_buffer_dirty+0x299/0x410
[ 102.066622][ T5329] ? mark_buffer_dirty+0x299/0x410
[ 102.068697][ T5329] __report_bug+0x276/0x570
[ 102.070504][ T5329] ? mark_buffer_dirty+0x299/0x410
[ 102.072571][ T5329] ? __pfx___report_bug+0x10/0x10
[ 102.074608][ T5329] ? schedule+0x16e/0x2b0
[ 102.076319][ T5329] ? io_schedule+0x7f/0xd0
[ 102.078126][ T5329] ? mark_buffer_dirty+0x299/0x410
[ 102.080177][ T5329] report_bug+0x16b/0x220
[ 102.081896][ T5329] ? mark_buffer_dirty+0x299/0x410
[ 102.083924][ T5329] ? mark_buffer_dirty+0x29b/0x410
[ 102.085916][ T5329] handle_bug+0x9c/0x200
[ 102.087647][ T5329] exc_invalid_op+0x1a/0x50
[ 102.089436][ T5329] asm_exc_invalid_op+0x1a/0x20
[ 102.091312][ T5329] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 102.093509][ T5329] Code: 4c 89 f7 e8 d9 01 d8 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 4f 63 66 ff eb 8c e8 48 63 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 3a 63 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 102.100889][ T5329] RSP: 0018:ffffc9000f68f470 EFLAGS: 00010293
[ 102.103272][ T5329] RAX: ffffffff82617318 RBX: ffff888044224700 RCX: ffff888033fd8000
[ 102.106371][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 102.109439][ T5329] RBP: dffffc0000000001 R08: ffff888044224707 R09: 1ffff110088448e0
[ 102.112562][ T5329] R10: dffffc0000000000 R11: ffffed10088448e1 R12: ffffffff8c28ac40
[ 102.115755][ T5329] R13: ffff8880369f4248 R14: dffffc0000000000 R15: ffff888013258788
[ 102.118908][ T5329] ? mark_buffer_dirty+0x298/0x410
[ 102.120961][ T5329] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 102.123057][ T5329] fat_ent_write+0xb8/0x190
[ 102.124915][ T5329] fat_chain_add+0x409/0x8e0
[ 102.126819][ T5329] ? __pfx_fat_chain_add+0x10/0x10
[ 102.128946][ T5329] ? fat_bmap+0x487/0x5a0
[ 102.130717][ T5329] fat_get_block+0x768/0xae0
[ 102.132564][ T5329] ? lock_acquire+0x115/0x350
[ 102.134434][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 102.136432][ T5329] ? do_raw_spin_unlock+0x4d/0x200
[ 102.138583][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 102.140583][ T5329] ? create_empty_buffers+0x460/0x520
[ 102.142799][ T5329] __block_write_begin_int+0x6c2/0x1900
[ 102.144962][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 102.147096][ T5329] ? __pfx___block_write_begin_int+0x10/0x10
[ 102.149469][ T5329] cont_write_begin+0x71b/0xac0
[ 102.151499][ T5329] ? __pfx_cont_write_begin+0x10/0x10
[ 102.153634][ T5329] ? do_raw_spin_unlock+0x4d/0x200
[ 102.155616][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 102.157742][ T5329] fat_write_begin+0x7a/0x150
[ 102.159710][ T5329] ? __pfx_fat_get_block+0x10/0x10
[ 102.161794][ T5329] generic_perform_write+0x2d5/0x8f0
[ 102.163780][ T5329] ? __pfx_generic_perform_write+0x10/0x10
[ 102.166108][ T5329] ? file_update_time_flags+0x3ab/0x440
[ 102.168724][ T5329] ? __generic_file_write_iter+0xf9/0x230
[ 102.171216][ T5329] ? generic_file_write_iter+0x9a/0x330
[ 102.173631][ T5329] generic_file_write_iter+0xae/0x330
[ 102.176045][ T5329] vfs_write+0x612/0xba0
[ 102.177984][ T5329] ? __pfx_vfs_write+0x10/0x10
[ 102.180127][ T5329] ? __fget_files+0x2a/0x420
[ 102.182173][ T5329] ksys_write+0x150/0x270
[ 102.184057][ T5329] ? __pfx_ksys_write+0x10/0x10
[ 102.186183][ T5329] do_syscall_64+0x166/0x520
[ 102.188237][ T5329] ? trace_irq_disable+0x3b/0x140
[ 102.190508][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.193287][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 102.195357][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.198056][ T5329] RIP: 0033:0x7f0c81b9e159
[ 102.200143][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.209326][ T5329] RSP: 002b:00007f0c82a63fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.214062][ T5329] RAX: ffffffffffffffda RBX: 00007f0c81e25fa0 RCX: 00007f0c81b9e159
[ 102.218862][ T5329] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000006
[ 102.222813][ T5329] RBP: 00007f0c82a64050 R08: 0000000000000000 R09: 0000000000000000
[ 102.226534][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 102.230063][ T5329] R13: 00007f0c81e26038 R14: 00007f0c81e25fa0 R15: 00007ffe2fb1fcd8
[ 102.233554][ T5329]
[ 102.235383][ T5329] Kernel Offset: disabled
[ 102.237446][ T5329] Rebooting in 86400 seconds..