program:
r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x19, 0x101000)
ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000100)={0x0, 0x0, {0xfffff7ff, 0xfffffffe, 0x300d, 0x7, 0x7, 0x6, 0x1, 0xb}}) (async)
syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xaf, &(0x7f0000000380)="$eJzs1zFKA0EABdDvCmprI4KF9TbewaOIpTZipQjeIOQiuUqOsH2KFNuGkAnJbgghqVKkWN4rBv58Bqb908XkaVwn5T8p9ePXrOx9//x+vH12ZxikKsltkrskz/ddnr923VXfN+3fe9NeHz++GV38vwAAwPmqvBzmVekvlv0K3E6Dh12/CTkxBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGah0AAP//ghMolg==")
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x96)
pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xc00) (async)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f00000008c0), 0xfecc) (async)
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0x1, 0x1000000, 0x8010, r3, 0x0) (async)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x18, 0x0, &(0x7f0000000180)=[@enter_looper, @release={0x40046306, 0x3}, @dead_binder_done], 0xd4, 0x0, &(0x7f0000000280)="4a68eca3dfcab1d6bff83912b834852deb34d070c59c8c22e021a15686600396cffb65104ebd8445011b6c03151306efea92e01d5cff58af73d28d369364278814b9518012d1941597aad3e98b392310136cd8f747754a7eeeca52848056099198996fe30f2b5c8585c8dca55d36f8d4b33cb8e6ada0b870fca36f3c588f314119a0df0e51f21a634f341e942fa1e5531e2646b7f253fd7c340b52561d86cab9228b63b90edb9021f0c5444a9827ea7e26bff68e74d3a6b994b0a87f945f9d7a371db865826a0707bb584c1d457efd981b654e86"})
[ 109.305854][ T4649] Bluetooth: hci0: command tx timeout
[ 109.368884][ T5331] loop0: detected capacity change from 0 to 64
[ 109.454054][ T5332] ------------[ cut here ]------------
[ 109.456716][ T5332] !buffer_uptodate(bh)
[ 109.456726][ T5332] WARNING: fs/buffer.c:1093 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5332
[ 109.463724][ T5332] Modules linked in:
[ 109.466410][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.470212][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.475460][ T5332] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 109.478195][ T5332] Code: 4c 89 f7 e8 c9 11 d9 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 d4 5e fb ff e8 8f f3 69 ff eb 8c e8 88 f3 69 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 7a f3 69 ff 90 0f 0b 90 e9 cf fd ff ff
[ 109.485793][ T5332] RSP: 0018:ffffc90005757828 EFLAGS: 00010293
[ 109.488704][ T5332] RAX: ffffffff825c7e88 RBX: ffff888043b350e0 RCX: ffff88801f6b2540
[ 109.492738][ T5332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 109.496247][ T5332] RBP: 0000000000000201 R08: ffff888043b350e7 R09: 1ffff11008766a1c
[ 109.499624][ T5332] R10: dffffc0000000000 R11: ffffed1008766a1d R12: 0000000000000010
[ 109.502855][ T5332] R13: ffff888043b350e0 R14: ffff888043b29d20 R15: dffffc0000000000
[ 109.508004][ T5332] FS: 00007f97400536c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000
[ 109.513097][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.516735][ T5332] CR2: 00007fff19e5bfc0 CR3: 0000000043c11000 CR4: 0000000000352ef0
[ 109.520167][ T5332] Call Trace:
[ 109.521548][ T5332]
[ 109.522912][ T5332] bfs_get_block+0x5c6/0xb50
[ 109.524905][ T5332] __block_write_begin_int+0x6c2/0x1900
[ 109.527414][ T5332] ? __pfx_bfs_get_block+0x10/0x10
[ 109.530108][ T5332] ? __pfx___block_write_begin_int+0x10/0x10
[ 109.533150][ T5332] ? __pfx_bfs_get_block+0x10/0x10
[ 109.535467][ T5332] block_write_begin+0x8d/0x120
[ 109.537683][ T5332] ? bfs_write_begin+0x1e/0xd0
[ 109.539826][ T5332] bfs_write_begin+0x35/0xd0
[ 109.541784][ T5332] generic_perform_write+0x2d5/0x8f0
[ 109.544042][ T5332] ? __pfx_generic_perform_write+0x10/0x10
[ 109.546799][ T5332] ? file_update_time_flags+0x219/0x4a0
[ 109.550225][ T5332] ? __generic_file_write_iter+0xf9/0x230
[ 109.553536][ T5332] ? generic_file_write_iter+0x9a/0x330
[ 109.556161][ T5332] generic_file_write_iter+0xae/0x330
[ 109.558582][ T5332] vfs_write+0x612/0xba0
[ 109.560551][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 109.562980][ T5332] ? __fget_files+0x2a/0x420
[ 109.565504][ T5332] ksys_write+0x150/0x270
[ 109.567763][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 109.569788][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.572370][ T5332] do_syscall_64+0x174/0x580
[ 109.574462][ T5332] ? trace_irq_disable+0x3b/0x140
[ 109.576913][ T5332] ? clear_bhb_loop+0x40/0x90
[ 109.579282][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.582429][ T5332] RIP: 0033:0x7f973f19ce59
[ 109.584612][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 109.593300][ T5332] RSP: 002b:00007f9740052fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 109.597910][ T5332] RAX: ffffffffffffffda RBX: 00007f973f416090 RCX: 00007f973f19ce59
[ 109.601851][ T5332] RDX: 000000000000fecc RSI: 00002000000008c0 RDI: 0000000000000006
[ 109.605418][ T5332] RBP: 00007f973f232e6f R08: 0000000000000000 R09: 0000000000000000
[ 109.609049][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.612620][ T5332] R13: 00007f973f416128 R14: 00007f973f416090 R15: 00007fff19e5c9a8
[ 109.616760][ T5332]
[ 109.618400][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 109.621697][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.625528][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.630512][ T5332] Call Trace:
[ 109.632293][ T5332]
[ 109.633676][ T5332] vpanic+0x56c/0xa60
[ 109.635320][ T5332] ? __pfx__printk+0x10/0x10
[ 109.637246][ T5332] ? __pfx_vpanic+0x10/0x10
[ 109.639213][ T5332] ? is_bpf_text_address+0x292/0x2b0
[ 109.641565][ T5332] ? is_bpf_text_address+0x26/0x2b0
[ 109.644202][ T5332] panic+0xc5/0xd0
[ 109.646146][ T5332] ? __pfx_panic+0x10/0x10
[ 109.648165][ T5332] __warn+0x315/0x4c0
[ 109.649914][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 109.652193][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 109.654659][ T5332] __report_bug+0x331/0x530
[ 109.657001][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 109.659338][ T5332] ? __pfx___report_bug+0x10/0x10
[ 109.661461][ T5332] ? lockdep_hardirqs_on+0x7a/0x110
[ 109.663796][ T5332] ? irqentry_exit+0x218/0x8f0
[ 109.666244][ T5332] ? trace_irq_disable+0x3b/0x140
[ 109.669202][ T5332] ? mark_buffer_dirty+0x29b/0x410
[ 109.671970][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 109.674190][ T5332] report_bug+0x16a/0x220
[ 109.676046][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 109.678462][ T5332] ? mark_buffer_dirty+0x29b/0x410
[ 109.680842][ T5332] handle_bug+0x9c/0x200
[ 109.682787][ T5332] exc_invalid_op+0x1a/0x50
[ 109.684659][ T5332] asm_exc_invalid_op+0x1a/0x20
[ 109.686661][ T5332] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 109.689004][ T5332] Code: 4c 89 f7 e8 c9 11 d9 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 d4 5e fb ff e8 8f f3 69 ff eb 8c e8 88 f3 69 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 7a f3 69 ff 90 0f 0b 90 e9 cf fd ff ff
[ 109.698269][ T5332] RSP: 0018:ffffc90005757828 EFLAGS: 00010293
[ 109.700838][ T5332] RAX: ffffffff825c7e88 RBX: ffff888043b350e0 RCX: ffff88801f6b2540
[ 109.704226][ T5332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 109.708052][ T5332] RBP: 0000000000000201 R08: ffff888043b350e7 R09: 1ffff11008766a1c
[ 109.711865][ T5332] R10: dffffc0000000000 R11: ffffed1008766a1d R12: 0000000000000010
[ 109.715256][ T5332] R13: ffff888043b350e0 R14: ffff888043b29d20 R15: dffffc0000000000
[ 109.719338][ T5332] ? mark_buffer_dirty+0x298/0x410
[ 109.721886][ T5332] ? mark_buffer_dirty+0x298/0x410
[ 109.724136][ T5332] bfs_get_block+0x5c6/0xb50
[ 109.726212][ T5332] __block_write_begin_int+0x6c2/0x1900
[ 109.728723][ T5332] ? __pfx_bfs_get_block+0x10/0x10
[ 109.731075][ T5332] ? __pfx___block_write_begin_int+0x10/0x10
[ 109.734271][ T5332] ? __pfx_bfs_get_block+0x10/0x10
[ 109.736817][ T5332] block_write_begin+0x8d/0x120
[ 109.739028][ T5332] ? bfs_write_begin+0x1e/0xd0
[ 109.741062][ T5332] bfs_write_begin+0x35/0xd0
[ 109.743048][ T5332] generic_perform_write+0x2d5/0x8f0
[ 109.745314][ T5332] ? __pfx_generic_perform_write+0x10/0x10
[ 109.748008][ T5332] ? file_update_time_flags+0x219/0x4a0
[ 109.751106][ T5332] ? __generic_file_write_iter+0xf9/0x230
[ 109.754229][ T5332] ? generic_file_write_iter+0x9a/0x330
[ 109.756575][ T5332] generic_file_write_iter+0xae/0x330
[ 109.758951][ T5332] vfs_write+0x612/0xba0
[ 109.760764][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 109.762873][ T5332] ? __fget_files+0x2a/0x420
[ 109.764982][ T5332] ksys_write+0x150/0x270
[ 109.767115][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 109.769739][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.772566][ T5332] do_syscall_64+0x174/0x580
[ 109.774580][ T5332] ? trace_irq_disable+0x3b/0x140
[ 109.776698][ T5332] ? clear_bhb_loop+0x40/0x90
[ 109.778824][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.781422][ T5332] RIP: 0033:0x7f973f19ce59
[ 109.783525][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 109.793072][ T5332] RSP: 002b:00007f9740052fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 109.796745][ T5332] RAX: ffffffffffffffda RBX: 00007f973f416090 RCX: 00007f973f19ce59
[ 109.800118][ T5332] RDX: 000000000000fecc RSI: 00002000000008c0 RDI: 0000000000000006
[ 109.804146][ T5332] RBP: 00007f973f232e6f R08: 0000000000000000 R09: 0000000000000000
[ 109.808408][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.811843][ T5332] R13: 00007f973f416128 R14: 00007f973f416090 R15: 00007fff19e5c9a8
[ 109.815160][ T5332]
[ 109.816908][ T5332] Kernel Offset: disabled
[ 109.818857][ T5332] Rebooting in 86400 seconds..