program:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x48, 0x30, 0x105, 0x70bd28, 0x0, {}, [{0x34, 0x1, [@m_simple={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async)
socket$alg(0x26, 0x5, 0x0) (async)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10)
syz_mount_image$vfat(&(0x7f00000005c0), &(0x7f00000002c0)='./file0\x00', 0xc80, &(0x7f0000020100)=ANY=[@ANYBLOB="00631dda01aef2456795dd9b26209f1c0f624854ea3dd5a00bd6df44035f5c3ae796fec6d633a0ffad0569794acfef7da01767fd4175f2cd82df769aa2ee7bfe3640554507d2e660c9f9e222a72e1e3e71145c480657d2864e5e276f028d64701ae31cde0ceaf408fdb05c0f4142da00e900000100000149e6d308cbe315789f4baffe39bbced9b1d421d2e290e9fc563b62225f002ee310e1fa7321000000000000d6231001a4b2d467825f3abb0c167e129cf1fa0e7854103f4bf2d3a0194983bc86cbd3d75ccef3c8ac4516dac102"], 0x1, 0x266, &(0x7f000001fe80)="$eJzs281OE1EYxvGHDwVBmCqKgjG+0Y1uJlCvoCGQGJtokBo/EpNBptp0aEmnwdQYYefW6yAu3ZkYb4CNV+DCHRuXLIxjmKnQlhrDQiba/29zXnJ4mnP6njZn0dl58Ha1XAzdoldXf59pUNrUrpRRvwaU6GuO/XF9Uq02dWMi/+XyvYePbufy+flFs4Xc0s2smY1f+fji1burn+qj99+PfxjSdubJzrfs1+3J7amdH0vPS6GVQqtU6+bZcrVa95YD31ZKYdk1uxv4XuhbqRL6tbb5YlBdW2uYV1kZG1mr+WFoXqVhZb9h9arVaw3znnmlirmua2Mjwp8UthYXvVzaq8DfVavlvDlJ04dmClupLAgAAKSK+38v4/7fC/bu/4+bn9923P8BAAAAAAAAAAAAAAAAAAAAAPgX7EaRE0WR82s8IcVP+ETNv09JGpE0Kum0pDFJ45IcSRlJZySdlTQh6Zyk85ImJV2QdFHSVMtrpb1XHEb/exv97230v7e1PLg7LK2+WS+sF5Ixmc8VVVIgXzNy9D3uZVNSL9zKz89YLKNLqxvN/MZ6YaA9Pytn78B0y88meWvPD8Xnbj+flbN3wLrls13zw7p+rSXvytHnp6oq0Ep8Jg/yr2fN5u7kO/LT8f/971zb17V/rvu7+SR/hPPR8f4Oanow3b1DChsvy14Q+DUKCgqK/SLtbyYch4Omp70SAAAAAAAAAAAAAAAAAMBRHMfPCdPeIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnX4GAAD//5KSYE0=")
syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) (async)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2ac00)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x800000c, 0x12, 0x1b, 0x0, "9e959f16deab7b08aa26e66c4056a516950600000000000000eef4fb0efcc1d8a6078ed9d5f8643902dd8f6fac274de9d940ffa5e592bbd48685450d00002000", "f625c10e6e0080ffffffffffffffff7e904dc8df6aa3a893ec00347f41be6908", [0xa, 0x80000476]}) (async)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x80000, 0x0)
getdents64(r2, &(0x7f0000000080)=""/4096, 0x1000)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) (async)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f20000d0014392c00"/20, @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) (async)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0x2, &(0x7f0000000500)=ANY=[@ANYBLOB="b70000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r3, r4, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) (async)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r3, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) (async)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async)
r5 = io_uring_setup(0xb66, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xa, 0xc1}) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50)
sendmmsg(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0)
io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0)
mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4) (async)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_TX_POWER(r6, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
[ 94.168198][ T4641] Bluetooth: hci0: command tx timeout
[ 94.234421][ T5311] loop0: detected capacity change from 0 to 128
[ 94.483894][ T5312] loop0: detected capacity change from 128 to 0
[ 94.485638][ T189] Buffer I/O error on dev loop0, logical block 34, lost async page write
[ 94.485663][ T189] Buffer I/O error on dev loop0, logical block 35, lost async page write
[ 94.486635][ T5311] Buffer I/O error on dev loop0, logical block 32, lost sync page write
[ 94.487743][ T5311] ------------[ cut here ]------------
[ 94.487750][ T5311] !buffer_uptodate(bh)
[ 94.487755][ T5311] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5311
[ 94.516170][ T5311] Modules linked in:
[ 94.517839][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.521529][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.525961][ T5311] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 94.528505][ T5311] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 94.536481][ T5311] RSP: 0018:ffffc9000d677490 EFLAGS: 00010293
[ 94.539155][ T5311] RAX: ffffffff8261a398 RBX: ffff88804396cb60 RCX: ffff888033354b00
[ 94.542796][ T5311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 94.545854][ T5311] RBP: dffffc0000000001 R08: ffff88804396cb67 R09: 1ffff1100872d96c
[ 94.549264][ T5311] R10: dffffc0000000000 R11: ffffed100872d96d R12: ffffffff8c28b180
[ 94.552905][ T5311] R13: ffff888012df4248 R14: dffffc0000000000 R15: ffff88801360c788
[ 94.556205][ T5311] FS: 00007fee6cb136c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 94.559912][ T5311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.562792][ T5311] CR2: 00007f6c874b04c0 CR3: 00000000128a0000 CR4: 0000000000352ef0
[ 94.565975][ T5311] Call Trace:
[ 94.567327][ T5311]
[ 94.568582][ T5311] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 94.571084][ T5311] fat_ent_write+0xb8/0x190
[ 94.573433][ T5311] fat_chain_add+0x409/0x8e0
[ 94.575828][ T5311] ? __pfx_fat_chain_add+0x10/0x10
[ 94.578395][ T5311] ? fat_zeroed_cluster+0x87a/0x8f0
[ 94.581118][ T5311] fat_add_entries+0x1aa4/0x2320
[ 94.583693][ T5311] ? __pfx_fat_add_entries+0x10/0x10
[ 94.586775][ T5311] ? kasan_quarantine_put+0xbb/0x1f0
[ 94.589875][ T5311] ? lockdep_hardirqs_on+0x7b/0x110
[ 94.592752][ T5311] ? kfree+0x1c5/0x650
[ 94.594660][ T5311] ? vfat_add_entry+0x2da3/0x3570
[ 94.596869][ T5311] vfat_add_entry+0x2dd3/0x3570
[ 94.599019][ T5311] ? __pfx_vfat_add_entry+0x10/0x10
[ 94.601247][ T5311] ? fat_sync_bhs+0x1a8/0x1d0
[ 94.603266][ T5311] ? __brelse+0x59/0x90
[ 94.605116][ T5311] ? fat_zeroed_cluster+0x87a/0x8f0
[ 94.607440][ T5311] ? do_raw_spin_unlock+0x4d/0x200
[ 94.609921][ T5311] ? fat_alloc_new_dir+0x80a/0xb90
[ 94.612338][ T5311] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 94.615279][ T5311] ? inode_lru_isolate+0x49e/0x670
[ 94.617573][ T5311] vfat_mkdir+0x16c/0x300
[ 94.619497][ T5311] ? __pfx_vfat_mkdir+0x10/0x10
[ 94.621835][ T5311] ? make_vfsuid+0x49/0xa0
[ 94.623850][ T5311] ? bpf_lsm_inode_mkdir+0x9/0x20
[ 94.626088][ T5311] vfs_mkdir+0x40c/0x620
[ 94.627948][ T5311] filename_mkdirat+0x285/0x510
[ 94.630175][ T5311] ? __pfx_filename_mkdirat+0x10/0x10
[ 94.632679][ T5311] ? do_getname+0x151/0x250
[ 94.634714][ T5311] __se_sys_mkdirat+0x35/0x150
[ 94.636754][ T5311] do_syscall_64+0x166/0x520
[ 94.638727][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.641158][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 94.643158][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.645635][ T5311] RIP: 0033:0x7fee6bb9cfc7
[ 94.647577][ T5311] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.655864][ T5311] RSP: 002b:00007fee6cb12e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 94.659727][ T5311] RAX: ffffffffffffffda RBX: 00007fee6cb12ea0 RCX: 00007fee6bb9cfc7
[ 94.663312][ T5311] RDX: 00000000000001ff RSI: 00002000000005c0 RDI: 00000000ffffff9c
[ 94.666783][ T5311] RBP: 0000200000000b00 R08: 0000200000000140 R09: 0000000000000000
[ 94.670359][ T5311] R10: 0000200000000b00 R11: 0000000000000246 R12: 00002000000005c0
[ 94.674074][ T5311] R13: 00007fee6cb12e60 R14: 0000000000000000 R15: 0000000000000000
[ 94.677540][ T5311]
[ 94.678894][ T5311] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.682113][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.685994][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.690393][ T5311] Call Trace:
[ 94.691901][ T5311]
[ 94.693209][ T5311] vpanic+0x56d/0xa60
[ 94.694917][ T5311] ? __pfx__printk+0x10/0x10
[ 94.696958][ T5311] ? __pfx_vpanic+0x10/0x10
[ 94.698980][ T5311] ? is_bpf_text_address+0x292/0x2b0
[ 94.701334][ T5311] ? is_bpf_text_address+0x26/0x2b0
[ 94.703661][ T5311] panic+0xc5/0xd0
[ 94.705364][ T5311] ? __pfx_panic+0x10/0x10
[ 94.707419][ T5311] __warn+0x315/0x4c0
[ 94.709136][ T5311] ? mark_buffer_dirty+0x299/0x410
[ 94.711244][ T5311] ? mark_buffer_dirty+0x299/0x410
[ 94.713436][ T5311] __report_bug+0x276/0x570
[ 94.715312][ T5311] ? mark_buffer_dirty+0x299/0x410
[ 94.717388][ T5311] ? __pfx___report_bug+0x10/0x10
[ 94.719445][ T5311] ? vprintk_emit+0x4ee/0x560
[ 94.721342][ T5311] ? __pfx_vprintk_emit+0x10/0x10
[ 94.723401][ T5311] ? mark_buffer_dirty+0x299/0x410
[ 94.725629][ T5311] report_bug+0x16b/0x220
[ 94.727631][ T5311] ? mark_buffer_dirty+0x299/0x410
[ 94.729895][ T5311] ? mark_buffer_dirty+0x29b/0x410
[ 94.732060][ T5311] handle_bug+0x9c/0x200
[ 94.733936][ T5311] exc_invalid_op+0x1a/0x50
[ 94.735828][ T5311] asm_exc_invalid_op+0x1a/0x20
[ 94.737906][ T5311] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 94.740387][ T5311] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 94.748666][ T5311] RSP: 0018:ffffc9000d677490 EFLAGS: 00010293
[ 94.751185][ T5311] RAX: ffffffff8261a398 RBX: ffff88804396cb60 RCX: ffff888033354b00
[ 94.754895][ T5311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 94.758330][ T5311] RBP: dffffc0000000001 R08: ffff88804396cb67 R09: 1ffff1100872d96c
[ 94.761825][ T5311] R10: dffffc0000000000 R11: ffffed100872d96d R12: ffffffff8c28b180
[ 94.765293][ T5311] R13: ffff888012df4248 R14: dffffc0000000000 R15: ffff88801360c788
[ 94.768974][ T5311] ? mark_buffer_dirty+0x298/0x410
[ 94.771280][ T5311] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 94.773554][ T5311] fat_ent_write+0xb8/0x190
[ 94.775498][ T5311] fat_chain_add+0x409/0x8e0
[ 94.777480][ T5311] ? __pfx_fat_chain_add+0x10/0x10
[ 94.779669][ T5311] ? fat_zeroed_cluster+0x87a/0x8f0
[ 94.781955][ T5311] fat_add_entries+0x1aa4/0x2320
[ 94.784144][ T5311] ? __pfx_fat_add_entries+0x10/0x10
[ 94.786453][ T5311] ? kasan_quarantine_put+0xbb/0x1f0
[ 94.788708][ T5311] ? lockdep_hardirqs_on+0x7b/0x110
[ 94.790958][ T5311] ? kfree+0x1c5/0x650
[ 94.792772][ T5311] ? vfat_add_entry+0x2da3/0x3570
[ 94.794979][ T5311] vfat_add_entry+0x2dd3/0x3570
[ 94.797132][ T5311] ? __pfx_vfat_add_entry+0x10/0x10
[ 94.799260][ T5311] ? fat_sync_bhs+0x1a8/0x1d0
[ 94.801321][ T5311] ? __brelse+0x59/0x90
[ 94.803253][ T5311] ? fat_zeroed_cluster+0x87a/0x8f0
[ 94.805586][ T5311] ? do_raw_spin_unlock+0x4d/0x200
[ 94.807737][ T5311] ? fat_alloc_new_dir+0x80a/0xb90
[ 94.809956][ T5311] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 94.812690][ T5311] ? inode_lru_isolate+0x49e/0x670
[ 94.814925][ T5311] vfat_mkdir+0x16c/0x300
[ 94.816895][ T5311] ? __pfx_vfat_mkdir+0x10/0x10
[ 94.818909][ T5311] ? make_vfsuid+0x49/0xa0
[ 94.820869][ T5311] ? bpf_lsm_inode_mkdir+0x9/0x20
[ 94.823224][ T5311] vfs_mkdir+0x40c/0x620
[ 94.825167][ T5311] filename_mkdirat+0x285/0x510
[ 94.827379][ T5311] ? __pfx_filename_mkdirat+0x10/0x10
[ 94.829790][ T5311] ? do_getname+0x151/0x250
[ 94.831847][ T5311] __se_sys_mkdirat+0x35/0x150
[ 94.834022][ T5311] do_syscall_64+0x166/0x520
[ 94.836111][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.838795][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 94.840918][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.843563][ T5311] RIP: 0033:0x7fee6bb9cfc7
[ 94.845561][ T5311] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.853897][ T5311] RSP: 002b:00007fee6cb12e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 94.857462][ T5311] RAX: ffffffffffffffda RBX: 00007fee6cb12ea0 RCX: 00007fee6bb9cfc7
[ 94.860858][ T5311] RDX: 00000000000001ff RSI: 00002000000005c0 RDI: 00000000ffffff9c
[ 94.864397][ T5311] RBP: 0000200000000b00 R08: 0000200000000140 R09: 0000000000000000
[ 94.867871][ T5311] R10: 0000200000000b00 R11: 0000000000000246 R12: 00002000000005c0
[ 94.871376][ T5311] R13: 00007fee6cb12e60 R14: 0000000000000000 R15: 0000000000000000
[ 94.874760][ T5311]
[ 94.876564][ T5311] Kernel Offset: disabled
[ 94.878481][ T5311] Rebooting in 86400 seconds..