program:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200010, &(0x7f0000000680)=ANY=[@ANYRES64=0x0], 0x1, 0x25a, &(0x7f0000000240)="$eJzs2s9rI2UYB/Bn6sqmXbqp+ItdEF/0oF6Gbc8edpEKYkFRK6yC7KydauyYlE4oRMT2pFf/BM/i0Zsge/TSi3+BB2+99LgHcSRNWtOysIs/mqX7+RySh3nnm7zzvmF4ErL/6refb6zX+XrRj5ksi5nrsRt3s1iImTiyG6+8dPOX5969+cGbN1ZWWuOjSymly8///OGXP7xwp3/p/R8v/3Qx9hY+2j9Y+n3vmb0r+3++92mnTp06dXv9VKTbvV6/uF2Vaa1Tb+QpvV2VRV2mTrcut06Mr1e9zc1BKrpr83ObW2Vdp6I7SBvlIPV7qb81SMUnRaeb8jxP83PBv7H6/d2miYPm8VvRNM3sd3HpTsz/Fu3InkjZk9ezp29lz+5mVw6apn06OjudGfPf+sf7z7kwvqkvv5NSK6L6Znt1e3X0PBxtxY316EQVZVyL2fgjhh+TsVH9+hsry9fSoYX4utoZ53e2Vx87fP3j/GK0Y+He+cVRPh3lL0bE8HFuMr8U7Xjq3vmlU/nR+7fi5Rcn8nm049ePoxdVrMUwGzvjJVj+ajGl195aOZW/engeAMB5k6djw/5t2LSd6N/y/MT4RH80yk/0h+379Ien+qsLcfXCdK+diHrwxUZRVeXW8AveYXF85FEtZieX5UGKo59C/r+JzZzYs4dloRTnuYj4bCp3JM7S35t+31NbZzIhAAAAAAAAAAAAHshZ/J1w2tcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA83P4KAAD//8scwHs=")
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd70100400000006000000080009000200000008000c00a80a000008000b"], 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20)
r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9)
sendmsg$RDMA_NLDEV_CMD_RES_GET(r4, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x18, 0x1409, 0x100, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x40082}, 0x4004080)
r5 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124)
write$P9_RREADDIR(r5, &(0x7f00000001c0)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7, 0x7, 0xf45b3bccc711007a, './file0'}]}}, 0xfffffceb)
mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0)
r6 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97)
ioctl$LOOP_SET_STATUS64(r6, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]})
[ 132.397236][ T5294] Bluetooth: hci0: command tx timeout
[ 132.540131][ T5332] loop0: detected capacity change from 0 to 128
[ 132.648468][ T5332] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'.
[ 132.768158][ T5333] loop0: detected capacity change from 128 to 0
[ 132.769298][ T43] I/O error, dev loop0, sector 1 op 0x1:(WRITE) flags 0x800000 phys_seg 1 prio class 2
[ 132.769419][ T43] Buffer I/O error on dev loop0, logical block 1, lost sync page write
[ 132.769673][ T5332] ------------[ cut here ]------------
[ 132.769680][ T5332] !buffer_uptodate(bh)
[ 132.769685][ T5332] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5332
[ 132.788972][ T5332] Modules linked in:
[ 132.790610][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 132.794377][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 132.799161][ T5332] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 132.801617][ T5332] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 132.811316][ T5332] RSP: 0018:ffffc9000de4f438 EFLAGS: 00010287
[ 132.813895][ T5332] RAX: ffffffff8261c6f8 RBX: ffff888042669700 RCX: 0000000000100000
[ 132.817863][ T5332] RDX: ffffc9000f351000 RSI: 000000000000d1b7 RDI: 000000000000d1b8
[ 132.821150][ T5332] RBP: dffffc0000000001 R08: ffff888042669707 R09: 1ffff110084cd2e0
[ 132.824542][ T5332] R10: dffffc0000000000 R11: ffffed10084cd2e1 R12: dffffc0000000000
[ 132.828069][ T5332] R13: 1ffff92001bc9ebe R14: ffffc9000de4f5f0 R15: ffff8880450cc788
[ 132.831255][ T5332] FS: 00007f8b44ef86c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 132.834444][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 132.837065][ T5332] CR2: 0000557c56150930 CR3: 0000000012e51000 CR4: 0000000000352ef0
[ 132.840536][ T5332] Call Trace:
[ 132.842007][ T5332]
[ 132.843353][ T5332] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 132.845783][ T5332] fat12_ent_put+0x1b7/0x2f0
[ 132.847809][ T5332] fat_ent_write+0xb8/0x190
[ 132.849606][ T5332] fat_chain_add+0x409/0x8e0
[ 132.851529][ T5332] ? __pfx_fat_chain_add+0x10/0x10
[ 132.853789][ T5332] ? fat_bmap+0x487/0x5a0
[ 132.855754][ T5332] fat_get_block+0x768/0xae0
[ 132.857702][ T5332] ? lock_acquire+0x115/0x350
[ 132.859599][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 132.861728][ T5332] ? do_raw_spin_unlock+0x4d/0x200
[ 132.863863][ T5332] ? _raw_spin_unlock+0x28/0x50
[ 132.865844][ T5332] ? create_empty_buffers+0x460/0x520
[ 132.868060][ T5332] __block_write_begin_int+0x6c2/0x1900
[ 132.870345][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 132.872380][ T5332] ? __pfx___block_write_begin_int+0x10/0x10
[ 132.874738][ T5332] cont_write_begin+0x71b/0xac0
[ 132.877118][ T5332] ? __pfx_cont_write_begin+0x10/0x10
[ 132.879299][ T5332] ? do_raw_spin_unlock+0x4d/0x200
[ 132.881677][ T5332] ? _raw_spin_unlock+0x28/0x50
[ 132.883720][ T5332] fat_write_begin+0x7a/0x150
[ 132.885834][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 132.888069][ T5332] generic_perform_write+0x2d5/0x8f0
[ 132.890414][ T5332] ? __pfx_generic_perform_write+0x10/0x10
[ 132.893034][ T5332] ? file_update_time_flags+0x3ab/0x440
[ 132.895405][ T5332] ? __generic_file_write_iter+0xf9/0x230
[ 132.897965][ T5332] ? generic_file_write_iter+0x9a/0x330
[ 132.900454][ T5332] generic_file_write_iter+0xae/0x330
[ 132.902729][ T5332] vfs_write+0x612/0xba0
[ 132.904551][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 132.906711][ T5332] ? __fget_files+0x2a/0x420
[ 132.908645][ T5332] ksys_write+0x150/0x270
[ 132.910316][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 132.912579][ T5332] do_syscall_64+0x166/0x520
[ 132.914625][ T5332] ? trace_irq_disable+0x3b/0x140
[ 132.917022][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.919740][ T5332] ? clear_bhb_loop+0x70/0xc0
[ 132.921762][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.924396][ T5332] RIP: 0033:0x7f8b43f9e159
[ 132.926209][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 132.933765][ T5332] RSP: 002b:00007f8b44ef7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 132.937161][ T5332] RAX: ffffffffffffffda RBX: 00007f8b44225fa0 RCX: 00007f8b43f9e159
[ 132.940291][ T5332] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000008
[ 132.943415][ T5332] RBP: 00007f8b4403506b R08: 0000000000000000 R09: 0000000000000000
[ 132.946759][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 132.950008][ T5332] R13: 00007f8b44226038 R14: 00007f8b44225fa0 R15: 00007ffd19604618
[ 132.953260][ T5332]
[ 132.954574][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 132.957415][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 132.960980][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 132.965078][ T5332] Call Trace:
[ 132.966433][ T5332]
[ 132.967701][ T5332] vpanic+0x56d/0xa60
[ 132.969374][ T5332] ? __pfx__printk+0x10/0x10
[ 132.971373][ T5332] ? __pfx_vpanic+0x10/0x10
[ 132.973529][ T5332] ? is_bpf_text_address+0x292/0x2b0
[ 132.975901][ T5332] ? is_bpf_text_address+0x26/0x2b0
[ 132.978454][ T5332] panic+0xc5/0xd0
[ 132.980058][ T5332] ? __pfx_panic+0x10/0x10
[ 132.982048][ T5332] __warn+0x315/0x4c0
[ 132.983788][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 132.986004][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 132.988284][ T5332] __report_bug+0x276/0x570
[ 132.990306][ T5332] ? __pfx___schedule+0x10/0x10
[ 132.992462][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 132.994650][ T5332] ? __pfx___report_bug+0x10/0x10
[ 132.996689][ T5332] ? schedule+0x90/0x2b0
[ 132.998420][ T5332] ? __lock_acquire+0x747/0x2de0
[ 133.000536][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 133.002802][ T5332] report_bug+0x16b/0x220
[ 133.004567][ T5332] ? mark_buffer_dirty+0x299/0x410
[ 133.006684][ T5332] ? mark_buffer_dirty+0x29b/0x410
[ 133.008759][ T5332] handle_bug+0x9c/0x200
[ 133.010269][ T5332] exc_invalid_op+0x1a/0x50
[ 133.011962][ T5332] asm_exc_invalid_op+0x1a/0x20
[ 133.013789][ T5332] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 133.016078][ T5332] Code: 4c 89 f7 e8 69 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 af 58 66 ff eb 8c e8 a8 58 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 9a 58 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 133.023617][ T5332] RSP: 0018:ffffc9000de4f438 EFLAGS: 00010287
[ 133.025944][ T5332] RAX: ffffffff8261c6f8 RBX: ffff888042669700 RCX: 0000000000100000
[ 133.028933][ T5332] RDX: ffffc9000f351000 RSI: 000000000000d1b7 RDI: 000000000000d1b8
[ 133.032047][ T5332] RBP: dffffc0000000001 R08: ffff888042669707 R09: 1ffff110084cd2e0
[ 133.035206][ T5332] R10: dffffc0000000000 R11: ffffed10084cd2e1 R12: dffffc0000000000
[ 133.038719][ T5332] R13: 1ffff92001bc9ebe R14: ffffc9000de4f5f0 R15: ffff8880450cc788
[ 133.042306][ T5332] ? mark_buffer_dirty+0x298/0x410
[ 133.044580][ T5332] ? mark_buffer_dirty+0x298/0x410
[ 133.046806][ T5332] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 133.049092][ T5332] fat12_ent_put+0x1b7/0x2f0
[ 133.051087][ T5332] fat_ent_write+0xb8/0x190
[ 133.053074][ T5332] fat_chain_add+0x409/0x8e0
[ 133.055079][ T5332] ? __pfx_fat_chain_add+0x10/0x10
[ 133.057325][ T5332] ? fat_bmap+0x487/0x5a0
[ 133.059220][ T5332] fat_get_block+0x768/0xae0
[ 133.061278][ T5332] ? lock_acquire+0x115/0x350
[ 133.063381][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 133.065621][ T5332] ? do_raw_spin_unlock+0x4d/0x200
[ 133.067861][ T5332] ? _raw_spin_unlock+0x28/0x50
[ 133.069990][ T5332] ? create_empty_buffers+0x460/0x520
[ 133.072355][ T5332] __block_write_begin_int+0x6c2/0x1900
[ 133.074714][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 133.076954][ T5332] ? __pfx___block_write_begin_int+0x10/0x10
[ 133.079636][ T5332] cont_write_begin+0x71b/0xac0
[ 133.081717][ T5332] ? __pfx_cont_write_begin+0x10/0x10
[ 133.084077][ T5332] ? do_raw_spin_unlock+0x4d/0x200
[ 133.086338][ T5332] ? _raw_spin_unlock+0x28/0x50
[ 133.088440][ T5332] fat_write_begin+0x7a/0x150
[ 133.090445][ T5332] ? __pfx_fat_get_block+0x10/0x10
[ 133.092708][ T5332] generic_perform_write+0x2d5/0x8f0
[ 133.095064][ T5332] ? __pfx_generic_perform_write+0x10/0x10
[ 133.097605][ T5332] ? file_update_time_flags+0x3ab/0x440
[ 133.100026][ T5332] ? __generic_file_write_iter+0xf9/0x230
[ 133.102492][ T5332] ? generic_file_write_iter+0x9a/0x330
[ 133.104949][ T5332] generic_file_write_iter+0xae/0x330
[ 133.107940][ T5332] vfs_write+0x612/0xba0
[ 133.109752][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 133.111906][ T5332] ? __fget_files+0x2a/0x420
[ 133.113839][ T5332] ksys_write+0x150/0x270
[ 133.115765][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 133.117798][ T5332] do_syscall_64+0x166/0x520
[ 133.119809][ T5332] ? trace_irq_disable+0x3b/0x140
[ 133.122014][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.124688][ T5332] ? clear_bhb_loop+0x70/0xc0
[ 133.126754][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.129295][ T5332] RIP: 0033:0x7f8b43f9e159
[ 133.131286][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 133.139664][ T5332] RSP: 002b:00007f8b44ef7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 133.143382][ T5332] RAX: ffffffffffffffda RBX: 00007f8b44225fa0 RCX: 00007f8b43f9e159
[ 133.146889][ T5332] RDX: 00000000fffffceb RSI: 00002000000001c0 RDI: 0000000000000008
[ 133.150356][ T5332] RBP: 00007f8b4403506b R08: 0000000000000000 R09: 0000000000000000
[ 133.153807][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 133.157184][ T5332] R13: 00007f8b44226038 R14: 00007f8b44225fa0 R15: 00007ffd19604618
[ 133.160528][ T5332]
[ 133.162335][ T5332] Kernel Offset: disabled
[ 133.164230][ T5332] Rebooting in 86400 seconds..