program: r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x1, 0x581800) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000100)={0x1, 0x0, {0x101, 0x0, 0x1014, 0x0, 0x9, 0x0, 0x2}}) r1 = syz_open_dev$vim2m(&(0x7f0000000300), 0x40000000000000fb, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000240)=0x1) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x48, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0x48}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x34, 0x5, 0x6, 0x301, 0x0, 0x0, {0xa, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8800) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_read_part_table(0x5e2, &(0x7f0000000b00)="$eJzs3L+rHFUUB/DvndlfD6LPP8DiQRpR8Al24sNY6DNdEO0EbS2eSCzEQnYXFcEff0Ba0cIohFhbKEgQ01mJ8NBCxN7CFIYrOzuzG1CrfSiBz6fYe+6de86Z4U47G+5udT+pJbnZzT5qu2HUJNNV8GvyzjhZvvhkv5CM+8SS5PmrTz198eBSmW7WVquL/up022XSj6Mc9NGXo3x49fjdLl6kZJ4+zPjzSUarvXWdd+XvN32rpO328D8bfVXXBzHJ9/kiyUlpV4c/TZb5JLkvs27fYZK21tod8yLZS9rNW7GDa0c3lk/08V76N228ns3fK/WR/to4tdbaZH5+yGyT+x8/vPxPRbv8Zfd4w1KtdXxuyG22F05uT4bw0W9/nmc521RPbbYlT/eSV0+ffbi7k7KuMd798QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOGMPvPbg180wudD9lk38zKdptlsXyZ9DfDA7o/7Xjm7sv/X25SZvHL38wytv/nL8W35P0ubw+Fwy3ex7aT1cf78bRv1qu3P/k9vN5LOPv9nbLPSlS/Ld+R9v1aHDaT++/tgdyUfNzv0BAAAAAAAAAAAAAAAAAABg5XouHlxq8lxS8kK2n/vXzJJShuksqbXWP2pn+Ph/cuXePrr5U8oqKbXcWf1Csn9PUqcfPNT9rcA6sdY66lqU/+YZ+Xd/BQAA//8EFGMK") r3 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x8000) mount(&(0x7f00000000c0)=@filename='./file1\x00', &(0x7f0000000040)='.\x00', &(0x7f0000000080)='omfs\x00', 0x0, 0x0) [ 84.767651][ T5305] Bluetooth: hci0: command tx timeout [ 85.024572][ T5327] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 85.047226][ T5327] loop0: detected capacity change from 0 to 2048 [ 85.081684][ T5302] loop0: p2 p3 < > p4 < p5 > [ 85.084238][ T5302] loop0: partition table partially beyond EOD, truncated [ 85.090497][ T5302] loop0: p3 start 4284289 is beyond EOD, truncated [ 85.114765][ T5327] loop0: p2 p3 < > p4 < p5 > [ 85.116742][ T5327] loop0: partition table partially beyond EOD, truncated [ 85.123877][ T5327] loop0: p3 start 4284289 is beyond EOD, truncated [ 85.159187][ T4721] loop0: p2 p3 < > p4 < p5 > [ 85.162246][ T4721] loop0: partition table partially beyond EOD, truncated [ 85.166574][ T4721] loop0: p3 start 4284289 is beyond EOD, truncated [ 85.217855][ T5302] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 85.222369][ T5303] Buffer I/O error on dev loop0p5, logical block 0, async page read [ 85.230273][ T5299] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.234094][ T5299] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.237912][ T5299] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.242078][ T5327] ------------[ cut here ]------------ [ 85.244667][ T5327] kernel BUG at fs/buffer.c:1582! [ 85.247083][ T5327] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 85.249871][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.253807][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.257794][ T5327] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 85.260072][ T5327] Code: 4c 89 e2 e8 b6 2e 8b 02 e9 42 ff ff ff e8 5c ea 70 ff 48 89 df 48 c7 c6 80 b6 be 8b e8 cd 70 d4 fe 90 0f 0b e8 45 ea 70 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 85.267209][ T5327] RSP: 0018:ffffc90003fdf9a0 EFLAGS: 00010287 [ 85.269565][ T5327] RAX: ffffffff82539f7b RBX: ffffea0000c2edc0 RCX: 0000000000100000 [ 85.272906][ T5327] RDX: ffffc90020802000 RSI: 0000000000000d6e RDI: 0000000000000d6f [ 85.276947][ T5327] RBP: dffffc0000000000 R08: ffffea0000c2edc7 R09: 1ffffd4000185db8 [ 85.280211][ T5327] R10: dffffc0000000000 R11: fffff94000185db9 R12: 0000000000000000 [ 85.283832][ T5327] R13: 0000000000001000 R14: ffff888031cc0570 R15: 0000000000001000 [ 85.287719][ T5327] FS: 00007f1cfe7146c0(0000) GS:ffff88808cce8000(0000) knlGS:0000000000000000 [ 85.291541][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.294358][ T5327] CR2: 00007fd7e228038f CR3: 0000000043b73000 CR4: 0000000000352ef0 [ 85.297801][ T5327] Call Trace: [ 85.299336][ T5327] [ 85.300600][ T5327] folio_alloc_buffers+0x39f/0x640 [ 85.302832][ T5327] bdev_getblk+0x2cb/0x6e0 [ 85.304697][ T5327] __bread_gfp+0x89/0x3b0 [ 85.306598][ T5327] omfs_fill_super+0x30d/0x1560 [ 85.308708][ T5327] ? sb_set_blocksize+0x10c/0x240 [ 85.310992][ T5327] ? setup_bdev_super+0x4c1/0x5b0 [ 85.313072][ T5327] get_tree_bdev_flags+0x431/0x4f0 [ 85.315088][ T5327] ? __pfx_omfs_fill_super+0x10/0x10 [ 85.317140][ T5327] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 85.319312][ T5327] vfs_get_tree+0x92/0x2a0 [ 85.321284][ T5327] do_new_mount+0x329/0xa50 [ 85.323133][ T5327] ? apparmor_capable+0x137/0x1a0 [ 85.325143][ T5327] ? __pfx_do_new_mount+0x10/0x10 [ 85.327196][ T5327] ? ns_capable+0x89/0xe0 [ 85.328933][ T5327] __se_sys_mount+0x31d/0x420 [ 85.330842][ T5327] ? __pfx___se_sys_mount+0x10/0x10 [ 85.333091][ T5327] ? __x64_sys_mount+0x20/0xc0 [ 85.335127][ T5327] do_syscall_64+0xe2/0xf80 [ 85.337073][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.339635][ T5327] ? trace_irq_disable+0x37/0x100 [ 85.341663][ T5327] ? clear_bhb_loop+0x60/0xb0 [ 85.343600][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.345997][ T5327] RIP: 0033:0x7f1cfd79af79 [ 85.347855][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.355878][ T5327] RSP: 002b:00007f1cfe714028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 85.359421][ T5327] RAX: ffffffffffffffda RBX: 00007f1cfda15fa0 RCX: 00007f1cfd79af79 [ 85.362709][ T5327] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 00002000000000c0 [ 85.366155][ T5327] RBP: 00007f1cfd8316e0 R08: 0000000000000000 R09: 0000000000000000 [ 85.369629][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.373124][ T5327] R13: 00007f1cfda16038 R14: 00007f1cfda15fa0 R15: 00007ffdcfcd8498 [ 85.376462][ T5327] [ 85.377720][ T5327] Modules linked in: [ 85.379741][ T5327] ---[ end trace 0000000000000000 ]--- [ 85.387689][ T5299] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.393381][ T5299] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.408039][ T5302] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.412767][ T5302] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.416288][ T5302] Buffer I/O error on dev loop0, logical block 0, async page read [ 85.467779][ T5327] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 85.471848][ T5327] Code: 4c 89 e2 e8 b6 2e 8b 02 e9 42 ff ff ff e8 5c ea 70 ff 48 89 df 48 c7 c6 80 b6 be 8b e8 cd 70 d4 fe 90 0f 0b e8 45 ea 70 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 85.481162][ T5327] RSP: 0018:ffffc90003fdf9a0 EFLAGS: 00010287 [ 85.483874][ T5327] RAX: ffffffff82539f7b RBX: ffffea0000c2edc0 RCX: 0000000000100000 [ 85.487187][ T5327] RDX: ffffc90020802000 RSI: 0000000000000d6e RDI: 0000000000000d6f [ 85.491037][ T5327] RBP: dffffc0000000000 R08: ffffea0000c2edc7 R09: 1ffffd4000185db8 [ 85.494910][ T5327] R10: dffffc0000000000 R11: fffff94000185db9 R12: 0000000000000000 [ 85.498184][ T5327] R13: 0000000000001000 R14: ffff888031cc0570 R15: 0000000000001000 [ 85.502619][ T5327] FS: 00007f1cfe7146c0(0000) GS:ffff88808cce8000(0000) knlGS:0000000000000000 [ 85.506515][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.509430][ T5327] CR2: 00007fd7e29fe000 CR3: 0000000043b73000 CR4: 0000000000352ef0 [ 85.513126][ T5327] Kernel panic - not syncing: Fatal exception [ 85.516098][ T5327] Kernel Offset: disabled [ 85.517847][ T5327] Rebooting in 86400 seconds..