program: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000280)={'tunl0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x40, 0x20, 0x5, 0xd4, {{0x25, 0x4, 0x2, 0x25, 0x94, 0x67, 0x0, 0x10, 0x29, 0x0, @private=0xa010101, @loopback, {[@timestamp={0x44, 0xc, 0x78, 0x0, 0x0, [0x4, 0x5]}, @ssrr={0x89, 0x7, 0x35, [@local]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0xa, 0x2, [{0x7, 0x4, "dba7"}]}, @timestamp_addr={0x44, 0x4c, 0x36, 0x1, 0x8, [{@remote, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x1}, {@empty, 0xffff}, {@dev={0xac, 0x14, 0x14, 0x35}, 0x10}, {@broadcast, 0xa}, {@empty, 0x4}, {@multicast1, 0xfffff001}, {@loopback, 0x1}, {@loopback, 0x1}]}, @ssrr={0x89, 0xf, 0x63, [@broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0x2f}]}, @end]}}}}}) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@delpolicy={0x454, 0x14, 0x8, 0x70bd2a, 0x25dfdbfe, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, @in=@rand_addr=0x64010102, 0x4e20, 0xfed4, 0x4e23, 0x8, 0x2, 0x80, 0x80, 0x3a, r1, 0xee00}}, [@tfcpad={0x8, 0x16, 0x7}, @policy_type={0xa}, @user_kmaddress={0x2c, 0x13, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@local, 0x0, 0x2}}, @migrate={0x9c, 0x11, [{@in=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@loopback, @in6=@empty, 0x2b, 0x1, 0x0, 0x3503, 0x2, 0x1b13172113ef061b}, {@in=@local, @in=@broadcast, @in6=@remote, @in=@private=0xa010102, 0x32, 0x3, 0x0, 0x3507, 0x2, 0xa}]}, @algo_auth={0x135, 0x1, {{'blake2s-128-generic\x00'}, 0x768, "d441ee258192ff8b46e16858014a764f27bc8dac8a60c95db8b786178f05533c0945151655b4ad6cf9828355c22404250f3a6fa4d9438938a915afd0dfe322f47b36edf55b0081bda17d4e1253dcb6645d8e0fa4fb685009878da662da5938c9362012f988720b5ce0f3257fd72d112d8312c3f31977589ca369530e23d49b951b9e1c854480f2c220a4527fe251e75faae4e67565027dfe778723cd5c5a39b3710af98ef517334ee05f9063248179f292756e3f87c208ca71bf862c13c086d8a455e7e2187431da4232d88851c1b8bdf9a40adf7b7e44b9da8b9c4b96634c10701da306edf06484c8dc98ce9f"}}, @replay_esn_val={0x24, 0x17, {0x2, 0x70bd25, 0x70bd2b, 0x70bd2d, 0x70bd26, 0x10001, [0x5, 0x9]}}, @algo_crypt={0x13f, 0x2, {{'xts(cast6)\x00'}, 0x7b8, "188bde4a3808a165d77e525a7aedba59ee2bb91fb227acf19cca9094fb086ce1bb9c1350c261d0ae99f8418193582570569a590a42d923da66412c8ef048009f150686f36560c67fc35b8d30b1327d5ee5b21eb5dbb9b2460fab0154736fde14919ec31b2ec76ae4ef0efdae90bbb25737f49ec1be796172fe61b515b9f61759f4c33248057f16c6debf20626e2af92fbcb12d9683f5040ae598b357685a4a05e8720c6af48dfbab8b350366e59ca0dec87236c22d91fc941fa91b9b96b272ff3667afb04f70e8f34811b9e1976c8174d7c14168c26caab9d40e8fc6f431b9f1db1df0d599b76ebd51cf8ea74e217bc1dbdaaefdf010b6"}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd28, 0x70bd29, 0x70bd26, 0x70bd2c, 0x8, [0x8, 0x8, 0x0, 0x401b5722]}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e22, 0x4e21, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}}, @tmpl={0x44, 0x5, [{{@in=@broadcast, 0x4d4, 0x6c}, 0xa, @in=@loopback, 0x34ff, 0x4, 0x1, 0x7, 0x6, 0x0, 0x8}]}]}, 0x454}}, 0x0) (async) syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xaf, &(0x7f0000000380)="$eJzs1zFKA0EABdDvCmprI4KF9TbewaOIpTZipQjeIOQiuUqOsH2KFNuGkAnJbgghqVKkWN4rBv58Bqb908XkaVwn5T8p9ePXrOx9//x+vH12ZxikKsltkrskz/ddnr923VXfN+3fe9NeHz++GV38vwAAwPmqvBzmVekvlv0K3E6Dh12/CTkxBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGah0AAP//ghMolg==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x96) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xc00) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f00000008c0), 0xfecc) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in6=@private0, 0x20, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}}}, 0xb8}}, 0x0) [ 170.704082][ T44] Bluetooth: hci0: command tx timeout [ 170.776716][ T5358] loop0: detected capacity change from 0 to 64 [ 170.916284][ T5360] netlink: 104 bytes leftover after parsing attributes in process `syz.0.0'. [ 170.929867][ T5359] ------------[ cut here ]------------ [ 170.933118][ T5359] !buffer_uptodate(bh) [ 170.933135][ T5359] WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5359 [ 170.940428][ T5359] Modules linked in: [ 170.942436][ T5359] CPU: 0 UID: 0 PID: 5359 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 170.946583][ T5359] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.951585][ T5359] RIP: 0010:mark_buffer_dirty+0x299/0x410 [ 170.954570][ T5359] Code: 4c 89 f7 e8 89 68 da ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 64 63 fb ff e8 2f 82 6d ff eb 8c e8 28 82 6d ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 1a 82 6d ff 90 0f 0b 90 e9 cf fd ff ff [ 170.964008][ T5359] RSP: 0018:ffffc9000dd97608 EFLAGS: 00010293 [ 170.967520][ T5359] RAX: ffffffff825844e8 RBX: ffff888046bb4ae0 RCX: ffff88803db9a540 [ 170.970960][ T5359] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 170.974320][ T5359] RBP: ffff88803642a001 R08: ffff888046bb4ae7 R09: 1ffff11008d7695c [ 170.977825][ T5359] R10: dffffc0000000000 R11: ffffed1008d7695d R12: ffff888055936000 [ 170.981298][ T5359] R13: ffff888046bc8bc8 R14: ffff888046bb4ae0 R15: 0000000000000010 [ 170.985260][ T5359] FS: 00007f25c8afb6c0(0000) GS:ffff88808c894000(0000) knlGS:0000000000000000 [ 170.989970][ T5359] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 170.994104][ T5359] CR2: 00007f9af0028000 CR3: 0000000040887000 CR4: 0000000000352ef0 [ 170.997271][ T5359] Call Trace: [ 170.999854][ T5359] [ 171.001552][ T5359] bfs_get_block+0x5da/0xae0 [ 171.004992][ T5359] __block_write_begin_int+0x6c6/0x1910 [ 171.007832][ T5359] ? __pfx_bfs_get_block+0x10/0x10 [ 171.009901][ T5359] ? __pfx___block_write_begin_int+0x10/0x10 [ 171.012362][ T5359] ? __pfx_bfs_get_block+0x10/0x10 [ 171.014596][ T5359] block_write_begin+0x8d/0x120 [ 171.016952][ T5359] ? bfs_write_begin+0x1e/0xd0 [ 171.021324][ T5359] bfs_write_begin+0x35/0xd0 [ 171.023968][ T5359] generic_perform_write+0x2e2/0x8f0 [ 171.026228][ T5359] ? __pfx_generic_perform_write+0x10/0x10 [ 171.028796][ T5359] ? file_update_time_flags+0x219/0x4a0 [ 171.031163][ T5359] ? __generic_file_write_iter+0xf9/0x230 [ 171.034348][ T5359] ? generic_file_write_iter+0x136/0x680 [ 171.037189][ T5359] generic_file_write_iter+0x14a/0x680 [ 171.039903][ T5359] ? add_lock_to_list+0xc7/0x100 [ 171.042189][ T5359] ? __pfx_generic_file_write_iter+0x10/0x10 [ 171.044699][ T5359] ? lockdep_unlock+0x5d/0xd0 [ 171.046898][ T5359] ? __lock_acquire+0x146e/0x2cf0 [ 171.049271][ T5359] ? __pfx_aa_file_perm+0x10/0x10 [ 171.052011][ T5359] ? vfs_write+0x227/0xb90 [ 171.054069][ T5359] ? vfs_write+0x227/0xb90 [ 171.056091][ T5359] vfs_write+0x61d/0xb90 [ 171.058072][ T5359] ? __pfx_vfs_write+0x10/0x10 [ 171.060224][ T5359] ? __fget_files+0x2a/0x420 [ 171.062422][ T5359] ksys_write+0x150/0x270 [ 171.064373][ T5359] ? __pfx_ksys_write+0x10/0x10 [ 171.067014][ T5359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.070179][ T5359] do_syscall_64+0x174/0x580 [ 171.072362][ T5359] ? trace_irq_disable+0x3b/0x140 [ 171.074668][ T5359] ? clear_bhb_loop+0x40/0x90 [ 171.076660][ T5359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.079493][ T5359] RIP: 0033:0x7f25c7b9ce59 [ 171.082210][ T5359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.090881][ T5359] RSP: 002b:00007f25c8afafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 171.094640][ T5359] RAX: ffffffffffffffda RBX: 00007f25c7e16090 RCX: 00007f25c7b9ce59 [ 171.099292][ T5359] RDX: 000000000000fecc RSI: 00002000000008c0 RDI: 0000000000000006 [ 171.103325][ T5359] RBP: 00007f25c7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 171.106737][ T5359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 171.110202][ T5359] R13: 00007f25c7e16128 R14: 00007f25c7e16090 R15: 00007fff7f533288 [ 171.113687][ T5359] [ 171.115097][ T5359] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 171.119000][ T5359] CPU: 0 UID: 0 PID: 5359 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 171.123385][ T5359] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 171.127804][ T5359] Call Trace: [ 171.129347][ T5359] [ 171.130645][ T5359] vpanic+0x56c/0xa60 [ 171.132433][ T5359] ? __pfx__printk+0x10/0x10 [ 171.134873][ T5359] ? __pfx_vpanic+0x10/0x10 [ 171.137274][ T5359] ? is_bpf_text_address+0x292/0x2b0 [ 171.139940][ T5359] ? is_bpf_text_address+0x26/0x2b0 [ 171.142282][ T5359] panic+0xc5/0xd0 [ 171.143903][ T5359] ? __pfx_panic+0x10/0x10 [ 171.145882][ T5359] __warn+0x315/0x4c0 [ 171.147684][ T5359] ? mark_buffer_dirty+0x299/0x410 [ 171.149926][ T5359] ? mark_buffer_dirty+0x299/0x410 [ 171.152346][ T5359] __report_bug+0x29a/0x540 [ 171.154649][ T5359] ? filemap_get_entry+0xcd/0x3f0 [ 171.157220][ T5359] ? filemap_get_entry+0xcd/0x3f0 [ 171.159522][ T5359] ? mark_buffer_dirty+0x299/0x410 [ 171.161720][ T5359] ? __pfx___report_bug+0x10/0x10 [ 171.164007][ T5359] ? __pfx_folio_mark_accessed+0x10/0x10 [ 171.166466][ T5359] ? rcu_is_watching+0x15/0xb0 [ 171.168697][ T5359] ? folio_alloc_buffers+0x336/0x640 [ 171.171338][ T5359] ? mark_buffer_dirty+0x299/0x410 [ 171.173634][ T5359] report_bug+0x16a/0x220 [ 171.175542][ T5359] ? mark_buffer_dirty+0x299/0x410 [ 171.177843][ T5359] ? mark_buffer_dirty+0x29b/0x410 [ 171.180237][ T5359] handle_bug+0x9c/0x200 [ 171.182633][ T5359] exc_invalid_op+0x1a/0x50 [ 171.185153][ T5359] asm_exc_invalid_op+0x1a/0x20 [ 171.187611][ T5359] RIP: 0010:mark_buffer_dirty+0x299/0x410 [ 171.190018][ T5359] Code: 4c 89 f7 e8 89 68 da ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 64 63 fb ff e8 2f 82 6d ff eb 8c e8 28 82 6d ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 1a 82 6d ff 90 0f 0b 90 e9 cf fd ff ff [ 171.198553][ T5359] RSP: 0018:ffffc9000dd97608 EFLAGS: 00010293 [ 171.201375][ T5359] RAX: ffffffff825844e8 RBX: ffff888046bb4ae0 RCX: ffff88803db9a540 [ 171.204983][ T5359] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 171.208427][ T5359] RBP: ffff88803642a001 R08: ffff888046bb4ae7 R09: 1ffff11008d7695c [ 171.211861][ T5359] R10: dffffc0000000000 R11: ffffed1008d7695d R12: ffff888055936000 [ 171.215937][ T5359] R13: ffff888046bc8bc8 R14: ffff888046bb4ae0 R15: 0000000000000010 [ 171.220213][ T5359] ? mark_buffer_dirty+0x298/0x410 [ 171.222504][ T5359] ? mark_buffer_dirty+0x298/0x410 [ 171.224794][ T5359] bfs_get_block+0x5da/0xae0 [ 171.226832][ T5359] __block_write_begin_int+0x6c6/0x1910 [ 171.229212][ T5359] ? __pfx_bfs_get_block+0x10/0x10 [ 171.231373][ T5359] ? __pfx___block_write_begin_int+0x10/0x10 [ 171.234887][ T5359] ? __pfx_bfs_get_block+0x10/0x10 [ 171.237577][ T5359] block_write_begin+0x8d/0x120 [ 171.239965][ T5359] ? bfs_write_begin+0x1e/0xd0 [ 171.242051][ T5359] bfs_write_begin+0x35/0xd0 [ 171.243878][ T5359] generic_perform_write+0x2e2/0x8f0 [ 171.246192][ T5359] ? __pfx_generic_perform_write+0x10/0x10 [ 171.249067][ T5359] ? file_update_time_flags+0x219/0x4a0 [ 171.251596][ T5359] ? __generic_file_write_iter+0xf9/0x230 [ 171.254197][ T5359] ? generic_file_write_iter+0x136/0x680 [ 171.256853][ T5359] generic_file_write_iter+0x14a/0x680 [ 171.259398][ T5359] ? add_lock_to_list+0xc7/0x100 [ 171.262281][ T5359] ? __pfx_generic_file_write_iter+0x10/0x10 [ 171.264970][ T5359] ? lockdep_unlock+0x5d/0xd0 [ 171.266969][ T5359] ? __lock_acquire+0x146e/0x2cf0 [ 171.269323][ T5359] ? __pfx_aa_file_perm+0x10/0x10 [ 171.272050][ T5359] ? vfs_write+0x227/0xb90 [ 171.274758][ T5359] ? vfs_write+0x227/0xb90 [ 171.276827][ T5359] vfs_write+0x61d/0xb90 [ 171.278837][ T5359] ? __pfx_vfs_write+0x10/0x10 [ 171.280880][ T5359] ? __fget_files+0x2a/0x420 [ 171.283129][ T5359] ksys_write+0x150/0x270 [ 171.285366][ T5359] ? __pfx_ksys_write+0x10/0x10 [ 171.288029][ T5359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.290853][ T5359] do_syscall_64+0x174/0x580 [ 171.292841][ T5359] ? trace_irq_disable+0x3b/0x140 [ 171.295020][ T5359] ? clear_bhb_loop+0x40/0x90 [ 171.297046][ T5359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.299811][ T5359] RIP: 0033:0x7f25c7b9ce59 [ 171.302280][ T5359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.312978][ T5359] RSP: 002b:00007f25c8afafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 171.316744][ T5359] RAX: ffffffffffffffda RBX: 00007f25c7e16090 RCX: 00007f25c7b9ce59 [ 171.320599][ T5359] RDX: 000000000000fecc RSI: 00002000000008c0 RDI: 0000000000000006 [ 171.324812][ T5359] RBP: 00007f25c7c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 171.328464][ T5359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 171.331951][ T5359] R13: 00007f25c7e16128 R14: 00007f25c7e16090 R15: 00007fff7f533288 [ 171.335474][ T5359] [ 171.337354][ T5359] Kernel Offset: disabled [ 171.339097][ T5359] Rebooting in 86400 seconds..