program: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x2000010, &(0x7f0000000280)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x85, 0x7a5, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) (async) creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) (async) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(r3, 0x29, 0x36, 0x0, &(0x7f00000006c0)) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='team_slave_0\x00', 0x10) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r5, &(0x7f0000000340), &(0x7f0000000000)=@udp6, 0x1}, 0x20) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) (async) syz_mount_image$minix(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x168, &(0x7f0000000240)="$eJzs289KAlEUx/HfqJXZ///RKiioTY7/Ctrlo4hOJo0l2UYJokfpyXoBXfQCTTDK1FyCJkGH9PsBuecIh3Pv4nrPRgGYaZYspSV5nvd8c2zpMO4NAZgIb7h+eABmT5KrD8yofjnpv/8tSW/vT9Xe8JOOOD/0ywl/vZLU+1a/GLX+xfLXg1S4PiNpKcr88jqoPzH6L/+xf8aoX4lcPzj/6VG4flXSmqR1SRuSNiVtSdqWtPND/5rRfz9ifwAAAAAAorCUNfPQFwldN1wnF+Rzfp4P8nk/Lxh5McgX/DxbvXdr4zoCgBElfrn/SeP+p4z7D+D/ane6txXXdR4ICAgIgiDuXyYA42Y/Nlt2u9M9azQrdafu3BVK5xelYv4yV7D9yd8Oz/8ApsfXox/3TgAAAAAAAAAAAAAAwKh2Je3FvQkAAAAAEzGJvxPFfUYAAAAAAAAAAAAAAKbdZwAAAP//5kRKxQ==") (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x6, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x6, 0xe7030000}, {0x4, 0x0, 0x0, 0x6}}, [@printk={@d, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x14}}], {{0x5, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xc4}}}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0xe43c4cf3342b4a61, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'macvlan0\x00', 0x0}) sendmsg$can_j1939(r8, &(0x7f0000000380)={&(0x7f0000000300)={0x1d, r9}, 0x18, &(0x7f0000000340)={&(0x7f0000000400)="5ea81cc8d4a412d67e65ce3b8f66", 0xe}}, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@getneightbl={0x14, 0x42, 0x1, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x40010) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r8) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r8, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1010c0}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r10, 0x100, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x4}, @ETHTOOL_A_CHANNELS_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000010) (async) clock_gettime(0x8, &(0x7f0000006500)) [ 93.956436][ T5314] loop0: detected capacity change from 0 to 2048 [ 94.025160][ T5276] Bluetooth: hci0: command tx timeout [ 94.146702][ T5314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.182327][ T25] audit: type=1804 audit(1787274842.570:2): pid=5315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.0" name="/newroot/0/file0/bus" dev="loop0" ino=18 res=1 errno=0 [ 94.195774][ T5313] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 94.220542][ T132] ------------[ cut here ]------------ [ 94.223386][ T132] kernel BUG at fs/ext4/inode.c:2804! [ 94.226972][ T132] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 94.229760][ T132] CPU: 0 UID: 0 PID: 132 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 94.233463][ T132] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.237170][ T132] Workqueue: writeback wb_workfn (flush-7:0) [ 94.239578][ T132] RIP: 0010:ext4_do_writepages+0x447c/0x4480 [ 94.241857][ T132] Code: c6 20 f6 05 8c e8 64 19 98 fe 90 0f 0b e8 dc 0e 37 ff 4c 89 f7 48 c7 c6 00 fb 05 8c e8 4d 19 98 fe 90 0f 0b e8 c5 0e 37 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f [ 94.249334][ T132] RSP: 0018:ffffc900015a6c80 EFLAGS: 00010293 [ 94.251750][ T132] RAX: ffffffff829000cb RBX: 0000004210000000 RCX: ffff888033058000 [ 94.254863][ T132] RDX: 0000000000000000 RSI: 0000004000000000 RDI: 0000000000000000 [ 94.258011][ T132] RBP: ffffc900015a7090 R08: ffff88804398e407 R09: 1ffff11008731c80 [ 94.261111][ T132] R10: dffffc0000000000 R11: ffffed1008731c81 R12: 0000000000000001 [ 94.264153][ T132] R13: dffffc0000000000 R14: 0000004000000000 R15: ffff88804398e5f0 [ 94.267239][ T132] FS: 0000000000000000(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 [ 94.270631][ T132] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.273164][ T132] CR2: 0000000000000000 CR3: 0000000012a55000 CR4: 0000000000352ef0 [ 94.276401][ T132] Call Trace: [ 94.277806][ T132] [ 94.279079][ T132] ? __pfx_folios_put_refs+0x10/0x10 [ 94.281226][ T132] ? __lock_acquire+0x683/0x2cf0 [ 94.283082][ T132] ? __pfx_lru_move_tail+0x10/0x10 [ 94.284927][ T132] ? __pfx_folio_batch_move_lru+0x10/0x10 [ 94.287024][ T132] ? register_lock_class+0x31/0x2e0 [ 94.289085][ T132] ? __pfx_ext4_do_writepages+0x10/0x10 [ 94.291463][ T132] ? __lock_acquire+0x683/0x2cf0 [ 94.293588][ T132] ? filemap_get_folios_tag+0x118/0x720 [ 94.295988][ T132] ? filemap_get_folios_tag+0x639/0x720 [ 94.298384][ T132] ? filemap_get_folios_tag+0x118/0x720 [ 94.300761][ T132] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 94.303278][ T132] ? ext4_writepages+0x205/0x3b0 [ 94.305352][ T132] ? ext4_writepages+0x205/0x3b0 [ 94.307491][ T132] ext4_writepages+0x241/0x3b0 [ 94.309620][ T132] ? __pfx_ext4_writepages+0x10/0x10 [ 94.311970][ T132] ? do_raw_spin_unlock+0x4d/0x200 [ 94.314180][ T132] ? __pfx_ext4_writepages+0x10/0x10 [ 94.316463][ T132] do_writepages+0x338/0x560 [ 94.318384][ T132] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.320504][ T132] ? locked_inode_to_wb_and_lock_list+0x204/0x310 [ 94.323223][ T132] ? reacquire_held_locks+0x104/0x190 [ 94.325522][ T132] ? writeback_sb_inodes+0x450/0x1b00 [ 94.328331][ T132] __writeback_single_inode+0x136/0x1220 [ 94.331112][ T132] ? do_raw_spin_unlock+0x4d/0x200 [ 94.333651][ T132] writeback_sb_inodes+0x9de/0x1b00 [ 94.336107][ T132] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 94.339076][ T132] ? __pfx_down_read_trylock+0x10/0x10 [ 94.341951][ T132] ? __pfx___up_read+0x10/0x10 [ 94.344143][ T132] __writeback_inodes_wb+0x114/0x240 [ 94.346391][ T132] wb_writeback+0x42f/0xad0 [ 94.348435][ T132] ? queue_io+0x201/0x470 [ 94.350299][ T132] ? __pfx_wb_writeback+0x10/0x10 [ 94.352466][ T132] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.354635][ T132] ? process_scheduled_works+0xa1a/0x14c0 [ 94.357107][ T132] wb_workfn+0x980/0x10f0 [ 94.359037][ T132] ? __pfx_wb_workfn+0x10/0x10 [ 94.361110][ T132] ? do_raw_spin_unlock+0x4d/0x200 [ 94.363456][ T132] ? process_scheduled_works+0xa1a/0x14c0 [ 94.365985][ T132] ? rcu_is_watching+0x16/0xb0 [ 94.368101][ T132] ? process_scheduled_works+0xa1a/0x14c0 [ 94.370594][ T132] process_scheduled_works+0xa88/0x14c0 [ 94.372982][ T132] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.375501][ T132] ? assign_work+0x3cf/0x5d0 [ 94.377469][ T132] worker_thread+0xa47/0xfb0 [ 94.379504][ T132] ? __kthread_parkme+0x71/0x1f0 [ 94.381619][ T132] kthread+0x38b/0x480 [ 94.383321][ T132] ? __pfx_worker_thread+0x10/0x10 [ 94.385574][ T132] ? __pfx_kthread+0x10/0x10 [ 94.387590][ T132] ret_from_fork+0x514/0xb70 [ 94.389631][ T132] ? __pfx_ret_from_fork+0x10/0x10 [ 94.391810][ T132] ? __switch_to+0xc89/0x1420 [ 94.393804][ T132] ? __pfx_kthread+0x10/0x10 [ 94.395733][ T132] ret_from_fork_asm+0x1a/0x30 [ 94.397722][ T132] [ 94.399075][ T132] Modules linked in: [ 94.401247][ T132] ---[ end trace 0000000000000000 ]---