program:
socket$nl_generic(0x10, 0x3, 0x10)
mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0)
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mount(&(0x7f0000000040)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x143042, 0x0)
syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x3004089, 0x0, 0x0, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) (fail_nth: 79)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='pids.events\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b)
linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file0/file2\x00', 0x1000)
mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0)
r2 = openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x1, 0x0)
write(r2, &(0x7f0000000680)='1', 0x1)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000006c0)={'wlan1\x00', &(0x7f0000000700)=@ethtool_stats={0x11}})
[ 94.934715][ T5313] Zero length message leads to an empty skb
[ 94.939537][ T5313] jffs2: notice: (5313) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 95.007391][ T5313] overlayfs: upper fs does not support tmpfile.
[ 95.010896][ T5313] FAULT_INJECTION: forcing a failure.
[ 95.010896][ T5313] name failslab, interval 1, probability 0, space 0, times 1
[ 95.017171][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.017188][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.017195][ T5313] Call Trace:
[ 95.017200][ T5313]
[ 95.017205][ T5313] dump_stack_lvl+0xe8/0x150
[ 95.017265][ T5313] should_fail_ex+0x40c/0x560
[ 95.017309][ T5313] should_failslab+0xa8/0x100
[ 95.017324][ T5313] __kmalloc_cache_noprof+0xa8/0x660
[ 95.017335][ T5313] ? ovl_fill_super+0x3c9b/0x5d40
[ 95.017346][ T5313] ? vfs_get_tree+0x92/0x2a0
[ 95.017359][ T5313] ? jffs2_sum_add_kvec+0x858/0x1870
[ 95.017373][ T5313] ? jffs2_sum_add_kvec+0x858/0x1870
[ 95.017391][ T5313] jffs2_sum_add_kvec+0x858/0x1870
[ 95.017410][ T5313] jffs2_flash_direct_writev+0xaa/0xe0
[ 95.017428][ T5313] jffs2_flash_writev+0x156/0x1550
[ 95.017444][ T5313] ? rcu_is_watching+0x15/0xb0
[ 95.017462][ T5313] ? __pfx_jffs2_flash_writev+0x10/0x10
[ 95.017500][ T5313] ? kmem_cache_alloc_noprof+0x150/0x5f0
[ 95.017509][ T5313] ? jffs2_write_dnode+0x14f/0xe20
[ 95.017522][ T5313] ? jffs2_write_dnode+0x14f/0xe20
[ 95.017538][ T5313] jffs2_write_dnode+0x485/0xe20
[ 95.017562][ T5313] ? __pfx_jffs2_write_dnode+0x10/0x10
[ 95.017575][ T5313] ? kernel_fpu_end+0x62/0x80
[ 95.017588][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 95.017600][ T5313] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.017638][ T5313] ? kernel_fpu_end+0x62/0x80
[ 95.017649][ T5313] ? crc32_le+0x6b/0x2c0
[ 95.017663][ T5313] jffs2_do_create+0x18e/0xe00
[ 95.017682][ T5313] ? __pfx_jffs2_do_create+0x10/0x10
[ 95.017695][ T5313] ? jffs2_create+0x21/0x320
[ 95.017704][ T5313] ? jffs2_create+0x21/0x320
[ 95.017717][ T5313] jffs2_create+0x1c8/0x320
[ 95.017729][ T5313] vfs_create+0x2c4/0x450
[ 95.017750][ T5313] ovl_do_create+0x81/0xf0
[ 95.017765][ T5313] ovl_create_real+0x1a8/0x740
[ 95.017785][ T5313] ovl_create_temp+0x169/0x240
[ 95.017801][ T5313] ? __pfx_ovl_create_temp+0x10/0x10
[ 95.017824][ T5313] ovl_fill_super+0x3c9b/0x5d40
[ 95.017835][ T5313] ? lockdep_unlock+0x5d/0xd0
[ 95.017859][ T5313] ? __mutex_trylock_common+0x15f/0x270
[ 95.017875][ T5313] ? __pfx_ovl_fill_super+0x10/0x10
[ 95.017905][ T5313] ? __init_swait_queue_head+0xa8/0x150
[ 95.017923][ T5313] ? shrinker_register+0x158/0x210
[ 95.017937][ T5313] ? sget_fc+0x1833/0x1900
[ 95.017960][ T5313] ? __pfx_ovl_next_opt+0x10/0x10
[ 95.017977][ T5313] ? __pfx_ovl_fill_super+0x10/0x10
[ 95.017988][ T5313] get_tree_nodev+0xbb/0x150
[ 95.018003][ T5313] vfs_get_tree+0x92/0x2a0
[ 95.018018][ T5313] do_new_mount+0x319/0xdc0
[ 95.018032][ T5313] ? __pfx_do_new_mount+0x10/0x10
[ 95.018044][ T5313] ? ns_capable+0x89/0xe0
[ 95.018056][ T5313] ? path_mount+0x647/0x1040
[ 95.018068][ T5313] ? user_path_at+0xd4/0x160
[ 95.018081][ T5313] __se_sys_mount+0x31d/0x420
[ 95.018095][ T5313] ? __pfx___se_sys_mount+0x10/0x10
[ 95.018110][ T5313] ? __x64_sys_mount+0x20/0xc0
[ 95.018120][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.018131][ T5313] do_syscall_64+0x174/0x580
[ 95.018142][ T5313] ? trace_irq_disable+0x3b/0x140
[ 95.018154][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 95.018165][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.018175][ T5313] RIP: 0033:0x7fe775d9e0d9
[ 95.018186][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.018194][ T5313] RSP: 002b:00007fe776d50fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.018206][ T5313] RAX: ffffffffffffffda RBX: 00007fe776025fa0 RCX: 00007fe775d9e0d9
[ 95.018214][ T5313] RDX: 0000200000000b80 RSI: 0000200000000100 RDI: 0000000000000000
[ 95.018220][ T5313] RBP: 00007fe776d51050 R08: 0000200000000240 R09: 0000000000000000
[ 95.018226][ T5313] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002
[ 95.018232][ T5313] R13: 00007fe776026038 R14: 00007fe776025fa0 R15: 00007ffdf4560bd8
[ 95.018249][ T5313]
[ 95.018557][ T5313] jffs2: warning: (5313) jffs2_sum_add_kvec: MEMORY ALLOCATION ERROR!
[ 95.197663][ T5272] Bluetooth: hci0: command tx timeout
[ 95.296165][ T5313] jffs2: Write of 68 bytes at 0x0001e218 failed. returned -12, retlen 0
[ 95.299754][ T5313] jffs2: Not marking the space at 0x0001e218 as dirty because the flash driver returned retlen zero
[ 95.449127][ T5313]
[ 95.450259][ T5313] =====================================
[ 95.452625][ T5313] WARNING: bad unlock balance detected!
[ 95.454992][ T5313] syzkaller #0 Not tainted
[ 95.456837][ T5313] -------------------------------------
[ 95.459206][ T5313] syz.0.0/5313 is trying to release lock (&c->alloc_sem) at:
[ 95.462427][ T5313] [] jffs2_do_create+0x1ae/0xe00
[ 95.465278][ T5313] but there are no more locks to release!
[ 95.467708][ T5313]
[ 95.467708][ T5313] other info that might help us debug this:
[ 95.471171][ T5313] 3 locks held by syz.0.0/5313:
[ 95.473327][ T5313] #0: ffff8880424140d8 (&type->s_umount_key#52/1){+.+.}-{4:4}, at: sget_fc+0x938/0x1900
[ 95.477515][ T5313] #1: ffff888012c72450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90
[ 95.481468][ T5313] #2: ffff88801229a880 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_creating+0xbe/0x100
[ 95.485895][ T5313]
[ 95.485895][ T5313] stack backtrace:
[ 95.488401][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.488419][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.488425][ T5313] Call Trace:
[ 95.488432][ T5313]
[ 95.488438][ T5313] dump_stack_lvl+0xe8/0x150
[ 95.488459][ T5313] ? jffs2_do_create+0x1ae/0xe00
[ 95.488474][ T5313] print_unlock_imbalance_bug+0xdc/0xf0
[ 95.488492][ T5313] lock_release+0x248/0x3c0
[ 95.488508][ T5313] ? jffs2_do_create+0x1ae/0xe00
[ 95.488524][ T5313] __mutex_unlock_slowpath+0x88/0x900
[ 95.488538][ T5313] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.488552][ T5313] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.488565][ T5313] ? do_raw_spin_unlock+0x4d/0x210
[ 95.488578][ T5313] jffs2_do_create+0x1ae/0xe00
[ 95.488595][ T5313] ? __pfx_jffs2_do_create+0x10/0x10
[ 95.488610][ T5313] ? jffs2_create+0x21/0x320
[ 95.488621][ T5313] ? jffs2_create+0x21/0x320
[ 95.488632][ T5313] jffs2_create+0x1c8/0x320
[ 95.488645][ T5313] vfs_create+0x2c4/0x450
[ 95.488662][ T5313] ovl_do_create+0x81/0xf0
[ 95.488678][ T5313] ovl_create_real+0x1a8/0x740
[ 95.488695][ T5313] ovl_create_temp+0x169/0x240
[ 95.488713][ T5313] ? __pfx_ovl_create_temp+0x10/0x10
[ 95.488731][ T5313] ovl_fill_super+0x3c9b/0x5d40
[ 95.488745][ T5313] ? lockdep_unlock+0x5d/0xd0
[ 95.488769][ T5313] ? __mutex_trylock_common+0x15f/0x270
[ 95.488784][ T5313] ? __pfx_ovl_fill_super+0x10/0x10
[ 95.488804][ T5313] ? __init_swait_queue_head+0xa8/0x150
[ 95.488824][ T5313] ? shrinker_register+0x158/0x210
[ 95.488838][ T5313] ? sget_fc+0x1833/0x1900
[ 95.488855][ T5313] ? __pfx_ovl_next_opt+0x10/0x10
[ 95.488872][ T5313] ? __pfx_ovl_fill_super+0x10/0x10
[ 95.488885][ T5313] get_tree_nodev+0xbb/0x150
[ 95.488899][ T5313] vfs_get_tree+0x92/0x2a0
[ 95.488916][ T5313] do_new_mount+0x319/0xdc0
[ 95.488929][ T5313] ? __pfx_do_new_mount+0x10/0x10
[ 95.488941][ T5313] ? ns_capable+0x89/0xe0
[ 95.488954][ T5313] ? path_mount+0x647/0x1040
[ 95.488967][ T5313] ? user_path_at+0xd4/0x160
[ 95.488980][ T5313] __se_sys_mount+0x31d/0x420
[ 95.488994][ T5313] ? __pfx___se_sys_mount+0x10/0x10
[ 95.489009][ T5313] ? __x64_sys_mount+0x20/0xc0
[ 95.489020][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.489031][ T5313] do_syscall_64+0x174/0x580
[ 95.489043][ T5313] ? trace_irq_disable+0x3b/0x140
[ 95.489059][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 95.489070][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.489081][ T5313] RIP: 0033:0x7fe775d9e0d9
[ 95.489093][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.489105][ T5313] RSP: 002b:00007fe776d50fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.489117][ T5313] RAX: ffffffffffffffda RBX: 00007fe776025fa0 RCX: 00007fe775d9e0d9
[ 95.489125][ T5313] RDX: 0000200000000b80 RSI: 0000200000000100 RDI: 0000000000000000
[ 95.489131][ T5313] RBP: 00007fe776d51050 R08: 0000200000000240 R09: 0000000000000000
[ 95.489137][ T5313] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002
[ 95.489143][ T5313] R13: 00007fe776026038 R14: 00007fe776025fa0 R15: 00007ffdf4560bd8
[ 95.489152][ T5313]