program:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x10000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10)
syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x10, &(0x7f0000001680)={[{@fat=@uid={'uid', 0x3d, 0xee01}}, {@fat=@umask={'umask', 0x3d, 0x1}}]}, 0x1, 0x542, &(0x7f0000000b40)="$eJzs2s9qE1EUB+BjE9MiglmLiwE3rkL1CQySQnFAiMxCceFA4yYjwsxmklUfxCfweXySrLqLtBPaxn8bm05jvg+Ge5jfDJzLwNy7uB+ffJ6efKk+ffj+NQ5eJtGNiL2ziH7sRSca91bj3kXdi+tOAwDYNuNxPmy7BzarLIf5+R5u/5ck+9ZKQwAAAAAAAAAAAPwz5/8BYPc4////K8th3lvt39Y5/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC052y5fLT8y9V2fwDAzbP+A8Dusf4DwO6x/gPA7nn77v3rYZqOxklyELE4rbM6a8YmPzpOR4fJhf7VW4u6zjqX+fMmT9bz+/Fglb/4bd6LZ0+b/Dx79Sb9Kd+Pk81PHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhmkFzqX91d1HXWafLBn/KmOjpOR4erB9bzbjzu3to0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBtQzebTvCgmpWKLi8HD5mvelX4U21+0/WcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADaUs3m07woJmXVdicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF1RzebTvCgm5QaLtucIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA7fsRAAD//7BtjrY=")
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x20)
ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000180)={'veth0\x00', {0x2, 0x0, @private}})
futimesat(r3, 0x0, &(0x7f0000000080))
r4 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21)
pwritev2(r4, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x5a00, 0x0, 0x3)
r5 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x800)
getsockopt$SO_J1939_ERRQUEUE(r5, 0x6b, 0x4, &(0x7f00000001c0), &(0x7f0000000280)=0x4)
ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x18, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x100000008]})
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
mknod$loop(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2, 0x0)
[ 94.027370][ T4642] Bluetooth: hci0: command tx timeout
[ 94.174391][ T5315] Zero length message leads to an empty skb
[ 94.201602][ T5315] loop0: detected capacity change from 0 to 2048
[ 94.360776][ T25] audit: type=1804 audit(1790626890.507:2): pid=5315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.0" name="/newroot/0/file0/file1" dev="loop0" ino=1048585 res=1 errno=0
[ 94.488475][ T5316] loop0: detected capacity change from 2048 to 64
[ 94.492484][ T5315] syz.0.0: attempt to access beyond end of device
[ 94.492484][ T5315] loop0: rw=8388609, sector=128, nr_sectors = 4 limit=64
[ 94.492567][ T5315] Buffer I/O error on dev loop0, logical block 32, lost sync page write
[ 94.495947][ T5315] ------------[ cut here ]------------
[ 94.495956][ T5315] !buffer_uptodate(bh)
[ 94.495962][ T5315] WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410, CPU#0: syz.0.0/5315
[ 94.517801][ T5315] Modules linked in:
[ 94.520123][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.523777][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.528167][ T5315] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 94.530760][ T5315] Code: 4c 89 f7 e8 99 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 5f 57 66 ff eb 8c e8 58 57 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 4a 57 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 94.538870][ T5315] RSP: 0018:ffffc9000f0172b0 EFLAGS: 00010283
[ 94.543184][ T5315] RAX: ffffffff8261a4e8 RBX: ffff888043d5e0e0 RCX: 0000000000100000
[ 94.546676][ T5315] RDX: ffffc9000e75a000 RSI: 000000000001e819 RDI: 000000000001e81a
[ 94.550173][ T5315] RBP: dffffc0000000001 R08: ffff888043d5e0e7 R09: 1ffff110087abc1c
[ 94.553578][ T5315] R10: dffffc0000000000 R11: ffffed10087abc1d R12: ffffffff8c28b180
[ 94.557045][ T5315] R13: ffff888033aa4248 R14: dffffc0000000000 R15: ffff888043dc0788
[ 94.560319][ T5315] FS: 00007f92fc5b76c0(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 94.564132][ T5315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.567095][ T5315] CR2: 00007fb5f147d720 CR3: 000000001390f000 CR4: 0000000000352ef0
[ 94.570576][ T5315] Call Trace:
[ 94.572118][ T5315]
[ 94.573534][ T5315] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 94.575971][ T5315] fat_ent_write+0xb8/0x190
[ 94.578042][ T5315] fat_chain_add+0x409/0x8e0
[ 94.580300][ T5315] ? __pfx_fat_chain_add+0x10/0x10
[ 94.582620][ T5315] ? fat_bmap+0x487/0x5a0
[ 94.584563][ T5315] fat_get_block+0x768/0xae0
[ 94.586826][ T5315] ? lock_acquire+0x115/0x350
[ 94.590145][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.592699][ T5315] ? do_raw_spin_unlock+0x4d/0x200
[ 94.595012][ T5315] ? _raw_spin_unlock+0x28/0x50
[ 94.599090][ T5315] ? create_empty_buffers+0x460/0x520
[ 94.601577][ T5315] __block_write_begin_int+0x6c2/0x1900
[ 94.604140][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.606502][ T5315] ? __pfx___block_write_begin_int+0x10/0x10
[ 94.609088][ T5315] cont_write_begin+0x71b/0xac0
[ 94.611297][ T5315] ? __pfx_cont_write_begin+0x10/0x10
[ 94.613669][ T5315] ? __pfx_unmap_mapping_range+0x10/0x10
[ 94.616193][ T5315] fat_write_begin+0x7a/0x150
[ 94.618206][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.620522][ T5315] generic_perform_write+0x2d5/0x8f0
[ 94.622930][ T5315] ? __pfx_generic_perform_write+0x10/0x10
[ 94.625570][ T5315] ? generic_file_direct_write+0x399/0x3f0
[ 94.628141][ T5315] __generic_file_write_iter+0x1ae/0x230
[ 94.630754][ T5315] generic_file_write_iter+0xae/0x330
[ 94.633156][ T5315] do_iter_readv_writev+0x612/0x8c0
[ 94.635349][ T5315] ? __pfx_do_iter_readv_writev+0x10/0x10
[ 94.637710][ T5315] vfs_writev+0x343/0x990
[ 94.639675][ T5315] ? __pfx_vfs_writev+0x10/0x10
[ 94.641811][ T5315] ? __fget_files+0x2a/0x420
[ 94.643943][ T5315] ? __fget_files+0x3a2/0x420
[ 94.646091][ T5315] ? __fget_files+0x2a/0x420
[ 94.648236][ T5315] __se_sys_pwritev2+0x177/0x2a0
[ 94.650390][ T5315] ? __pfx___se_sys_pwritev2+0x10/0x10
[ 94.652809][ T5315] ? __x64_sys_pwritev2+0x20/0xc0
[ 94.655019][ T5315] do_syscall_64+0x166/0x520
[ 94.657258][ T5315] ? trace_irq_disable+0x3b/0x140
[ 94.659542][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.662251][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 94.664308][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.667073][ T5315] RIP: 0033:0x7f92fb79e159
[ 94.669114][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.678094][ T5315] RSP: 002b:00007f92fc5b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
[ 94.681735][ T5315] RAX: ffffffffffffffda RBX: 00007f92fba25fa0 RCX: 00007f92fb79e159
[ 94.685144][ T5315] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000007
[ 94.688620][ T5315] RBP: 00007f92fb83506b R08: 0000000000000000 R09: 0000000000000003
[ 94.692487][ T5315] R10: 0000000000005a00 R11: 0000000000000246 R12: 0000000000000000
[ 94.696279][ T5315] R13: 00007f92fba26038 R14: 00007f92fba25fa0 R15: 00007ffdd0db5718
[ 94.699641][ T5315]
[ 94.701119][ T5315] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.704394][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.708318][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.712796][ T5315] Call Trace:
[ 94.714320][ T5315]
[ 94.715620][ T5315] vpanic+0x56d/0xa60
[ 94.717358][ T5315] ? __pfx__printk+0x10/0x10
[ 94.719432][ T5315] ? __pfx_vpanic+0x10/0x10
[ 94.721509][ T5315] ? is_bpf_text_address+0x292/0x2b0
[ 94.723783][ T5315] ? is_bpf_text_address+0x26/0x2b0
[ 94.726033][ T5315] panic+0xc5/0xd0
[ 94.727694][ T5315] ? __pfx_panic+0x10/0x10
[ 94.729636][ T5315] __warn+0x315/0x4c0
[ 94.731473][ T5315] ? mark_buffer_dirty+0x299/0x410
[ 94.733743][ T5315] ? mark_buffer_dirty+0x299/0x410
[ 94.735938][ T5315] __report_bug+0x276/0x570
[ 94.737931][ T5315] ? mark_buffer_dirty+0x299/0x410
[ 94.740107][ T5315] ? __pfx___report_bug+0x10/0x10
[ 94.742342][ T5315] ? vprintk_emit+0x4ee/0x560
[ 94.744374][ T5315] ? __pfx_vprintk_emit+0x10/0x10
[ 94.746582][ T5315] ? _printk+0xdd/0x130
[ 94.748467][ T5315] ? mark_buffer_dirty+0x299/0x410
[ 94.750742][ T5315] report_bug+0x16b/0x220
[ 94.752638][ T5315] ? mark_buffer_dirty+0x299/0x410
[ 94.754864][ T5315] ? mark_buffer_dirty+0x29b/0x410
[ 94.757041][ T5315] handle_bug+0x9c/0x200
[ 94.758864][ T5315] exc_invalid_op+0x1a/0x50
[ 94.760769][ T5315] asm_exc_invalid_op+0x1a/0x20
[ 94.762802][ T5315] RIP: 0010:mark_buffer_dirty+0x299/0x410
[ 94.765280][ T5315] Code: 4c 89 f7 e8 99 fa d7 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 5f 57 66 ff eb 8c e8 58 57 66 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 4a 57 66 ff 90 0f 0b 90 e9 cf fd ff ff
[ 94.773267][ T5315] RSP: 0018:ffffc9000f0172b0 EFLAGS: 00010283
[ 94.775874][ T5315] RAX: ffffffff8261a4e8 RBX: ffff888043d5e0e0 RCX: 0000000000100000
[ 94.779198][ T5315] RDX: ffffc9000e75a000 RSI: 000000000001e819 RDI: 000000000001e81a
[ 94.782571][ T5315] RBP: dffffc0000000001 R08: ffff888043d5e0e7 R09: 1ffff110087abc1c
[ 94.785971][ T5315] R10: dffffc0000000000 R11: ffffed10087abc1d R12: ffffffff8c28b180
[ 94.789412][ T5315] R13: ffff888033aa4248 R14: dffffc0000000000 R15: ffff888043dc0788
[ 94.792996][ T5315] ? mark_buffer_dirty+0x298/0x410
[ 94.795300][ T5315] mmb_mark_buffer_dirty+0x2c/0x1f0
[ 94.797538][ T5315] fat_ent_write+0xb8/0x190
[ 94.799566][ T5315] fat_chain_add+0x409/0x8e0
[ 94.801618][ T5315] ? __pfx_fat_chain_add+0x10/0x10
[ 94.803782][ T5315] ? fat_bmap+0x487/0x5a0
[ 94.805675][ T5315] fat_get_block+0x768/0xae0
[ 94.807605][ T5315] ? lock_acquire+0x115/0x350
[ 94.809562][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.811803][ T5315] ? do_raw_spin_unlock+0x4d/0x200
[ 94.813960][ T5315] ? _raw_spin_unlock+0x28/0x50
[ 94.816119][ T5315] ? create_empty_buffers+0x460/0x520
[ 94.818465][ T5315] __block_write_begin_int+0x6c2/0x1900
[ 94.820703][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.822914][ T5315] ? __pfx___block_write_begin_int+0x10/0x10
[ 94.825564][ T5315] cont_write_begin+0x71b/0xac0
[ 94.827848][ T5315] ? __pfx_cont_write_begin+0x10/0x10
[ 94.830236][ T5315] ? __pfx_unmap_mapping_range+0x10/0x10
[ 94.832726][ T5315] fat_write_begin+0x7a/0x150
[ 94.834820][ T5315] ? __pfx_fat_get_block+0x10/0x10
[ 94.837017][ T5315] generic_perform_write+0x2d5/0x8f0
[ 94.839317][ T5315] ? __pfx_generic_perform_write+0x10/0x10
[ 94.841686][ T5315] ? generic_file_direct_write+0x399/0x3f0
[ 94.844070][ T5315] __generic_file_write_iter+0x1ae/0x230
[ 94.846242][ T5315] generic_file_write_iter+0xae/0x330
[ 94.848711][ T5315] do_iter_readv_writev+0x612/0x8c0
[ 94.851073][ T5315] ? __pfx_do_iter_readv_writev+0x10/0x10
[ 94.853638][ T5315] vfs_writev+0x343/0x990
[ 94.855635][ T5315] ? __pfx_vfs_writev+0x10/0x10
[ 94.857793][ T5315] ? __fget_files+0x2a/0x420
[ 94.859730][ T5315] ? __fget_files+0x3a2/0x420
[ 94.861772][ T5315] ? __fget_files+0x2a/0x420
[ 94.863628][ T5315] __se_sys_pwritev2+0x177/0x2a0
[ 94.865976][ T5315] ? __pfx___se_sys_pwritev2+0x10/0x10
[ 94.868647][ T5315] ? __x64_sys_pwritev2+0x20/0xc0
[ 94.871027][ T5315] do_syscall_64+0x166/0x520
[ 94.873291][ T5315] ? trace_irq_disable+0x3b/0x140
[ 94.875350][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.877734][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 94.879950][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.882781][ T5315] RIP: 0033:0x7f92fb79e159
[ 94.884805][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.893361][ T5315] RSP: 002b:00007f92fc5b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
[ 94.897087][ T5315] RAX: ffffffffffffffda RBX: 00007f92fba25fa0 RCX: 00007f92fb79e159
[ 94.900394][ T5315] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000007
[ 94.903706][ T5315] RBP: 00007f92fb83506b R08: 0000000000000000 R09: 0000000000000003
[ 94.907084][ T5315] R10: 0000000000005a00 R11: 0000000000000246 R12: 0000000000000000
[ 94.910476][ T5315] R13: 00007f92fba26038 R14: 00007f92fba25fa0 R15: 00007ffdd0db5718
[ 94.913923][ T5315]
[ 94.915660][ T5315] Kernel Offset: disabled
[ 94.917907][ T5315] Rebooting in 86400 seconds..