program: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, &(0x7f00000001c0)) sendto$packet(r1, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb1000000080086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) syz_read_part_table(0x5e3, &(0x7f0000001100)="$eJzs3L+LHVUUB/DvnZn3YyGy+QMsFtKIgivYiYtpdE0XRDsLW4sViYVYyO5DRfDHH5BWtDAKIdYWChLEdFYiLFqI2FuYwnDlzZt5b0Gt3qIEPp/i3XPv3HPODHPbeeH+VneTWpI7/eyjth+6Jpktg1+TdybJ4mKGhWQyJJYkL9x4+pkre1fLbL22XD0Zrs42XabD2GVviL7s8uGNw3f7+CQlxxnCTD6fplvurau863+/6bslbb+H/1n3VV29iGm+zxdJjkq7fPmzZJFPkouZ9/v2k7S11v41nyQ7Sbs+FVu4eXB78dQQ72Q4aZPV7Pi9Uh8brk1Sa61Nji+NmW3y4JP71/6paJ+/yJnDvsyeXBhzm6wP39G9aVdW4ePf/nycxXxdPbXZlDzdSV49fe7R/k7KqsZk+8cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcPfTaw1834+Ry/1vW8bOfptlsPUn+HOO9+Tn1v3lwe/ett681eePg5R9eefOXw9/ye5I2+4cXktl630ur4db7/dANq+3W/Y/uNdPPPv5mZ70wlC7Jd5d+vFvHDqfD+PoTZ5IPmq37AwAAAAAAAAAAAAAAAAAAwNKtXNm72uT5pOTFbD73r5knpYzTeVJrrX/U3vjx//T6+N38nZ9Slkmp5Wz1y8nuA0mdffBI/7cCq8Raa9e3KP/NM/Lv/goAAP//fn1idw==") r3 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) r4 = io_uring_setup(0x7, &(0x7f00000000c0)) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r4, 0x18, &(0x7f0000000140)={0x8000, 0xffffffffffffffff, 0xc, {0x0, 0xcee}, 0xe}, 0x1) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x8000) mount(&(0x7f0000000400)=@filename='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x1800000, 0x0) [ 74.408615][ T4686] Bluetooth: hci0: command tx timeout [ 74.494544][ T5338] loop0: detected capacity change from 0 to 2048 [ 74.537415][ T5338] loop0: p2 p3 < > p4 < p5 > [ 74.539615][ T5338] loop0: partition table partially beyond EOD, truncated [ 74.547328][ T5338] loop0: p3 start 4225 is beyond EOD, truncated [ 74.582166][ T25] audit: type=1326 audit(1767048703.665:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5337 comm="syz.0.0" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb8c7f8f7c9 code=0x0 [ 74.655906][ T5339] MTD: Attempt to mount non-MTD device "./file0" [ 74.659926][ T5339] romfs: block size(32768) > page size(4096) not supported by filesystem [ 74.664734][ T5339] ------------[ cut here ]------------ [ 74.667278][ T5339] kernel BUG at fs/buffer.c:1582! [ 74.670446][ T5339] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 74.673098][ T5339] CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.677050][ T5339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 74.681581][ T5339] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 74.683959][ T5339] Code: 4c 89 e2 e8 a6 8c 7b 02 e9 42 ff ff ff e8 dc 0f 74 ff 48 89 df 48 c7 c6 80 8a 7a 8b e8 0d 0f db fe 90 0f 0b e8 c5 0f 74 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 74.692273][ T5339] RSP: 0018:ffffc9000be67938 EFLAGS: 00010287 [ 74.694901][ T5339] RAX: ffffffff824cf79b RBX: ffffea0001552c00 RCX: 0000000000100000 [ 74.698405][ T5339] RDX: ffffc900214e2000 RSI: 0000000000001a04 RDI: 0000000000001a05 [ 74.701712][ T5339] RBP: dffffc0000000000 R08: ffffea0001552c07 R09: 1ffffd40002aa580 [ 74.705429][ T5339] R10: dffffc0000000000 R11: fffff940002aa581 R12: 0000000000000003 [ 74.709642][ T5339] R13: 0000000000008000 R14: ffff888046f1e2b8 R15: 0000000000008000 [ 74.713973][ T5339] FS: 00007fb8c8dbb6c0(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 [ 74.718733][ T5339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.721775][ T5339] CR2: 00007fb8c8dbafc8 CR3: 0000000041d68000 CR4: 0000000000352ef0 [ 74.725321][ T5339] Call Trace: [ 74.726835][ T5339] [ 74.728119][ T5339] folio_alloc_buffers+0x3a0/0x640 [ 74.730301][ T5339] bdev_getblk+0x2cc/0x6e0 [ 74.732158][ T5339] __bread_gfp+0x89/0x3b0 [ 74.734055][ T5339] romfs_dev_read+0x22b/0x350 [ 74.736100][ T5339] ? __pfx_romfs_dev_read+0x10/0x10 [ 74.738352][ T5339] ? __kmalloc_cache_noprof+0x3e2/0x700 [ 74.740691][ T5339] romfs_fill_super+0x20e/0x720 [ 74.742643][ T5339] get_tree_bdev_flags+0x40e/0x4d0 [ 74.745013][ T5339] ? __pfx_romfs_fill_super+0x10/0x10 [ 74.747335][ T5339] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 74.749735][ T5339] vfs_get_tree+0x92/0x2a0 [ 74.751662][ T5339] do_new_mount+0x302/0xa10 [ 74.753637][ T5339] ? apparmor_capable+0x137/0x1a0 [ 74.755889][ T5339] ? __pfx_do_new_mount+0x10/0x10 [ 74.758053][ T5339] ? ns_capable+0x8a/0xf0 [ 74.759942][ T5339] ? kmem_cache_free+0x197/0x620 [ 74.762131][ T5339] __se_sys_mount+0x313/0x410 [ 74.764178][ T5339] ? __pfx___se_sys_mount+0x10/0x10 [ 74.766492][ T5339] ? __x64_sys_mount+0x20/0xc0 [ 74.768819][ T5339] do_syscall_64+0xec/0xf80 [ 74.770873][ T5339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.773535][ T5339] ? trace_irq_disable+0x37/0x100 [ 74.775911][ T5339] ? clear_bhb_loop+0x60/0xb0 [ 74.777933][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.780546][ T5339] RIP: 0033:0x7fb8c7f8f7c9 [ 74.782438][ T5339] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.790420][ T5339] RSP: 002b:00007fb8c8dbb038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 74.794024][ T5339] RAX: ffffffffffffffda RBX: 00007fb8c81e6090 RCX: 00007fb8c7f8f7c9 [ 74.797598][ T5339] RDX: 0000200000000000 RSI: 00002000000002c0 RDI: 0000200000000400 [ 74.800986][ T5339] RBP: 00007fb8c8013f91 R08: 0000000000000000 R09: 0000000000000000 [ 74.804906][ T5339] R10: 0000000001800000 R11: 0000000000000246 R12: 0000000000000000 [ 74.808618][ T5339] R13: 00007fb8c81e6128 R14: 00007fb8c81e6090 R15: 00007ffcb2a5dfb8 [ 74.812058][ T5339] [ 74.813415][ T5339] Modules linked in: [ 74.815549][ T5339] ---[ end trace 0000000000000000 ]--- [ 74.833955][ T5339] RIP: 0010:folio_set_bh+0x1dc/0x1e0 [ 74.837283][ T5339] Code: 4c 89 e2 e8 a6 8c 7b 02 e9 42 ff ff ff e8 dc 0f 74 ff 48 89 df 48 c7 c6 80 8a 7a 8b e8 0d 0f db fe 90 0f 0b e8 c5 0f 74 ff 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f [ 74.846369][ T5339] RSP: 0018:ffffc9000be67938 EFLAGS: 00010287 [ 74.849129][ T5339] RAX: ffffffff824cf79b RBX: ffffea0001552c00 RCX: 0000000000100000 [ 74.852406][ T5339] RDX: ffffc900214e2000 RSI: 0000000000001a04 RDI: 0000000000001a05 [ 74.856782][ T5339] RBP: dffffc0000000000 R08: ffffea0001552c07 R09: 1ffffd40002aa580 [ 74.860282][ T5339] R10: dffffc0000000000 R11: fffff940002aa581 R12: 0000000000000003 [ 74.863882][ T5339] R13: 0000000000008000 R14: ffff888046f1e2b8 R15: 0000000000008000 [ 74.869566][ T5339] FS: 00007fb8c8dbb6c0(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 [ 74.872808][ T5339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.875815][ T5339] CR2: 00007fb8c8dbafc8 CR3: 0000000041d68000 CR4: 0000000000352ef0 [ 74.879270][ T5339] Kernel panic - not syncing: Fatal exception [ 74.882226][ T5339] Kernel Offset: disabled [ 74.884277][ T5339] Rebooting in 86400 seconds..