program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000780)='ext3\x00', &(0x7f00000007c0)='./file0\x00', 0x0, &(0x7f0000000800)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@bh}, {@noload}, {@data_err_ignore}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000880)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") syz_mount_image$fuse(0x0, &(0x7f0000000d00)='./bus\x00', 0xa82086, 0x0, 0x31, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000e00)='./file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000e40)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000e80)={0x18}) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000ec0)=0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab02, r3) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000140)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f00000004c0)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x1008, 0x0, 0x70, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) mkdir(&(0x7f00000000c0)='./sys\x00', 0x1ff) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000280)=0x2) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000000)='sysfs\x00', 0x2000000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='none\x00', &(0x7f0000000340)='./proc\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f00000003c0)={0x84, @loopback, 0x4e20, 0x0, 'rr\x00', 0x8}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000680)={{0x84, @loopback, 0x4e20, 0x0, 'rr\x00'}, {@loopback, 0x4e20, 0x1, 0x1}}, 0x44) r6 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r6, &(0x7f0000000700)={0x2, 0x4e20, @loopback}, 0x10) r7 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./proc/net/ip_vs_conn\x00', 0x0, 0x0) read(r7, &(0x7f0000000780), 0x1000) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:1d.0/remove\x00', 0x1, 0x0) write(r8, &(0x7f0000000440)='1', 0x1) [ 102.705482][ T4665] Bluetooth: hci0: command tx timeout [ 102.825774][ T5350] loop0: detected capacity change from 0 to 512 [ 102.835289][ T5350] EXT4-fs: Ignoring removed bh option [ 102.849432][ T5350] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 102.947278][ T5350] EXT4-fs (loop0): 1 truncate cleaned up [ 102.955225][ T5350] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.976722][ T5350] overlayfs: upper fs needs to support d_type. [ 103.021326][ T5350] Oops: divide error: 0000 [#1] SMP KASAN NOPTI [ 103.024209][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.027987][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.032040][ T5350] RIP: 0010:blk_stack_limits+0x1105/0x2d00 [ 103.034776][ T5350] Code: 68 48 4c 89 e8 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 7c 18 00 00 45 8b 65 00 c7 44 24 10 00 00 00 00 eb 5f 48 8b 44 24 48 31 d2 <41> f7 f5 44 01 e9 29 d1 89 c8 31 d2 41 f7 f5 48 8b 44 24 08 4c 8d [ 103.042906][ T5350] RSP: 0018:ffffc9000e2ef4f8 EFLAGS: 00010246 [ 103.045474][ T5350] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 103.048748][ T5350] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 103.051780][ T5350] RBP: ffffc9000e2ef850 R08: ffffc9000e2ef7e0 R09: 1ffffffff38495bc [ 103.055214][ T5350] R10: dffffc0000000000 R11: ffffffff88b32260 R12: 00000000ffffffff [ 103.058221][ T5350] R13: 0000000000000000 R14: 1ffff92001c5df0a R15: ffffc9000e2ef854 [ 103.061127][ T5350] FS: 00007f6dc39f56c0(0000) GS:ffff88808aa10000(0000) knlGS:0000000000000000 [ 103.064831][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.067563][ T5350] CR2: 00007f6dc8365150 CR3: 0000000043ee7000 CR4: 0000000000352ef0 [ 103.070852][ T5350] Call Trace: [ 103.072372][ T5350] [ 103.073737][ T5350] dm_calculate_queue_limits+0x70c/0x1510 [ 103.076810][ T5350] ? __pfx_dm_calculate_queue_limits+0x10/0x10 [ 103.080261][ T5350] ? kmem_cache_alloc_noprof+0x151/0x600 [ 103.083327][ T5350] ? kasan_save_free_info+0x40/0x50 [ 103.086186][ T5350] ? __kasan_mempool_poison_object+0x16e/0x1d0 [ 103.089531][ T5350] ? mempool_init_node+0x474/0x510 [ 103.091859][ T5350] ? __pfx_bioset_init+0x10/0x10 [ 103.093864][ T5350] dm_setup_md_queue+0x199/0x4f0 [ 103.095886][ T5350] ? dm_table_complete+0x1d84/0x22d0 [ 103.098106][ T5350] ? __pfx_dm_setup_md_queue+0x10/0x10 [ 103.100443][ T5350] ? __pfx_dm_table_complete+0x10/0x10 [ 103.102858][ T5350] table_load+0x4fd/0x8a0 [ 103.104714][ T5350] ? __pfx_table_load+0x10/0x10 [ 103.106715][ T5350] ? __might_fault+0xaf/0x130 [ 103.109682][ T5350] dm_ctl_ioctl+0x9ec/0xe10 [ 103.111446][ T5350] ? __pfx_table_load+0x10/0x10 [ 103.113450][ T5350] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.115490][ T5350] ? __fget_files+0x2a/0x420 [ 103.117323][ T5350] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.119442][ T5350] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.121493][ T5350] __se_sys_ioctl+0xfc/0x170 [ 103.123385][ T5350] do_syscall_64+0x166/0x520 [ 103.125364][ T5350] ? trace_irq_disable+0x3b/0x140 [ 103.127686][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.130466][ T5350] ? clear_bhb_loop+0x70/0xc0 [ 103.132543][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.135310][ T5350] RIP: 0033:0x7f6dc759f559 [ 103.137420][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.146526][ T5350] RSP: 002b:00007f6dc39f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.150063][ T5350] RAX: ffffffffffffffda RBX: 00007f6dc7825fa0 RCX: 00007f6dc759f559 [ 103.153283][ T5350] RDX: 00002000000004c0 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.156182][ T5350] RBP: 00007f6dc7636b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.159382][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.162631][ T5350] R13: 00007f6dc7826038 R14: 00007f6dc7825fa0 R15: 00007ffedafb74a8 [ 103.165894][ T5350] [ 103.167278][ T5350] Modules linked in: [ 103.169525][ T5350] ---[ end trace 0000000000000000 ]--- [ 103.182935][ T81] IPVS: starting estimator thread 0... [ 103.200254][ T5350] RIP: 0010:blk_stack_limits+0x1105/0x2d00 [ 103.200369][ T5350] Code: 68 48 4c 89 e8 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 7c 18 00 00 45 8b 65 00 c7 44 24 10 00 00 00 00 eb 5f 48 8b 44 24 48 31 d2 <41> f7 f5 44 01 e9 29 d1 89 c8 31 d2 41 f7 f5 48 8b 44 24 08 4c 8d [ 103.200379][ T5350] RSP: 0018:ffffc9000e2ef4f8 EFLAGS: 00010246 [ 103.200392][ T5350] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 103.200400][ T5350] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 103.200407][ T5350] RBP: ffffc9000e2ef850 R08: ffffc9000e2ef7e0 R09: 1ffffffff38495bc [ 103.200416][ T5350] R10: dffffc0000000000 R11: ffffffff88b32260 R12: 00000000ffffffff [ 103.200425][ T5350] R13: 0000000000000000 R14: 1ffff92001c5df0a R15: ffffc9000e2ef854 [ 103.200491][ T5350] FS: 00007f6dc39f56c0(0000) GS:ffff88808aa10000(0000) knlGS:0000000000000000 [ 103.200503][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.200511][ T5350] CR2: 00007f6dc8365150 CR3: 0000000043ee7000 CR4: 0000000000352ef0 [ 103.200557][ T5350] Kernel panic - not syncing: Fatal exception [ 103.243213][ T5350] Kernel Offset: disabled [ 103.245053][ T5350] Rebooting in 86400 seconds..