FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 548)
FAT-fs (loop3): Filesystem has been set read-only
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5984 Comm: syz.3.14 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline]
RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline]
RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743
Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 0c 33 b9 fd 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000a926680 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: dffffc0000000000 RSI: 0000000000009f72 RDI: ffff8881482bf530
RBP: 0000000000000000 R08: ffff88802496b137 R09: 1ffff1100492d626
R10: dffffc0000000000 R11: ffffed100492d627 R12: 0000000000000c00
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881482bf500
FS:  00007f09e7a456c0(0000) GS:ffff888125ecd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2ea57909c0 CR3: 000000002cab8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 bio_attempt_back_merge+0x4ba/0x920 block/blk-merge.c:940
 blk_attempt_plug_merge+0x145/0x1d0 block/blk-merge.c:1073
 blk_mq_attempt_bio_merge block/blk-mq.c:3022 [inline]
 blk_mq_submit_bio+0x1abd/0x26d0 block/blk-mq.c:3186
 __submit_bio+0x207/0x5a0 block/blk-core.c:637
 __submit_bio_noacct_mq block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x2fb/0xa50 block/blk-core.c:755
 submit_bio_wait+0x104/0x200 block/bio.c:1389
 blkdev_issue_discard+0x113/0x1b0 block/blk-lib.c:95
 sb_issue_discard include/linux/blkdev.h:1280 [inline]
 fat_free_clusters+0x405/0xb80 fs/fat/fatent.c:588
 fat_add_cluster fs/fat/inode.c:115 [inline]
 __fat_get_block fs/fat/inode.c:155 [inline]
 fat_get_block+0x699/0xa70 fs/fat/inode.c:190
 __block_write_begin_int+0x6b5/0x1900 fs/buffer.c:2145
 block_write_begin fs/buffer.c:2256 [inline]
 cont_write_begin+0x78c/0xb50 fs/buffer.c:2594
 fat_write_begin+0x7a/0x150 fs/fat/inode.c:230
 generic_perform_write+0x2c5/0x900 mm/filemap.c:4313
 __generic_file_write_iter+0x1ae/0x230 mm/filemap.c:4427
 generic_file_write_iter+0x117/0x550 mm/filemap.c:4456
 iter_file_splice_write+0x975/0x10e0 fs/splice.c:738
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x101/0x160 fs/splice.c:1161
 splice_direct_to_actor+0x5a8/0xcc0 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x181/0x270 fs/splice.c:1230
 do_sendfile+0x4da/0x7e0 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x13e/0x190 fs/read_write.c:1417
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f09e6b8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f09e7a45038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f09e6de5fa0 RCX: 00007f09e6b8f6c9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f09e6c11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f09e6de6038 R14: 00007f09e6de5fa0 R15: 00007ffee1ed1618
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline]
RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline]
RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743
Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 0c 33 b9 fd 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000a926680 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: dffffc0000000000 RSI: 0000000000009f72 RDI: ffff8881482bf530
RBP: 0000000000000000 R08: ffff88802496b137 R09: 1ffff1100492d626
R10: dffffc0000000000 R11: ffffed100492d627 R12: 0000000000000c00
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881482bf500
FS:  00007f09e7a456c0(0000) GS:ffff888125fcd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005561cf260690 CR3: 000000002cab8000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	fd                   	std
   1:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   8:	fc ff df
   b:	49 8b 06             	mov    (%r14),%rax
   e:	48 89 5c 24 20       	mov    %rbx,0x20(%rsp)
  13:	49 89 de             	mov    %rbx,%r14
  16:	49 c1 e6 04          	shl    $0x4,%r14
  1a:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  1f:	4a 8d 2c 30          	lea    (%rax,%r14,1),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	48 89 ef             	mov    %rbp,%rdi
  33:	e8 0c 33 b9 fd       	call   0xfdb93344
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah