t(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1510.507174] loop4: detected capacity change from 0 to 40 17:13:03 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1510.578049] loop1: detected capacity change from 0 to 40 [ 1510.646063] syz-executor.6: attempt to access beyond end of device [ 1510.646063] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1510.647287] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1510.673036] syz-executor.4: attempt to access beyond end of device [ 1510.673036] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1510.674287] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:13:04 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:13:04 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1510.759833] syz-executor.1: attempt to access beyond end of device [ 1510.759833] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1510.761712] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1510.774045] loop6: detected capacity change from 0 to 40 [ 1510.902219] syz-executor.6: attempt to access beyond end of device [ 1510.902219] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1510.903341] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:17 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:17 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:13:17 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:17 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:17 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:17 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:17 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1523.795689] loop4: detected capacity change from 0 to 40 [ 1523.822214] loop3: detected capacity change from 0 to 40 [ 1523.828113] loop1: detected capacity change from 0 to 40 [ 1523.840522] loop6: detected capacity change from 0 to 40 [ 1523.906513] syz-executor.1: attempt to access beyond end of device [ 1523.906513] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1523.908047] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1523.929534] syz-executor.4: attempt to access beyond end of device [ 1523.929534] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1523.931075] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1523.944834] syz-executor.6: attempt to access beyond end of device [ 1523.944834] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1523.946121] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:17 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1524.000819] syz-executor.3: attempt to access beyond end of device [ 1524.000819] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 17:13:17 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1524.002129] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:13:17 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:17 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1524.316411] loop6: detected capacity change from 0 to 40 [ 1524.342618] loop1: detected capacity change from 0 to 40 17:13:17 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1524.395660] loop3: detected capacity change from 0 to 40 17:13:17 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1524.428729] loop4: detected capacity change from 0 to 40 [ 1524.504475] syz-executor.6: attempt to access beyond end of device [ 1524.504475] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1524.507080] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1524.527142] syz-executor.1: attempt to access beyond end of device [ 1524.527142] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1524.529379] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1524.578867] syz-executor.3: attempt to access beyond end of device [ 1524.578867] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1524.581203] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1524.673455] syz-executor.4: attempt to access beyond end of device [ 1524.673455] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1524.675652] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:13:18 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:18 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:18 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:18 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:18 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:18 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1524.858259] loop3: detected capacity change from 0 to 40 17:13:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:18 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1525.034603] syz-executor.3: attempt to access beyond end of device [ 1525.034603] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1525.036678] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1525.091351] loop4: detected capacity change from 0 to 40 17:13:18 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:13:18 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1525.403763] syz-executor.4: attempt to access beyond end of device [ 1525.403763] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1525.406100] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1525.532636] loop3: detected capacity change from 0 to 40 17:13:19 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:19 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1525.787555] loop4: detected capacity change from 0 to 40 17:13:31 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:31 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:31 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1538.405675] loop1: detected capacity change from 0 to 40 17:13:31 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:31 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:31 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:31 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1538.435942] loop4: detected capacity change from 0 to 40 [ 1538.445475] loop6: detected capacity change from 0 to 40 [ 1538.564090] bio_check_eod: 2 callbacks suppressed [ 1538.564101] syz-executor.4: attempt to access beyond end of device [ 1538.564101] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1538.565819] buffer_io_error: 2 callbacks suppressed [ 1538.565827] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1538.602743] syz-executor.6: attempt to access beyond end of device [ 1538.602743] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1538.605129] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1538.646123] syz-executor.1: attempt to access beyond end of device [ 1538.646123] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1538.648408] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:13:32 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:32 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:32 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1538.922058] loop1: detected capacity change from 0 to 40 [ 1538.946695] loop6: detected capacity change from 0 to 40 [ 1539.022827] syz-executor.1: attempt to access beyond end of device [ 1539.022827] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1539.025083] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:13:32 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1539.164470] loop1: detected capacity change from 0 to 40 [ 1539.195180] loop4: detected capacity change from 0 to 40 [ 1539.253430] syz-executor.6: attempt to access beyond end of device [ 1539.253430] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1539.255207] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1539.431371] syz-executor.4: attempt to access beyond end of device [ 1539.431371] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1539.433156] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1539.472349] syz-executor.1: attempt to access beyond end of device [ 1539.472349] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1539.474361] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:13:32 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1539.670414] loop6: detected capacity change from 0 to 40 [ 1539.783411] syz-executor.6: attempt to access beyond end of device [ 1539.783411] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1539.785492] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:46 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:46 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:46 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, 0x0, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:46 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:46 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:46 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:46 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1553.655007] loop4: detected capacity change from 0 to 40 [ 1553.661462] loop1: detected capacity change from 0 to 40 [ 1553.668178] loop6: detected capacity change from 0 to 40 [ 1553.887689] syz-executor.4: attempt to access beyond end of device [ 1553.887689] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1553.889772] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1553.902487] syz-executor.1: attempt to access beyond end of device [ 1553.902487] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1553.904068] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1553.915663] syz-executor.6: attempt to access beyond end of device [ 1553.915663] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1553.917103] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:47 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:47 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:47 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1554.212170] loop6: detected capacity change from 0 to 40 [ 1554.224176] loop1: detected capacity change from 0 to 40 [ 1554.228355] loop4: detected capacity change from 0 to 40 [ 1554.379189] syz-executor.4: attempt to access beyond end of device [ 1554.379189] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1554.380484] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1554.426300] syz-executor.6: attempt to access beyond end of device [ 1554.426300] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1554.427724] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:13:47 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1554.462587] syz-executor.1: attempt to access beyond end of device [ 1554.462587] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1554.463757] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1554.514342] loop4: detected capacity change from 0 to 40 17:13:47 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1554.600810] syz-executor.4: attempt to access beyond end of device [ 1554.600810] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1554.602822] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:13:47 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:47 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:13:47 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:13:48 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1554.710151] loop2: detected capacity change from 0 to 40 [ 1554.749664] loop1: detected capacity change from 0 to 40 [ 1554.760662] loop6: detected capacity change from 0 to 40 [ 1554.946495] syz-executor.1: attempt to access beyond end of device [ 1554.946495] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1554.948748] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1555.036451] syz-executor.6: attempt to access beyond end of device [ 1555.036451] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1555.037922] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1555.040055] syz-executor.2: attempt to access beyond end of device [ 1555.040055] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1555.042160] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:14:02 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:02 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:02 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:02 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, 0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:02 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:02 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:02 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:02 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1569.611748] loop4: detected capacity change from 0 to 40 [ 1569.618828] loop2: detected capacity change from 0 to 40 [ 1569.642647] loop6: detected capacity change from 0 to 40 [ 1569.646489] loop1: detected capacity change from 0 to 40 [ 1569.690480] syz-executor.4: attempt to access beyond end of device [ 1569.690480] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1569.691541] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1569.700174] syz-executor.1: attempt to access beyond end of device [ 1569.700174] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1569.701313] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:14:03 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, 0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1569.739783] syz-executor.2: attempt to access beyond end of device [ 1569.739783] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1569.740849] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1569.875309] syz-executor.6: attempt to access beyond end of device [ 1569.875309] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1569.876556] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1569.934791] loop4: detected capacity change from 0 to 40 [ 1570.080461] syz-executor.4: attempt to access beyond end of device [ 1570.080461] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1570.082038] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:14:17 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, 0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:17 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, 0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), 0x0) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:17 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1584.164416] loop1: detected capacity change from 0 to 40 [ 1584.203712] loop4: detected capacity change from 0 to 40 [ 1584.215444] loop3: detected capacity change from 0 to 40 [ 1584.220089] loop6: detected capacity change from 0 to 40 [ 1584.231961] loop2: detected capacity change from 0 to 40 [ 1584.407474] syz-executor.2: attempt to access beyond end of device [ 1584.407474] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.409762] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1584.440145] syz-executor.6: attempt to access beyond end of device [ 1584.440145] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.442140] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1584.464668] syz-executor.1: attempt to access beyond end of device [ 1584.464668] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.466542] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1584.541167] syz-executor.4: attempt to access beyond end of device [ 1584.541167] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.543020] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:14:17 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:17 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), 0x0) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1584.573344] syz-executor.3: attempt to access beyond end of device [ 1584.573344] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.575159] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1584.633054] loop2: detected capacity change from 0 to 40 [ 1584.700500] loop6: detected capacity change from 0 to 40 17:14:18 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:18 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1584.848265] syz-executor.2: attempt to access beyond end of device [ 1584.848265] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1584.850220] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:14:18 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1584.948974] loop4: detected capacity change from 0 to 40 [ 1584.987764] loop3: detected capacity change from 0 to 40 17:14:18 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:18 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1585.133098] loop2: detected capacity change from 0 to 40 17:14:18 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1585.181829] syz-executor.4: attempt to access beyond end of device [ 1585.181829] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1585.183218] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1585.252379] syz-executor.3: attempt to access beyond end of device [ 1585.252379] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1585.254524] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1585.301707] syz-executor.2: attempt to access beyond end of device [ 1585.301707] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1585.303565] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:14:18 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:18 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:18 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1585.526084] loop4: detected capacity change from 0 to 40 [ 1585.571362] loop3: detected capacity change from 0 to 40 17:14:19 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), 0x0) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1585.631037] loop2: detected capacity change from 0 to 40 [ 1585.735817] syz-executor.2: attempt to access beyond end of device [ 1585.735817] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1585.737148] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1585.791984] loop6: detected capacity change from 0 to 40 17:14:19 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1585.971283] loop2: detected capacity change from 0 to 40 17:14:33 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:33 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1600.144589] loop3: detected capacity change from 0 to 40 17:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:33 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:33 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), 0x0) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:33 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:33 executing program 6: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:33 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1600.147097] loop1: detected capacity change from 0 to 40 [ 1600.176320] loop6: detected capacity change from 0 to 40 [ 1600.210806] loop4: detected capacity change from 0 to 40 [ 1600.244289] loop2: detected capacity change from 0 to 40 [ 1600.323177] bio_check_eod: 4 callbacks suppressed [ 1600.323199] syz-executor.1: attempt to access beyond end of device [ 1600.323199] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.326289] buffer_io_error: 4 callbacks suppressed [ 1600.326306] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:14:33 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1600.377174] syz-executor.6: attempt to access beyond end of device [ 1600.377174] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.379664] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1600.415835] syz-executor.4: attempt to access beyond end of device [ 1600.415835] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.418292] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1600.443469] syz-executor.3: attempt to access beyond end of device [ 1600.443469] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.446335] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1600.462855] syz-executor.2: attempt to access beyond end of device [ 1600.462855] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.465013] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:14:33 executing program 6: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:33 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:33 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1600.643832] loop6: detected capacity change from 0 to 40 [ 1600.775249] loop1: detected capacity change from 0 to 40 [ 1600.821521] syz-executor.6: attempt to access beyond end of device [ 1600.821521] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1600.823454] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1601.008695] syz-executor.1: attempt to access beyond end of device [ 1601.008695] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1601.011136] Buffer I/O error on dev loop1, logical block 10, lost async page write 17:14:50 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:50 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1617.310540] loop3: detected capacity change from 0 to 40 17:14:50 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:50 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:50 executing program 6: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1617.318481] loop1: detected capacity change from 0 to 40 [ 1617.330325] loop2: detected capacity change from 0 to 40 [ 1617.331233] loop6: detected capacity change from 0 to 40 [ 1617.334099] loop4: detected capacity change from 0 to 40 17:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:50 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:50 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1617.413139] syz-executor.2: attempt to access beyond end of device [ 1617.413139] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.414288] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1617.448698] syz-executor.6: attempt to access beyond end of device [ 1617.448698] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.449780] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1617.455773] syz-executor.3: attempt to access beyond end of device [ 1617.455773] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.456744] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1617.460392] syz-executor.1: attempt to access beyond end of device [ 1617.460392] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.461871] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1617.477250] syz-executor.4: attempt to access beyond end of device [ 1617.477250] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.478190] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:14:50 executing program 7: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000940)) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:14:50 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:50 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:14:50 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:14:50 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1617.601070] loop4: detected capacity change from 0 to 40 17:14:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1617.639460] loop1: detected capacity change from 0 to 40 [ 1617.648415] loop2: detected capacity change from 0 to 40 [ 1617.654618] loop3: detected capacity change from 0 to 40 [ 1617.661102] loop6: detected capacity change from 0 to 40 17:14:51 executing program 7: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000940)) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1617.752177] syz-executor.2: attempt to access beyond end of device [ 1617.752177] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.753206] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1617.804816] syz-executor.1: attempt to access beyond end of device [ 1617.804816] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.805044] syz-executor.3: attempt to access beyond end of device [ 1617.805044] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.805953] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1617.806805] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1617.816326] syz-executor.4: attempt to access beyond end of device [ 1617.816326] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.817557] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:14:51 executing program 7: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000940)) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1617.842170] syz-executor.6: attempt to access beyond end of device [ 1617.842170] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1617.843314] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:15:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:07 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:07 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:07 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0x0) 17:15:07 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:07 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:07 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1634.402324] loop3: detected capacity change from 0 to 40 [ 1634.449658] loop6: detected capacity change from 0 to 40 [ 1634.450590] loop4: detected capacity change from 0 to 40 [ 1634.455387] loop1: detected capacity change from 0 to 40 [ 1634.456983] loop2: detected capacity change from 0 to 40 [ 1634.588348] syz-executor.3: attempt to access beyond end of device [ 1634.588348] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1634.590690] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1634.604283] syz-executor.4: attempt to access beyond end of device [ 1634.604283] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1634.606152] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:15:08 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0x0) [ 1634.684631] syz-executor.2: attempt to access beyond end of device [ 1634.684631] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1634.686550] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1634.688329] syz-executor.1: attempt to access beyond end of device [ 1634.688329] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1634.690343] Buffer I/O error on dev loop1, logical block 10, lost async page write [ 1634.753398] syz-executor.6: attempt to access beyond end of device [ 1634.753398] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1634.755273] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:15:08 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:08 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:08 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0x0) 17:15:08 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:08 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1634.971799] loop4: detected capacity change from 0 to 40 [ 1635.003571] loop2: detected capacity change from 0 to 40 [ 1635.006296] loop1: detected capacity change from 0 to 40 17:15:08 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1635.055700] loop3: detected capacity change from 0 to 40 [ 1635.062718] loop6: detected capacity change from 0 to 40 [ 1635.134856] syz-executor.2: attempt to access beyond end of device [ 1635.134856] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1635.136207] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1635.167318] syz-executor.3: attempt to access beyond end of device [ 1635.167318] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1635.169038] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1635.187621] syz-executor.4: attempt to access beyond end of device [ 1635.187621] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1635.189686] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:15:08 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1635.272264] loop2: detected capacity change from 0 to 40 [ 1635.312293] syz-executor.2: attempt to access beyond end of device [ 1635.312293] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1635.313622] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1635.332756] syz-executor.6: attempt to access beyond end of device [ 1635.332756] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1635.334798] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1635.382719] loop3: detected capacity change from 0 to 40 17:15:08 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:08 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1635.413500] loop1: detected capacity change from 0 to 40 17:15:24 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:24 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:24 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1651.054816] loop1: detected capacity change from 0 to 40 [ 1651.073366] loop4: detected capacity change from 0 to 40 17:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:24 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:24 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:24 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:24 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1651.078389] loop6: detected capacity change from 0 to 40 [ 1651.078508] loop3: detected capacity change from 0 to 40 [ 1651.120653] loop7: detected capacity change from 0 to 40 [ 1651.143647] loop2: detected capacity change from 0 to 40 [ 1651.248086] bio_check_eod: 1 callbacks suppressed [ 1651.248099] syz-executor.2: attempt to access beyond end of device [ 1651.248099] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.249325] buffer_io_error: 1 callbacks suppressed [ 1651.249333] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1651.267077] syz-executor.3: attempt to access beyond end of device [ 1651.267077] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.269502] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1651.271736] syz-executor.6: attempt to access beyond end of device [ 1651.271736] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.274266] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1651.292332] syz-executor.4: attempt to access beyond end of device [ 1651.292332] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.294249] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1651.295247] syz-executor.7: attempt to access beyond end of device [ 1651.295247] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.296530] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:15:24 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) 17:15:24 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:24 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1651.436783] loop1: detected capacity change from 0 to 40 [ 1651.441698] loop2: detected capacity change from 0 to 40 [ 1651.442557] loop4: detected capacity change from 0 to 40 17:15:24 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1651.506420] loop6: detected capacity change from 0 to 40 [ 1651.541561] syz-executor.2: attempt to access beyond end of device [ 1651.541561] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.543512] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1651.695615] syz-executor.4: attempt to access beyond end of device [ 1651.695615] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.697422] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1651.707632] syz-executor.6: attempt to access beyond end of device [ 1651.707632] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1651.709593] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:15:40 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) 17:15:40 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:40 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:40 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:40 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:40 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:40 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1667.607207] loop1: detected capacity change from 0 to 40 [ 1667.612783] loop4: detected capacity change from 0 to 40 [ 1667.613539] loop6: detected capacity change from 0 to 40 [ 1667.619322] loop3: detected capacity change from 0 to 40 [ 1667.621584] loop2: detected capacity change from 0 to 40 [ 1667.666077] loop7: detected capacity change from 0 to 40 [ 1667.767707] syz-executor.3: attempt to access beyond end of device [ 1667.767707] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1667.770351] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:15:41 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1667.820053] syz-executor.2: attempt to access beyond end of device [ 1667.820053] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1667.821586] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:15:41 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1667.876798] syz-executor.4: attempt to access beyond end of device [ 1667.876798] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1667.878604] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1667.900169] syz-executor.6: attempt to access beyond end of device [ 1667.900169] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1667.902218] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:15:41 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r5, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1667.977335] syz-executor.7: attempt to access beyond end of device [ 1667.977335] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1667.979419] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:15:41 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1668.024469] loop1: detected capacity change from 0 to 40 [ 1668.026000] loop2: detected capacity change from 0 to 40 [ 1668.034715] loop3: detected capacity change from 0 to 40 [ 1668.106719] loop4: detected capacity change from 0 to 40 17:15:41 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:41 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1668.206804] syz-executor.2: attempt to access beyond end of device [ 1668.206804] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1668.208836] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1668.287430] syz-executor.3: attempt to access beyond end of device [ 1668.287430] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1668.289502] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1668.347029] loop6: detected capacity change from 0 to 40 [ 1668.351618] syz-executor.4: attempt to access beyond end of device [ 1668.351618] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1668.353531] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:15:41 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1668.358724] loop7: detected capacity change from 0 to 40 [ 1668.517045] syz-executor.6: attempt to access beyond end of device [ 1668.517045] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1668.518179] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1668.526137] syz-executor.7: attempt to access beyond end of device [ 1668.526137] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1668.527573] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:15:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:15:57 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r5, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:57 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:57 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:57 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRESHEX], 0x220) signalfd(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:57 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:57 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1684.254403] loop6: detected capacity change from 0 to 40 [ 1684.259763] loop1: detected capacity change from 0 to 40 [ 1684.275372] loop7: detected capacity change from 0 to 40 [ 1684.277578] loop2: detected capacity change from 0 to 40 [ 1684.279154] loop4: detected capacity change from 0 to 40 [ 1684.397250] syz-executor.6: attempt to access beyond end of device [ 1684.397250] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1684.399568] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1684.485547] syz-executor.2: attempt to access beyond end of device [ 1684.485547] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1684.487410] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:15:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1684.563557] syz-executor.4: attempt to access beyond end of device [ 1684.563557] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1684.565559] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:15:58 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1684.631403] syz-executor.7: attempt to access beyond end of device [ 1684.631403] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1684.633447] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1684.635707] loop1: detected capacity change from 0 to 40 17:15:58 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r5, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:58 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1684.853288] loop6: detected capacity change from 0 to 40 17:15:58 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1684.902671] syz-executor.6: attempt to access beyond end of device [ 1684.902671] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1684.904536] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1684.942755] loop2: detected capacity change from 0 to 40 17:15:58 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1684.983158] loop4: detected capacity change from 0 to 40 [ 1684.994515] loop7: detected capacity change from 0 to 40 [ 1685.043432] loop1: detected capacity change from 0 to 40 17:15:58 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1685.171204] syz-executor.2: attempt to access beyond end of device [ 1685.171204] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1685.172918] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1685.175474] syz-executor.7: attempt to access beyond end of device [ 1685.175474] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1685.178118] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1685.207773] loop6: detected capacity change from 0 to 40 [ 1685.209231] syz-executor.4: attempt to access beyond end of device [ 1685.209231] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1685.211046] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:15:58 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:15:58 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1685.346815] syz-executor.6: attempt to access beyond end of device [ 1685.346815] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1685.349077] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:15:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:15:58 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1685.483113] loop2: detected capacity change from 0 to 40 [ 1685.543606] loop7: detected capacity change from 0 to 40 [ 1685.630234] syz-executor.2: attempt to access beyond end of device [ 1685.630234] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1685.632156] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:16:13 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:13 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1700.092518] loop1: detected capacity change from 0 to 40 [ 1700.108662] loop4: detected capacity change from 0 to 40 [ 1700.131826] loop2: detected capacity change from 0 to 40 [ 1700.133660] loop6: detected capacity change from 0 to 40 [ 1700.138799] loop7: detected capacity change from 0 to 40 [ 1700.143784] loop3: detected capacity change from 0 to 40 [ 1700.177782] bio_check_eod: 1 callbacks suppressed [ 1700.177792] syz-executor.2: attempt to access beyond end of device [ 1700.177792] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.179111] buffer_io_error: 1 callbacks suppressed [ 1700.179118] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:16:13 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.402421] syz-executor.7: attempt to access beyond end of device [ 1700.402421] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.404715] syz-executor.3: attempt to access beyond end of device [ 1700.404715] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.404990] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1700.405812] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1700.449650] syz-executor.4: attempt to access beyond end of device [ 1700.449650] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.452122] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1700.484459] syz-executor.6: attempt to access beyond end of device [ 1700.484459] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.486590] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:16:13 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:13 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.554431] loop2: detected capacity change from 0 to 40 17:16:13 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:13 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.595711] loop3: detected capacity change from 0 to 40 [ 1700.596390] loop6: detected capacity change from 0 to 40 [ 1700.654645] syz-executor.6: attempt to access beyond end of device [ 1700.654645] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.655690] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1700.668531] syz-executor.3: attempt to access beyond end of device [ 1700.668531] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.669732] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:16:14 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.703590] loop4: detected capacity change from 0 to 40 17:16:14 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.748823] syz-executor.2: attempt to access beyond end of device [ 1700.748823] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.750841] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1700.786130] syz-executor.4: attempt to access beyond end of device [ 1700.786130] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.787372] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1700.826985] loop6: detected capacity change from 0 to 40 17:16:14 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1700.864076] loop3: detected capacity change from 0 to 40 [ 1700.944275] syz-executor.6: attempt to access beyond end of device [ 1700.944275] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1700.945433] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1701.043535] loop4: detected capacity change from 0 to 40 17:16:28 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:28 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:28 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:28 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1714.856618] loop6: detected capacity change from 0 to 40 [ 1714.861602] loop7: detected capacity change from 0 to 40 [ 1714.868609] loop3: detected capacity change from 0 to 40 [ 1714.883853] loop4: detected capacity change from 0 to 40 [ 1714.893869] loop1: detected capacity change from 0 to 40 [ 1714.904531] loop2: detected capacity change from 0 to 40 [ 1715.052681] bio_check_eod: 2 callbacks suppressed [ 1715.052705] syz-executor.3: attempt to access beyond end of device [ 1715.052705] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.055481] buffer_io_error: 2 callbacks suppressed [ 1715.055495] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1715.104675] syz-executor.2: attempt to access beyond end of device [ 1715.104675] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.106324] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1715.184463] syz-executor.7: attempt to access beyond end of device [ 1715.184463] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.186262] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1715.207398] syz-executor.6: attempt to access beyond end of device [ 1715.207398] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.209126] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1715.214401] syz-executor.4: attempt to access beyond end of device [ 1715.214401] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.216065] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:16:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:28 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:28 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1715.422069] loop3: detected capacity change from 0 to 40 [ 1715.460580] loop6: detected capacity change from 0 to 40 [ 1715.521845] loop4: detected capacity change from 0 to 40 [ 1715.530913] loop2: detected capacity change from 0 to 40 [ 1715.571342] loop7: detected capacity change from 0 to 40 [ 1715.657059] syz-executor.2: attempt to access beyond end of device [ 1715.657059] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.659041] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1715.664194] syz-executor.6: attempt to access beyond end of device [ 1715.664194] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.666234] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:16:29 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1715.776656] syz-executor.7: attempt to access beyond end of device [ 1715.776656] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.778167] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:16:29 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1715.806186] syz-executor.4: attempt to access beyond end of device [ 1715.806186] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.807612] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1715.824372] loop6: detected capacity change from 0 to 40 17:16:29 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1715.912060] syz-executor.6: attempt to access beyond end of device [ 1715.912060] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1715.914023] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:16:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:29 executing program 1: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:29 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1715.975575] loop2: detected capacity change from 0 to 40 17:16:29 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:29 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1716.060656] loop4: detected capacity change from 0 to 40 [ 1716.104222] loop7: detected capacity change from 0 to 40 [ 1716.113023] loop6: detected capacity change from 0 to 40 17:16:29 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1716.272706] loop2: detected capacity change from 0 to 40 17:16:29 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:29 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1716.722120] loop2: detected capacity change from 0 to 40 [ 1716.756162] loop6: detected capacity change from 0 to 40 17:16:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:46 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:46 executing program 1: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:46 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:46 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:46 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:16:46 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1733.308676] loop7: detected capacity change from 0 to 40 [ 1733.311077] loop3: detected capacity change from 0 to 40 [ 1733.325189] loop2: detected capacity change from 0 to 40 [ 1733.335798] loop4: detected capacity change from 0 to 40 [ 1733.342848] loop6: detected capacity change from 0 to 40 [ 1733.561330] bio_check_eod: 6 callbacks suppressed [ 1733.561352] syz-executor.2: attempt to access beyond end of device [ 1733.561352] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1733.564040] buffer_io_error: 6 callbacks suppressed [ 1733.564053] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1733.612659] syz-executor.6: attempt to access beyond end of device [ 1733.612659] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1733.614688] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:16:47 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1733.711399] syz-executor.4: attempt to access beyond end of device [ 1733.711399] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1733.712525] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:16:47 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:16:47 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1733.929008] loop4: detected capacity change from 0 to 40 [ 1733.933822] loop2: detected capacity change from 0 to 40 [ 1734.097647] syz-executor.2: attempt to access beyond end of device [ 1734.097647] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1734.099446] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1734.232631] syz-executor.4: attempt to access beyond end of device [ 1734.232631] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1734.233834] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:17:04 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:04 executing program 3: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:04 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:04 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:04 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) 17:17:04 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:04 executing program 1: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1751.253400] loop4: detected capacity change from 0 to 40 [ 1751.266178] loop2: detected capacity change from 0 to 40 [ 1751.268644] loop6: detected capacity change from 0 to 40 [ 1751.287114] loop7: detected capacity change from 0 to 40 [ 1751.353916] syz-executor.2: attempt to access beyond end of device [ 1751.353916] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1751.355665] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1751.373138] syz-executor.6: attempt to access beyond end of device [ 1751.373138] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1751.375090] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:17:04 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1751.507367] syz-executor.4: attempt to access beyond end of device [ 1751.507367] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1751.509469] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1751.576376] loop6: detected capacity change from 0 to 40 [ 1751.598468] syz-executor.7: attempt to access beyond end of device [ 1751.598468] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1751.600049] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1751.722496] syz-executor.6: attempt to access beyond end of device [ 1751.722496] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1751.723856] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:17:19 executing program 3: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:19 executing program 1: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) 17:17:19 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:19 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:19 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:19 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:19 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1766.528777] loop2: detected capacity change from 0 to 40 [ 1766.529670] loop6: detected capacity change from 0 to 40 [ 1766.551693] syz-executor.2: attempt to access beyond end of device [ 1766.551693] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1766.552934] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 1766.558361] loop1: detected capacity change from 0 to 40 [ 1766.586833] loop7: detected capacity change from 0 to 40 [ 1766.599720] loop4: detected capacity change from 0 to 40 17:17:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1766.616464] syz-executor.6: attempt to access beyond end of device [ 1766.616464] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1766.618739] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:17:20 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1766.795660] loop2: detected capacity change from 0 to 40 17:17:20 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:20 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1766.907178] syz-executor.4: attempt to access beyond end of device [ 1766.907178] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1766.909395] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1766.937265] syz-executor.7: attempt to access beyond end of device [ 1766.937265] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1766.939417] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1766.970749] loop6: detected capacity change from 0 to 40 [ 1766.995349] syz-executor.2: attempt to access beyond end of device [ 1766.995349] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1766.997144] Buffer I/O error on dev loop2, logical block 10, lost async page write 17:17:20 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1767.302277] syz-executor.6: attempt to access beyond end of device [ 1767.302277] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1767.304347] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:17:34 executing program 3: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:34 executing program 1: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:34 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:34 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:34 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:34 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:34 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:34 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1781.388667] loop7: detected capacity change from 0 to 40 [ 1781.393386] loop2: detected capacity change from 0 to 40 [ 1781.395555] loop3: detected capacity change from 0 to 40 [ 1781.404047] loop6: detected capacity change from 0 to 40 [ 1781.410632] loop1: detected capacity change from 0 to 40 [ 1781.418639] loop4: detected capacity change from 0 to 40 [ 1781.559605] syz-executor.7: attempt to access beyond end of device [ 1781.559605] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1781.561648] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:17:34 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1781.696291] syz-executor.6: attempt to access beyond end of device [ 1781.696291] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1781.698409] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1781.702388] syz-executor.4: attempt to access beyond end of device [ 1781.702388] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1781.704430] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1781.790516] loop2: detected capacity change from 0 to 40 17:17:35 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:17:35 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:35 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:35 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1782.046744] loop2: detected capacity change from 0 to 40 [ 1782.112584] loop4: detected capacity change from 0 to 40 [ 1782.138987] loop7: detected capacity change from 0 to 40 17:17:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1782.212265] loop6: detected capacity change from 0 to 40 17:17:35 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) [ 1782.345417] syz-executor.4: attempt to access beyond end of device [ 1782.345417] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.346770] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1782.375772] syz-executor.7: attempt to access beyond end of device [ 1782.375772] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.377150] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1782.405201] syz-executor.6: attempt to access beyond end of device [ 1782.405201] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.405904] loop2: detected capacity change from 0 to 40 [ 1782.407014] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:17:35 executing program 1: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:35 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:35 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:35 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1782.551841] loop1: detected capacity change from 0 to 40 17:17:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:17:35 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:35 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1782.581742] loop4: detected capacity change from 0 to 40 [ 1782.591807] loop6: detected capacity change from 0 to 40 [ 1782.610828] loop3: detected capacity change from 0 to 40 [ 1782.612736] loop7: detected capacity change from 0 to 40 [ 1782.789420] syz-executor.6: attempt to access beyond end of device [ 1782.789420] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.791315] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1782.841653] syz-executor.4: attempt to access beyond end of device [ 1782.841653] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.843479] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1782.868314] syz-executor.7: attempt to access beyond end of device [ 1782.868314] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1782.870100] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:17:51 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:51 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) 17:17:51 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:51 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:17:51 executing program 5: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:51 executing program 3: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:51 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:17:51 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1798.281593] loop1: detected capacity change from 0 to 40 [ 1798.282282] loop4: detected capacity change from 0 to 40 [ 1798.284017] loop2: detected capacity change from 0 to 40 [ 1798.301250] loop6: detected capacity change from 0 to 40 17:17:51 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) [ 1798.433156] syz-executor.4: attempt to access beyond end of device [ 1798.433156] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1798.434404] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1798.492498] loop2: detected capacity change from 0 to 40 [ 1798.527517] syz-executor.6: attempt to access beyond end of device [ 1798.527517] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1798.529696] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:18:09 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:18:09 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:09 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:09 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5}, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:09 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:09 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:09 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:09 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1816.118779] loop7: detected capacity change from 0 to 40 [ 1816.123307] loop4: detected capacity change from 0 to 40 [ 1816.128569] loop3: detected capacity change from 0 to 40 [ 1816.131722] loop5: detected capacity change from 0 to 40 [ 1816.135108] loop2: detected capacity change from 0 to 40 [ 1816.137605] loop6: detected capacity change from 0 to 40 [ 1816.143738] loop1: detected capacity change from 0 to 40 17:18:09 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1816.405450] syz-executor.6: attempt to access beyond end of device [ 1816.405450] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1816.407768] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1816.410211] syz-executor.7: attempt to access beyond end of device [ 1816.410211] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1816.412172] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1816.420371] syz-executor.4: attempt to access beyond end of device [ 1816.420371] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1816.422320] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1816.432163] syz-executor.5: attempt to access beyond end of device [ 1816.432163] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1816.435554] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1816.455587] loop2: detected capacity change from 0 to 40 17:18:09 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:09 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1816.648411] loop2: detected capacity change from 0 to 40 17:18:10 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1816.809683] loop6: detected capacity change from 0 to 40 [ 1816.836582] loop7: detected capacity change from 0 to 40 [ 1816.869012] loop2: detected capacity change from 0 to 40 [ 1816.905378] loop4: detected capacity change from 0 to 40 [ 1816.962343] loop5: detected capacity change from 0 to 40 [ 1817.059589] syz-executor.6: attempt to access beyond end of device [ 1817.059589] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.061359] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1817.139104] syz-executor.5: attempt to access beyond end of device [ 1817.139104] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.141072] Buffer I/O error on dev loop5, logical block 10, lost async page write 17:18:10 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:10 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1817.166211] syz-executor.7: attempt to access beyond end of device [ 1817.166211] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.168111] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1817.209491] syz-executor.4: attempt to access beyond end of device [ 1817.209491] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.211179] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1817.258332] loop1: detected capacity change from 0 to 40 17:18:10 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0x0, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x0, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:10 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x0, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1817.501755] loop5: detected capacity change from 0 to 40 [ 1817.519297] loop6: detected capacity change from 0 to 40 [ 1817.548596] loop3: detected capacity change from 0 to 40 [ 1817.569789] loop7: detected capacity change from 0 to 40 [ 1817.636464] loop4: detected capacity change from 0 to 40 [ 1817.754516] syz-executor.6: attempt to access beyond end of device [ 1817.754516] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.756367] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1817.819484] syz-executor.3: attempt to access beyond end of device [ 1817.819484] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1817.821736] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:18:11 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1817.964300] loop2: detected capacity change from 0 to 40 17:18:11 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:11 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1818.030658] loop6: detected capacity change from 0 to 40 17:18:11 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:11 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1818.124297] loop5: detected capacity change from 0 to 40 [ 1818.152362] loop7: detected capacity change from 0 to 40 17:18:11 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1818.223681] loop4: detected capacity change from 0 to 40 17:18:11 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1818.257737] loop6: detected capacity change from 0 to 40 17:18:11 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1818.273039] loop3: detected capacity change from 0 to 40 [ 1818.358812] loop7: detected capacity change from 0 to 40 17:18:26 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:26 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) 17:18:26 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1832.729672] loop2: detected capacity change from 0 to 40 [ 1832.746739] loop5: detected capacity change from 0 to 40 [ 1832.758352] loop7: detected capacity change from 0 to 40 [ 1832.768611] loop4: detected capacity change from 0 to 40 [ 1832.774439] loop6: detected capacity change from 0 to 40 [ 1832.778410] loop3: detected capacity change from 0 to 40 [ 1832.882195] bio_check_eod: 9 callbacks suppressed [ 1832.882215] syz-executor.4: attempt to access beyond end of device [ 1832.882215] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1832.885022] buffer_io_error: 9 callbacks suppressed [ 1832.885036] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1832.951730] syz-executor.7: attempt to access beyond end of device [ 1832.951730] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1832.953956] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:18:26 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1832.985308] syz-executor.3: attempt to access beyond end of device [ 1832.985308] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1832.987405] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1833.057261] syz-executor.6: attempt to access beyond end of device [ 1833.057261] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.059509] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1833.081656] loop4: detected capacity change from 0 to 40 17:18:26 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x0, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1833.210741] syz-executor.4: attempt to access beyond end of device [ 1833.210741] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.212816] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:18:26 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:26 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 1833.401189] loop6: detected capacity change from 0 to 40 [ 1833.403996] loop3: detected capacity change from 0 to 40 [ 1833.416085] loop7: detected capacity change from 0 to 40 [ 1833.485219] loop4: detected capacity change from 0 to 40 [ 1833.599776] syz-executor.7: attempt to access beyond end of device [ 1833.599776] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.601587] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1833.616202] syz-executor.3: attempt to access beyond end of device [ 1833.616202] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.618069] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1833.634485] syz-executor.6: attempt to access beyond end of device [ 1833.634485] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.638479] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:18:27 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1833.749296] syz-executor.4: attempt to access beyond end of device [ 1833.749296] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.751127] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:18:27 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1833.920709] loop7: detected capacity change from 0 to 40 [ 1833.965606] syz-executor.7: attempt to access beyond end of device [ 1833.965606] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1833.967385] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:18:42 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:42 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:42 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:42 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:42 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:42 executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:18:42 executing program 2: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1849.417498] loop6: detected capacity change from 0 to 40 [ 1849.464241] loop4: detected capacity change from 0 to 40 [ 1849.472012] loop7: detected capacity change from 0 to 40 17:18:42 executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1849.494608] syz-executor.6: attempt to access beyond end of device [ 1849.494608] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1849.496079] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:18:42 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1849.695090] loop6: detected capacity change from 0 to 40 17:18:43 executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1849.781394] syz-executor.4: attempt to access beyond end of device [ 1849.781394] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1849.783214] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1849.834752] syz-executor.7: attempt to access beyond end of device [ 1849.834752] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1849.836625] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1849.890987] syz-executor.6: attempt to access beyond end of device [ 1849.890987] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1849.892565] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:18:43 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:43 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:43 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:18:43 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1850.185999] loop4: detected capacity change from 0 to 40 [ 1850.199845] loop6: detected capacity change from 0 to 40 [ 1850.202095] loop7: detected capacity change from 0 to 40 [ 1850.407808] syz-executor.7: attempt to access beyond end of device [ 1850.407808] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1850.409673] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:18:43 executing program 2: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1850.443480] syz-executor.6: attempt to access beyond end of device [ 1850.443480] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1850.445502] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1850.479509] syz-executor.4: attempt to access beyond end of device [ 1850.479509] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1850.481263] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:18:58 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:58 executing program 2: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:58 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:18:58 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:58 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:58 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, 0x0, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:18:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:18:58 executing program 3: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r2 = signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r2, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r3, 0x40603d10, &(0x7f0000000940)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1865.126562] loop7: detected capacity change from 0 to 40 [ 1865.133487] loop4: detected capacity change from 0 to 40 [ 1865.136987] loop6: detected capacity change from 0 to 40 [ 1865.147673] FAT-fs (loop1): bogus number of reserved sectors [ 1865.148625] FAT-fs (loop1): Can't find a valid FAT filesystem 17:18:58 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r1, r0, 0x0, 0x0) [ 1865.374182] syz-executor.4: attempt to access beyond end of device [ 1865.374182] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1865.376542] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1865.378646] syz-executor.6: attempt to access beyond end of device [ 1865.378646] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1865.382105] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1865.383726] syz-executor.7: attempt to access beyond end of device [ 1865.383726] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1865.385291] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:18:58 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, 0x0, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1865.658921] loop6: detected capacity change from 0 to 40 [ 1865.919385] syz-executor.6: attempt to access beyond end of device [ 1865.919385] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1865.921373] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:19:14 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:14 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:14 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:14 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index, 0xfffffffffffffe01, 0x0, 0x0, 0x5, 0x0, {0x3}}, 0x0) sendfile(r1, r0, 0x0, 0x0) 17:19:14 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, 0x0, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:14 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:14 executing program 2: r0 = syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1881.458952] FAT-fs (loop3): bogus number of reserved sectors [ 1881.459380] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1881.462864] loop2: detected capacity change from 0 to 40 [ 1881.469859] loop6: detected capacity change from 0 to 40 [ 1881.480063] FAT-fs (loop1): bogus number of reserved sectors [ 1881.480941] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1881.501493] loop4: detected capacity change from 0 to 40 [ 1881.511001] loop5: detected capacity change from 0 to 40 [ 1881.514356] loop7: detected capacity change from 0 to 40 17:19:14 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1881.619243] syz-executor.4: attempt to access beyond end of device [ 1881.619243] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.620293] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1881.652291] loop0: detected capacity change from 0 to 40 [ 1881.667370] syz-executor.6: attempt to access beyond end of device [ 1881.667370] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.668618] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:19:15 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1881.745686] syz-executor.5: attempt to access beyond end of device [ 1881.745686] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.746723] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1881.751504] syz-executor.7: attempt to access beyond end of device [ 1881.751504] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.752729] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1881.806395] loop4: detected capacity change from 0 to 40 [ 1881.840436] syz-executor.0: attempt to access beyond end of device [ 1881.840436] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.841463] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:19:15 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:15 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1881.893347] loop6: detected capacity change from 0 to 40 17:19:15 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, 0x0, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1881.933420] loop7: detected capacity change from 0 to 40 [ 1881.965266] syz-executor.6: attempt to access beyond end of device [ 1881.965266] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.966769] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1881.974553] syz-executor.4: attempt to access beyond end of device [ 1881.974553] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1881.975698] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:19:15 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:15 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1882.045715] loop5: detected capacity change from 0 to 40 17:19:15 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1882.098227] syz-executor.7: attempt to access beyond end of device [ 1882.098227] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1882.099492] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1882.107920] loop6: detected capacity change from 0 to 40 [ 1882.135689] loop0: detected capacity change from 0 to 40 [ 1882.182235] loop4: detected capacity change from 0 to 40 [ 1882.249793] syz-executor.5: attempt to access beyond end of device [ 1882.249793] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1882.251098] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1882.255572] syz-executor.0: attempt to access beyond end of device [ 1882.255572] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1882.257435] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:19:15 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1882.392404] loop7: detected capacity change from 0 to 40 17:19:28 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:28 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:28 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1894.737218] loop0: detected capacity change from 0 to 40 [ 1894.749708] loop5: detected capacity change from 0 to 40 17:19:28 executing program 2: r0 = syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:28 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:28 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, 0x0, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:28 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:28 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1894.764343] loop4: detected capacity change from 0 to 40 [ 1894.772150] loop6: detected capacity change from 0 to 40 [ 1894.805212] FAT-fs (loop1): bogus number of reserved sectors [ 1894.805703] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1894.823120] loop7: detected capacity change from 0 to 40 [ 1894.823315] bio_check_eod: 3 callbacks suppressed [ 1894.823325] syz-executor.5: attempt to access beyond end of device [ 1894.823325] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1894.824412] loop2: detected capacity change from 0 to 40 [ 1894.824557] buffer_io_error: 3 callbacks suppressed [ 1894.824564] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1894.827442] loop3: detected capacity change from 0 to 40 [ 1894.835226] syz-executor.0: attempt to access beyond end of device [ 1894.835226] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1894.836250] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 1894.852117] syz-executor.6: attempt to access beyond end of device [ 1894.852117] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1894.853240] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1894.937313] syz-executor.4: attempt to access beyond end of device [ 1894.937313] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1894.939503] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1894.969189] syz-executor.7: attempt to access beyond end of device [ 1894.969189] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1894.970182] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1895.044068] syz-executor.3: attempt to access beyond end of device [ 1895.044068] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1895.045154] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:19:43 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1909.974947] loop7: detected capacity change from 0 to 40 17:19:43 executing program 2: r0 = syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:43 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1909.985557] loop0: detected capacity change from 0 to 40 17:19:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1909.997849] loop3: detected capacity change from 0 to 40 [ 1910.022457] FAT-fs (loop1): bogus number of reserved sectors [ 1910.022583] loop4: detected capacity change from 0 to 40 [ 1910.023431] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1910.037022] loop2: detected capacity change from 0 to 40 [ 1910.055139] syz-executor.7: attempt to access beyond end of device [ 1910.055139] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.056282] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1910.058786] loop6: detected capacity change from 0 to 40 [ 1910.075174] FAT-fs (loop5): bogus number of reserved sectors [ 1910.076191] FAT-fs (loop5): Can't find a valid FAT filesystem [ 1910.083568] syz-executor.3: attempt to access beyond end of device [ 1910.083568] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.084725] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1910.142402] syz-executor.4: attempt to access beyond end of device [ 1910.142402] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.143538] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1910.164108] syz-executor.0: attempt to access beyond end of device [ 1910.164108] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.165267] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:19:43 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1910.198749] syz-executor.6: attempt to access beyond end of device [ 1910.198749] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.200807] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:19:43 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:43 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:43 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1910.332767] loop7: detected capacity change from 0 to 40 [ 1910.359234] loop3: detected capacity change from 0 to 40 [ 1910.568057] loop4: detected capacity change from 0 to 40 [ 1910.580356] loop6: detected capacity change from 0 to 40 [ 1910.631431] syz-executor.7: attempt to access beyond end of device [ 1910.631431] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.633229] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1910.658793] syz-executor.3: attempt to access beyond end of device [ 1910.658793] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.661174] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:19:44 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1910.775478] syz-executor.4: attempt to access beyond end of device [ 1910.775478] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.777451] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:19:44 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1910.824270] syz-executor.6: attempt to access beyond end of device [ 1910.824270] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1910.826140] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1910.949328] loop7: detected capacity change from 0 to 40 [ 1910.970956] loop3: detected capacity change from 0 to 40 17:19:44 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:44 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:44 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1911.144490] syz-executor.3: attempt to access beyond end of device [ 1911.144490] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1911.146403] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1911.166461] loop2: detected capacity change from 0 to 40 [ 1911.178987] FAT-fs (loop1): bogus number of reserved sectors [ 1911.179855] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1911.189629] loop6: detected capacity change from 0 to 40 17:19:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1911.321613] loop4: detected capacity change from 0 to 40 [ 1911.509489] FAT-fs (loop5): bogus number of reserved sectors [ 1911.510571] FAT-fs (loop5): Can't find a valid FAT filesystem 17:19:59 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:59 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:59 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:59 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:59 executing program 0: r0 = syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:59 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:19:59 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1926.082453] loop2: detected capacity change from 0 to 40 [ 1926.095245] loop3: detected capacity change from 0 to 40 [ 1926.155832] FAT-fs (loop1): bogus number of reserved sectors [ 1926.156962] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1926.173274] loop0: detected capacity change from 0 to 40 [ 1926.174940] loop7: detected capacity change from 0 to 40 [ 1926.176841] bio_check_eod: 3 callbacks suppressed [ 1926.176851] syz-executor.3: attempt to access beyond end of device [ 1926.176851] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.178278] buffer_io_error: 3 callbacks suppressed [ 1926.178286] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1926.200016] loop6: detected capacity change from 0 to 40 [ 1926.201687] loop4: detected capacity change from 0 to 40 [ 1926.225957] FAT-fs (loop5): bogus number of reserved sectors [ 1926.227114] FAT-fs (loop5): Can't find a valid FAT filesystem [ 1926.302269] syz-executor.7: attempt to access beyond end of device [ 1926.302269] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.303371] Buffer I/O error on dev loop7, logical block 10, lost async page write 17:19:59 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:19:59 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1926.416752] syz-executor.4: attempt to access beyond end of device [ 1926.416752] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.417980] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1926.487203] syz-executor.6: attempt to access beyond end of device [ 1926.487203] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.489189] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1926.589058] loop7: detected capacity change from 0 to 40 17:19:59 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1926.643436] loop3: detected capacity change from 0 to 40 17:20:00 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1926.779310] loop4: detected capacity change from 0 to 40 [ 1926.799503] syz-executor.3: attempt to access beyond end of device [ 1926.799503] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.801456] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1926.817517] syz-executor.7: attempt to access beyond end of device [ 1926.817517] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1926.819530] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1926.833631] loop6: detected capacity change from 0 to 40 [ 1927.063532] syz-executor.6: attempt to access beyond end of device [ 1927.063532] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1927.065319] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1927.066513] syz-executor.4: attempt to access beyond end of device [ 1927.066513] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1927.068435] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:20:22 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:20:22 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:20:22 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:22 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:22 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:20:22 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:22 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1949.300939] loop6: detected capacity change from 0 to 40 [ 1949.304581] loop1: detected capacity change from 0 to 40 [ 1949.305743] loop4: detected capacity change from 0 to 40 [ 1949.307845] loop2: detected capacity change from 0 to 40 [ 1949.311532] loop7: detected capacity change from 0 to 40 [ 1949.325487] loop0: detected capacity change from 0 to 40 [ 1949.331284] loop3: detected capacity change from 0 to 40 [ 1949.332332] FAT-fs (loop1): bogus number of reserved sectors [ 1949.333312] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1949.338273] FAT-fs (loop5): bogus number of reserved sectors [ 1949.339159] FAT-fs (loop5): Can't find a valid FAT filesystem [ 1949.480232] syz-executor.3: attempt to access beyond end of device [ 1949.480232] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.482353] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1949.531294] syz-executor.7: attempt to access beyond end of device [ 1949.531294] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.533154] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1949.565748] syz-executor.6: attempt to access beyond end of device [ 1949.565748] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.567686] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1949.585628] syz-executor.4: attempt to access beyond end of device [ 1949.585628] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.587529] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1949.653562] syz-executor.0: attempt to access beyond end of device [ 1949.653562] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.657678] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:20:23 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1949.867914] loop3: detected capacity change from 0 to 40 [ 1949.878110] loop7: detected capacity change from 0 to 40 [ 1949.883254] loop6: detected capacity change from 0 to 40 [ 1949.892483] loop4: detected capacity change from 0 to 40 17:20:23 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1949.960770] syz-executor.3: attempt to access beyond end of device [ 1949.960770] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1949.964411] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1950.076192] syz-executor.7: attempt to access beyond end of device [ 1950.076192] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 17:20:23 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1950.078308] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 1950.099278] syz-executor.4: attempt to access beyond end of device [ 1950.099278] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1950.101208] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1950.121079] loop0: detected capacity change from 0 to 40 [ 1950.122782] syz-executor.6: attempt to access beyond end of device [ 1950.122782] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1950.124645] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:20:23 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1950.300419] loop5: detected capacity change from 0 to 40 [ 1950.310356] loop3: detected capacity change from 0 to 40 [ 1950.348032] syz-executor.0: attempt to access beyond end of device [ 1950.348032] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1950.350114] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 1950.391095] loop7: detected capacity change from 0 to 40 17:20:23 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:23 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1950.489678] loop4: detected capacity change from 0 to 40 [ 1950.492772] loop6: detected capacity change from 0 to 40 17:20:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1950.534770] loop1: detected capacity change from 0 to 40 [ 1950.557323] FAT-fs (loop1): bogus number of reserved sectors [ 1950.558164] FAT-fs (loop1): Can't find a valid FAT filesystem 17:20:23 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1950.648289] loop0: detected capacity change from 0 to 40 [ 1950.691617] FAT-fs (loop0): bogus number of reserved sectors [ 1950.692609] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1950.815490] loop5: detected capacity change from 0 to 40 17:20:39 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:39 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:39 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:39 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:20:39 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1965.845735] loop1: detected capacity change from 0 to 40 [ 1965.855212] loop0: detected capacity change from 0 to 40 17:20:39 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:39 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:39 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1965.864791] loop4: detected capacity change from 0 to 40 [ 1965.869498] loop3: detected capacity change from 0 to 40 [ 1965.879680] FAT-fs (loop1): bogus number of reserved sectors [ 1965.880333] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1965.891935] loop6: detected capacity change from 0 to 40 [ 1965.901980] loop7: detected capacity change from 0 to 40 [ 1965.902283] loop5: detected capacity change from 0 to 40 [ 1965.972120] bio_check_eod: 6 callbacks suppressed [ 1965.972131] syz-executor.4: attempt to access beyond end of device [ 1965.972131] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1965.973851] buffer_io_error: 6 callbacks suppressed [ 1965.973860] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1966.003093] syz-executor.0: attempt to access beyond end of device [ 1966.003093] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1966.004495] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 1966.017610] syz-executor.3: attempt to access beyond end of device [ 1966.017610] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1966.018961] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:20:39 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1966.060627] syz-executor.6: attempt to access beyond end of device [ 1966.060627] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1966.061983] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1966.102569] syz-executor.5: attempt to access beyond end of device [ 1966.102569] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1966.103674] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1966.166150] loop7: detected capacity change from 0 to 40 17:20:55 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:20:55 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1981.801402] loop6: detected capacity change from 0 to 40 [ 1981.818508] loop7: detected capacity change from 0 to 40 [ 1981.823829] loop4: detected capacity change from 0 to 40 [ 1981.831676] loop3: detected capacity change from 0 to 40 [ 1981.835619] loop1: detected capacity change from 0 to 40 [ 1981.861600] loop0: detected capacity change from 0 to 40 [ 1981.862753] loop5: detected capacity change from 0 to 40 [ 1981.866087] syz-executor.6: attempt to access beyond end of device [ 1981.866087] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1981.867238] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:20:55 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) [ 1981.894303] FAT-fs (loop1): bogus number of reserved sectors [ 1981.895239] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1981.918366] loop7: detected capacity change from 0 to 40 17:20:55 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.001696] syz-executor.4: attempt to access beyond end of device [ 1982.001696] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.003642] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1982.045013] loop6: detected capacity change from 0 to 40 17:20:55 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.100707] syz-executor.3: attempt to access beyond end of device [ 1982.100707] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.103247] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:20:55 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) [ 1982.207698] syz-executor.5: attempt to access beyond end of device [ 1982.207698] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.209607] Buffer I/O error on dev loop5, logical block 10, lost async page write 17:20:55 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.240685] syz-executor.6: attempt to access beyond end of device [ 1982.240685] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.242446] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1982.276044] loop0: detected capacity change from 0 to 40 17:20:55 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.395761] loop7: detected capacity change from 0 to 40 [ 1982.410702] syz-executor.0: attempt to access beyond end of device [ 1982.410702] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.412479] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:20:55 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.492779] loop4: detected capacity change from 0 to 40 17:20:55 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:20:55 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r6, 0x40603d10, &(0x7f0000000940)) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1982.559712] loop6: detected capacity change from 0 to 40 [ 1982.583489] loop3: detected capacity change from 0 to 40 17:20:56 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef) [ 1982.665332] loop5: detected capacity change from 0 to 40 [ 1982.669324] syz-executor.6: attempt to access beyond end of device [ 1982.669324] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.671630] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1982.723552] syz-executor.4: attempt to access beyond end of device [ 1982.723552] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.725461] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1982.739094] loop0: detected capacity change from 0 to 40 [ 1982.777551] syz-executor.5: attempt to access beyond end of device [ 1982.777551] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.779750] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 1982.807811] loop7: detected capacity change from 0 to 40 [ 1982.814732] syz-executor.3: attempt to access beyond end of device [ 1982.814732] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1982.816713] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:21:09 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:09 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:09 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:21:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1996.159504] loop7: detected capacity change from 0 to 40 [ 1996.170560] loop4: detected capacity change from 0 to 40 17:21:09 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1996.191741] loop0: detected capacity change from 0 to 40 [ 1996.193630] FAT-fs (loop2): bogus number of reserved sectors [ 1996.194211] FAT-fs (loop2): Can't find a valid FAT filesystem [ 1996.201219] loop1: detected capacity change from 0 to 40 17:21:09 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6, r7}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:09 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:09 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1996.211721] loop5: detected capacity change from 0 to 40 [ 1996.223893] FAT-fs (loop5): bogus number of reserved sectors [ 1996.224348] FAT-fs (loop5): Can't find a valid FAT filesystem [ 1996.232923] FAT-fs (loop1): bogus number of reserved sectors [ 1996.233381] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1996.261722] loop3: detected capacity change from 0 to 40 [ 1996.263335] loop6: detected capacity change from 0 to 40 17:21:09 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) [ 1996.279103] bio_check_eod: 1 callbacks suppressed [ 1996.279114] syz-executor.4: attempt to access beyond end of device [ 1996.279114] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.280791] buffer_io_error: 1 callbacks suppressed [ 1996.280809] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1996.386714] syz-executor.0: attempt to access beyond end of device [ 1996.386714] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.388028] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 1996.389785] loop7: detected capacity change from 0 to 40 17:21:09 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1996.444351] syz-executor.6: attempt to access beyond end of device [ 1996.444351] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.445708] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 1996.449515] syz-executor.3: attempt to access beyond end of device [ 1996.449515] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.451503] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:21:09 executing program 0: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 1996.560671] loop4: detected capacity change from 0 to 40 [ 1996.576018] loop0: detected capacity change from 0 to 40 17:21:09 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r6}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:09 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) 17:21:10 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 1996.726445] loop3: detected capacity change from 0 to 40 [ 1996.764512] syz-executor.4: attempt to access beyond end of device [ 1996.764512] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.766319] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 1996.770640] loop7: detected capacity change from 0 to 40 [ 1996.794277] loop6: detected capacity change from 0 to 40 [ 1996.844191] syz-executor.0: attempt to access beyond end of device [ 1996.844191] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1996.846269] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 1997.033418] syz-executor.3: attempt to access beyond end of device [ 1997.033418] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1997.035386] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 1997.098085] syz-executor.6: attempt to access beyond end of device [ 1997.098085] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 1997.100117] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:21:24 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:24 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:24 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2011.283714] loop3: detected capacity change from 0 to 40 17:21:24 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:24 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:24 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2011.295958] loop5: detected capacity change from 0 to 40 [ 2011.302691] loop7: detected capacity change from 0 to 40 [ 2011.309519] loop4: detected capacity change from 0 to 40 [ 2011.354620] loop0: detected capacity change from 0 to 40 [ 2011.364195] loop1: detected capacity change from 0 to 40 [ 2011.368008] FAT-fs (loop2): bogus number of reserved sectors [ 2011.368937] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2011.369406] loop6: detected capacity change from 0 to 40 [ 2011.378405] FAT-fs (loop1): bogus number of reserved sectors [ 2011.379013] FAT-fs (loop1): Can't find a valid FAT filesystem [ 2011.451758] syz-executor.5: attempt to access beyond end of device [ 2011.451758] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.453675] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2011.483204] syz-executor.3: attempt to access beyond end of device [ 2011.483204] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.485308] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 2011.487474] syz-executor.4: attempt to access beyond end of device [ 2011.487474] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.489609] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:21:24 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:24 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2011.618856] syz-executor.6: attempt to access beyond end of device [ 2011.618856] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.621450] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 2011.650543] syz-executor.0: attempt to access beyond end of device [ 2011.650543] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.652705] Buffer I/O error on dev loop0, logical block 10, lost async page write 17:21:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2011.679319] loop4: detected capacity change from 0 to 40 [ 2011.781404] syz-executor.4: attempt to access beyond end of device [ 2011.781404] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2011.783241] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2011.806174] loop3: detected capacity change from 0 to 40 17:21:25 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x0) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x0, 0x80000, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2011.898191] loop5: detected capacity change from 0 to 40 [ 2011.971224] loop0: detected capacity change from 0 to 40 [ 2012.026785] loop4: detected capacity change from 0 to 40 [ 2012.108153] loop6: detected capacity change from 0 to 40 [ 2012.114182] syz-executor.5: attempt to access beyond end of device [ 2012.114182] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2012.116217] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2012.155327] syz-executor.3: attempt to access beyond end of device [ 2012.155327] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2012.157291] Buffer I/O error on dev loop3, logical block 10, lost async page write 17:21:25 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2012.214559] syz-executor.0: attempt to access beyond end of device [ 2012.214559] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2012.216447] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2012.275191] syz-executor.4: attempt to access beyond end of device [ 2012.275191] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2012.277028] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:21:25 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2012.319650] loop5: detected capacity change from 0 to 40 17:21:25 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x0) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:25 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2012.465413] loop7: detected capacity change from 0 to 40 [ 2012.491680] loop4: detected capacity change from 0 to 40 [ 2012.493462] loop3: detected capacity change from 0 to 40 [ 2012.501142] FAT-fs (loop2): bogus number of reserved sectors [ 2012.502253] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2012.525173] loop0: detected capacity change from 0 to 40 [ 2012.578798] loop6: detected capacity change from 0 to 40 [ 2012.583332] loop1: detected capacity change from 0 to 40 [ 2012.597235] FAT-fs (loop1): bogus number of reserved sectors [ 2012.598186] FAT-fs (loop1): Can't find a valid FAT filesystem [ 2027.126636] loop1: detected capacity change from 0 to 40 17:21:40 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x0) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) [ 2027.142685] loop5: detected capacity change from 0 to 40 perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2027.148359] loop3: detected capacity change from 0 to 40 [ 2027.151244] FAT-fs (loop1): bogus number of reserved sectors [ 2027.151716] FAT-fs (loop1): Can't find a valid FAT filesystem [ 2027.156394] loop0: detected capacity change from 0 to 40 [ 2027.161054] FAT-fs (loop2): bogus number of reserved sectors [ 2027.161130] loop4: detected capacity change from 0 to 40 [ 2027.161553] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2027.164679] loop6: detected capacity change from 0 to 40 [ 2027.166200] loop7: detected capacity change from 0 to 40 [ 2027.273817] bio_check_eod: 6 callbacks suppressed [ 2027.273845] syz-executor.3: attempt to access beyond end of device [ 2027.273845] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.276400] buffer_io_error: 6 callbacks suppressed [ 2027.276409] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 2027.291231] syz-executor.5: attempt to access beyond end of device [ 2027.291231] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.292377] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2027.295825] syz-executor.0: attempt to access beyond end of device [ 2027.295825] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.296979] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2027.310252] syz-executor.6: attempt to access beyond end of device [ 2027.310252] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.312352] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 2027.369647] syz-executor.4: attempt to access beyond end of device [ 2027.369647] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.370693] Buffer I/O error on dev loop4, logical block 10, lost async page write 17:21:40 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2027.452223] loop6: detected capacity change from 0 to 40 17:21:40 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, 0x0, 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:40 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, 0x0, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2027.538089] loop3: detected capacity change from 0 to 40 17:21:40 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2027.633220] syz-executor.6: attempt to access beyond end of device [ 2027.633220] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.634275] Buffer I/O error on dev loop6, logical block 10, lost async page write [ 2027.638507] loop0: detected capacity change from 0 to 40 [ 2027.650905] loop5: detected capacity change from 0 to 40 [ 2027.665292] loop4: detected capacity change from 0 to 40 [ 2027.736584] syz-executor.3: attempt to access beyond end of device [ 2027.736584] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.737837] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 2027.827710] syz-executor.4: attempt to access beyond end of device [ 2027.827710] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.828776] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2027.836167] syz-executor.0: attempt to access beyond end of device [ 2027.836167] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.837201] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2027.847538] syz-executor.5: attempt to access beyond end of device [ 2027.847538] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2027.848591] Buffer I/O error on dev loop5, logical block 10, lost async page write 17:21:54 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 7: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:54 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2040.949925] loop4: detected capacity change from 0 to 40 17:21:54 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x0, 0x23456}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)) r3 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) sendto$unix(r3, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r4, 0x40603d10, &(0x7f0000000940)) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2040.979288] loop1: detected capacity change from 0 to 40 [ 2040.982389] loop5: detected capacity change from 0 to 40 [ 2040.986087] FAT-fs (loop2): bogus number of reserved sectors [ 2040.986591] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2040.991628] loop0: detected capacity change from 0 to 40 [ 2040.994133] FAT-fs (loop1): bogus number of reserved sectors [ 2040.994627] FAT-fs (loop1): Can't find a valid FAT filesystem [ 2041.003800] loop6: detected capacity change from 0 to 40 [ 2041.036013] loop3: detected capacity change from 0 to 40 [ 2041.125269] syz-executor.3: attempt to access beyond end of device [ 2041.125269] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.126538] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 2041.134283] syz-executor.4: attempt to access beyond end of device [ 2041.134283] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.136455] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2041.192774] syz-executor.5: attempt to access beyond end of device [ 2041.192774] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.195083] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2041.212313] syz-executor.0: attempt to access beyond end of device [ 2041.212313] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.214157] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2041.218139] syz-executor.6: attempt to access beyond end of device [ 2041.218139] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.219989] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:21:54 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(0xffffffffffffffff, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:54 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2041.449948] loop3: detected capacity change from 0 to 40 [ 2041.488452] loop4: detected capacity change from 0 to 40 [ 2041.505325] loop6: detected capacity change from 0 to 40 [ 2041.617797] loop0: detected capacity change from 0 to 40 [ 2041.640084] syz-executor.4: attempt to access beyond end of device [ 2041.640084] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.642170] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2041.687385] loop5: detected capacity change from 0 to 40 [ 2041.730747] syz-executor.3: attempt to access beyond end of device [ 2041.730747] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.733132] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 2041.826584] syz-executor.6: attempt to access beyond end of device [ 2041.826584] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.829185] Buffer I/O error on dev loop6, logical block 10, lost async page write 17:21:55 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r4, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000}, 0x4) sendto$unix(r5, &(0x7f0000000400)="481e4aee52d65c4be47cb5d90072436dac25a8903eb8d5ccbc98a6e3ca98ddfda5fca64f071a19893b15ae5377154f202a1909fbb43c2c2b48b4690cdc5ed777516a9f87d0fc86326e72c583691f87eb95ac98f7544b3cc7efcbd90e71b533b4ffd0e44c622e6b811a90fba94a9bb5ff5fcf5a55a35727df43dc859b69598f6cd380ebab3a004cf9e5b2f6a79aa9eaa3575b67f1bb912e26e110cecef04250aabb19550d88df8b6de291280e9301b7529433ea39cdde08e99a54a071ed52ec98861c10b24ad66d11635571ad5878e790b3ed0512f630ba449a88babe3e9ae3f5e91d9f59f72a620efc3d81291b", 0xed, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="02002cbd7000fbdbdf25740000000400f4000400f4000400f40000f4000400f4000400f400040009010400f4000400f40000"], 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x80800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r6, 0x0, &(0x7f0000000280)="d2", 0x1}, 0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r8 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$PTP_PIN_SETFUNC2(r8, 0x40603d10, &(0x7f0000000940)) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3, 0x0, {0x0, r7, r8}}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2041.898365] syz-executor.5: attempt to access beyond end of device [ 2041.898365] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2041.900146] Buffer I/O error on dev loop5, logical block 10, lost async page write 17:21:55 executing program 6: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r4 = signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) sendto$unix(r4, 0x0, 0x0, 0x40, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 17:21:55 executing program 1: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:55 executing program 7: chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT], 0x220) signalfd(0xffffffffffffffff, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r0, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 17:21:55 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESOCT], 0x220) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, 0x0, &(0x7f0000000140)=0x0) signalfd(r0, &(0x7f00000003c0)={[0xf807]}, 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2007, @fd_index=0x7, 0xfffffffffffffe01, 0x8001, 0x7, 0x5, 0x0, {0x3}}, 0x1) syz_io_uring_submit(0x0, r3, &(0x7f00000005c0)=@IORING_OP_OPENAT={0x12, 0x4, 0x0, r1, 0x0, &(0x7f0000000580)='./file1\x00', 0x3d, 0x80000, 0x23456}, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd, 0x0, 0x0, 0x7f, 0x3}, 0x200) perf_event_open(&(0x7f0000000280)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2042.114677] loop4: detected capacity change from 0 to 40 [ 2042.170321] loop6: detected capacity change from 0 to 40 [ 2042.210121] loop3: detected capacity change from 0 to 40 [ 2042.217546] loop1: detected capacity change from 0 to 40 [ 2042.256423] FAT-fs (loop1): bogus number of reserved sectors [ 2042.257563] FAT-fs (loop1): Can't find a valid FAT filesystem [ 2042.323193] syz-executor.4: attempt to access beyond end of device [ 2042.323193] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2042.325092] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2043.375158] ================================================================== [ 2043.375899] BUG: KASAN: use-after-free in __lock_acquire+0x42c9/0x5e70 [ 2043.376529] Read of size 8 at addr ffff88800ed866d8 by task syz-executor/9061 [ 2043.377206] [ 2043.377369] CPU: 0 PID: 9061 Comm: syz-executor Not tainted 5.19.0-rc7-next-20220722 #1 [ 2043.378111] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 2043.379131] Call Trace: [ 2043.379373] [ 2043.379589] dump_stack_lvl+0x8b/0xb3 [ 2043.379953] print_report.cold+0x5e/0x5e5 [ 2043.380342] ? __lock_acquire+0x42c9/0x5e70 [ 2043.380757] kasan_report+0xb1/0x1c0 [ 2043.381124] ? __lock_acquire+0x42c9/0x5e70 [ 2043.381547] __lock_acquire+0x42c9/0x5e70 [ 2043.381949] ? lock_chain_count+0x20/0x20 [ 2043.382342] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2043.382840] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2043.383336] ? finish_task_switch.isra.0+0x230/0x8a0 [ 2043.383813] lock_acquire+0x1a2/0x530 [ 2043.384174] ? kmemleak_scan+0x21d/0x16f0 [ 2043.384573] ? lock_release+0x750/0x750 [ 2043.384962] ? mark_held_locks+0x9e/0xe0 [ 2043.385359] ? call_rcu+0x589/0xa30 [ 2043.385700] ? call_rcu+0x589/0xa30 [ 2043.386052] ? _raw_spin_lock_irq+0x41/0x50 [ 2043.386480] _raw_spin_lock_irq+0x32/0x50 [ 2043.386861] ? kmemleak_scan+0x21d/0x16f0 [ 2043.387251] kmemleak_scan+0x21d/0x16f0 [ 2043.387822] ? paint_ptr+0xc0/0xc0 [ 2043.388168] ? strncpy_from_user+0x204/0x3e0 [ 2043.389096] kmemleak_write+0x570/0x680 [ 2043.389480] ? kmemleak_scan+0x16f0/0x16f0 [ 2043.390337] ? debugfs_file_get+0x1ce/0x450 [ 2043.390749] ? debugfs_file_put+0xd0/0xd0 [ 2043.391146] full_proxy_write+0x11d/0x190 [ 2043.391544] vfs_write+0x2cb/0xd90 [ 2043.391891] ? full_proxy_poll+0x180/0x180 [ 2043.392300] ? __ia32_sys_pread64+0x220/0x220 [ 2043.392727] ? lock_release+0x3b2/0x750 [ 2043.393131] ? __up_read+0x192/0x710 [ 2043.393475] ? handle_mm_fault+0x6fd/0xa20 [ 2043.393876] ? up_write+0x460/0x460 [ 2043.394224] ? __fget_light+0x212/0x280 [ 2043.394598] ksys_write+0x127/0x250 [ 2043.394943] ? __ia32_sys_read+0xb0/0xb0 [ 2043.395324] ? syscall_enter_from_user_mode+0x1d/0x50 [ 2043.395802] ? syscall_enter_from_user_mode+0x1d/0x50 [ 2043.396286] do_syscall_64+0x3b/0x90 [ 2043.396633] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2043.397117] RIP: 0033:0x7f0654d8e5c3 [ 2043.397471] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 2043.399123] RSP: 002b:00007ffe1a18b9e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2043.399817] RAX: ffffffffffffffda RBX: 00007ffe1a18c028 RCX: 00007f0654d8e5c3 [ 2043.400465] RDX: 0000000000000004 RSI: 00007f0654e44ed9 RDI: 0000000000000003 [ 2043.401124] RBP: 0000000000000002 R08: 00000000000007fa R09: 00007ffe1a1c1080 [ 2043.401766] R10: 00007ffe1a1c1090 R11: 0000000000000246 R12: 00000000fffffff6 [ 2043.402406] R13: 00007ffe1a18cef1 R14: 0000000000000000 R15: 00000000001f2c23 [ 2043.403053] [ 2043.403269] [ 2043.403428] Allocated by task 9039: [ 2043.403771] kasan_save_stack+0x1e/0x40 [ 2043.404142] __kasan_slab_alloc+0x66/0x80 [ 2043.404507] kmem_cache_alloc+0x1b1/0x4a0 [ 2043.404872] __create_object.isra.0+0x3d/0xc10 [ 2043.405295] kmem_cache_alloc+0x24b/0x4a0 [ 2043.405669] __alloc_file+0x21/0x240 [ 2043.406016] alloc_empty_file+0x6d/0x170 [ 2043.406391] path_openat+0xd4/0x2800 [ 2043.406741] do_filp_open+0x1b6/0x410 [ 2043.407097] do_sys_openat2+0x171/0x4c0 [ 2043.407468] __x64_sys_openat+0x13f/0x1f0 [ 2043.407847] do_syscall_64+0x3b/0x90 [ 2043.408194] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2043.408667] [ 2043.408825] Freed by task 19: [ 2043.409116] kasan_save_stack+0x1e/0x40 [ 2043.409476] kasan_set_track+0x21/0x30 [ 2043.409831] kasan_set_free_info+0x20/0x40 [ 2043.410213] __kasan_slab_free+0x108/0x190 [ 2043.410608] kmem_cache_free+0xfb/0x610 [ 2043.410966] rcu_core+0x7e2/0x2080 [ 2043.411296] __do_softirq+0x1c8/0x8d0 [ 2043.411654] [ 2043.411811] Last potentially related work creation: [ 2043.412247] kasan_save_stack+0x1e/0x40 [ 2043.412605] __kasan_record_aux_stack+0x97/0xb0 [ 2043.413041] call_rcu+0x6a/0xa30 [ 2043.413361] kmem_cache_free+0xc1/0x610 [ 2043.413725] rcu_core+0x7e2/0x2080 [ 2043.414048] __do_softirq+0x1c8/0x8d0 [ 2043.414400] [ 2043.414558] Second to last potentially related work creation: [ 2043.415075] kasan_save_stack+0x1e/0x40 [ 2043.415434] __kasan_record_aux_stack+0x97/0xb0 [ 2043.415865] call_rcu+0x6a/0xa30 [ 2043.416180] kfree+0xbb/0x5e0 [ 2043.416471] skb_release_data+0x6d8/0x810 [ 2043.416846] consume_skb+0xc2/0x160 [ 2043.417186] mac80211_hwsim_tx_frame+0x1f6/0x2a0 [ 2043.417619] mac80211_hwsim_beacon_tx+0x562/0xaa0 [ 2043.418056] __iterate_interfaces+0x2d3/0x560 [ 2043.418468] ieee80211_iterate_active_interfaces_atomic+0x70/0x180 [ 2043.419031] mac80211_hwsim_beacon+0x101/0x200 [ 2043.419442] __hrtimer_run_queues+0x5de/0xbd0 [ 2043.419850] hrtimer_run_softirq+0x172/0x340 [ 2043.420249] __do_softirq+0x1c8/0x8d0 [ 2043.420603] [ 2043.420762] The buggy address belongs to the object at ffff88800ed866c0 [ 2043.420762] which belongs to the cache kmemleak_object of size 368 [ 2043.421876] The buggy address is located 24 bytes inside of [ 2043.421876] 368-byte region [ffff88800ed866c0, ffff88800ed86830) [ 2043.422887] [ 2043.423040] The buggy address belongs to the physical page: [ 2043.423528] page:000000009a6e1dfa refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xed86 [ 2043.424336] head:000000009a6e1dfa order:1 compound_mapcount:0 compound_pincount:0 [ 2043.425000] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 2043.425537] raw: 0100000000010200 0000000000000000 dead000000000001 ffff888007c4f780 [ 2043.426226] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 [ 2043.426910] page dumped because: kasan: bad access detected [ 2043.427416] [ 2043.427572] Memory state around the buggy address: [ 2043.428007] ffff88800ed86580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2043.428651] ffff88800ed86600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2043.429316] >ffff88800ed86680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2043.429949] ^ [ 2043.430494] ffff88800ed86700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2043.431133] ffff88800ed86780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2043.431777] ================================================================== [ 2043.432400] Disabling lock debugging due to kernel taint VM DIAGNOSIS: 17:21:57 Registers: info registers vcpu 0 RAX=0000000000000034 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82437bb1 RDI=ffffffff876276e0 RBP=ffffffff876276a0 RSP=ffff88801867f268 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000034 R11=0000000000000001 R12=0000000000000034 R13=ffffffff876276a0 R14=0000000000000010 R15=ffffffff82437ba0 RIP=ffffffff82437c09 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555556110400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fd406b99344 CR3=000000000da6e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 0000000affffffff 000055cf2d582bd0 YMM02=0000000000000000 0000000000000000 ffffff0f0e0d0c0b 0a09080706050403 YMM03=0000000000000000 0000000000000000 696e656420737365 636341002f737973 YMM04=0000000000000000 0000000000000000 323d44455a494c41 4954494e495f4345 YMM05=0000000000000000 0000000000000000 3d5145534b534944 006b7369643d4550 YMM06=0000000000000000 0000000000000000 3d454d414e564544 00303d444955555f YMM07=0000000000000000 0000000000000000 5953425553003670 6f6f6c2f6b636f6c YMM08=0000000000000000 0000000000000000 49006d756e203c20 69000a313a56000a YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000002000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=0000000000000008 RBX=000000000000001d RCX=b702a2c80fb82085 RDX=d863ee332e9ce066 RSI=0000000000000001 RDI=00007ffe62b27e00 RBP=00007ffe62b27e00 RSP=00007ffe62b27de0 R8 =000055cf2d5683c0 R9 =00007ffe62b27e08 R10=000055cf2d5696b0 R11=000055cf2d5684a8 R12=000055cf2b84d888 R13=0000000000000008 R14=00007ffe62b27e00 R15=0000000000000001 RIP=000055cf2b7ce00d RFL=00000203 [------C] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA] SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fd4074d58c0 00000000 00000000 GS =0000 0000000000000000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055cf2d5681c8 CR3=000000000e93c000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000006 000055cf2d5682e0 YMM01=0000000000000000 0000000000000000 000055cf2d5910c0 000055cf2d5910a0 YMM02=0000000000000000 0000000000000000 0000000000000000 0000000900000001 YMM03=0000000000000000 0000000000000000 0000000200000008 000055cf2d591100 YMM04=0000000000000000 0000000000000000 000055cf2d5911b0 000055cf2d591190 YMM05=0000000000000000 0000000000000000 00000006ffffffff 000055cf2d568360 YMM06=0000000000000000 0000000000000000 0000000000000000 0000000400000005 YMM07=0000000000000000 0000000000000000 000055cf2d591140 000055cf2d591120 YMM08=0000000000000000 0000000000000000 ff010100ff000100 0000000000000006 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000002000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000