1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 58) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3124.970301] loop4: detected capacity change from 0 to 40 15:22:09 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) 15:22:09 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f00000000c0)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) io_pgetevents(0x0, 0x5, 0x3, &(0x7f0000000300)=[{}, {}, {}], 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={[0x80000000]}, 0x8}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) pwrite64(r2, &(0x7f00000003c0)="127ec1b21fbb64be26c890adc2ed6e9002e61d70109228f6f2bb5b807d5ee6f943ba47e1b123974aad99f2b02e2ce102af3f802fd704860c9246130bc683cec2a415d9b08da9ac57f7990d62d3eab392f9b31e7437902048ef88843aaf72af7a9a6e406887c1b9042f5c5551de0feeab19308110ac57c3b60fbb3d7c1037e25f7ed3e690f0f03bb30c82c2009dff13b64f272f82799d5e9ad3457f114f4a5a59b70ab912ebe2f0f98b0ca5c22dcf2465b6ca8be8df4f71f81e47204c0fbd69b588c3d00c53ab15b897", 0xc9, 0x1f) clock_getres(0x2, &(0x7f0000000240)) sendfile(r1, r0, 0x0, 0xfffffdef) 15:22:09 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:09 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3124.996871] loop7: detected capacity change from 0 to 40 [ 3125.056122] loop3: detected capacity change from 0 to 40 [ 3125.073314] FAT-fs (loop1): bogus number of reserved sectors [ 3125.074391] FAT-fs (loop1): Can't find a valid FAT filesystem 15:22:09 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) 15:22:09 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 58) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:09 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3125.199918] syz-executor.7: attempt to access beyond end of device [ 3125.199918] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3125.201765] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3125.214244] syz-executor.3: attempt to access beyond end of device [ 3125.214244] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3125.215163] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3125.406796] loop4: detected capacity change from 0 to 40 [ 3125.549773] syz-executor.4: attempt to access beyond end of device [ 3125.549773] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3125.550822] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3125.903754] FAT-fs (loop1): bogus number of reserved sectors [ 3125.904621] FAT-fs (loop1): Can't find a valid FAT filesystem 15:22:24 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57) 15:22:24 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:24 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 59) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:24 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3140.247717] loop3: detected capacity change from 0 to 40 15:22:24 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) 15:22:24 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 59) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x8f183bd76cc029, 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:22:24 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') acct(&(0x7f0000000180)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101242, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{}, {0x2, 0x1}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file0\x00', 0x1011c2, 0xa8) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r2, 0x2, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2, 0x0, 0x0, r2}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001e000102"], 0x28}}, 0x0) recvmmsg(r4, &(0x7f0000003980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x9b, 0x6}, 0x8080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3140.286643] loop7: detected capacity change from 0 to 40 [ 3140.310442] loop4: detected capacity change from 0 to 40 [ 3140.313228] FAT-fs (loop1): bogus number of reserved sectors [ 3140.313720] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3140.336306] syz-executor.3: attempt to access beyond end of device [ 3140.336306] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3140.337306] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3140.351734] blktrace: Concurrent blktraces are not allowed on sg0 15:22:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58) 15:22:25 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:25 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 60) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3140.479850] syz-executor.4: attempt to access beyond end of device [ 3140.479850] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3140.480748] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:22:25 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) [ 3140.577136] loop7: detected capacity change from 0 to 40 15:22:25 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 60) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3140.647530] loop3: detected capacity change from 0 to 40 15:22:25 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:22:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x250142, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = dup(0xffffffffffffffff) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x20}, 0x1c) r6 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmmsg$inet6(r5, &(0x7f0000000a40)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @private1}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r7}}}], 0x28}}], 0x1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000006d00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000006cc0)={&(0x7f0000006ac0)={0x1f0, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x37dda32f06bc409a}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xbfcfa33e293e6965}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x24000010}, 0x20000880) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r0, 0x0, 0xfffffdef) [ 3140.804155] syz-executor.3: attempt to access beyond end of device [ 3140.804155] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3140.806144] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3140.822077] syz-executor.7: attempt to access beyond end of device [ 3140.822077] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3140.823890] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3140.828781] loop4: detected capacity change from 0 to 40 15:22:25 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) 15:22:25 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 61) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:25 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59) [ 3141.102581] syz-executor.4: attempt to access beyond end of device [ 3141.102581] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3141.104732] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3141.127737] loop3: detected capacity change from 0 to 40 15:22:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getuid() fsetxattr$system_posix_acl(r4, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r5}, {0x2, 0x1, r6}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r4, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r3, {0x5}}, '\x00'}) accept4$unix(r4, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r4, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file1\x00'}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r7, r0, 0x0, 0xfffffdef) 15:22:25 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3141.217087] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:22:25 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3141.280479] loop7: detected capacity change from 0 to 40 [ 3141.340927] syz-executor.3: attempt to access beyond end of device [ 3141.340927] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3141.342583] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3141.497041] syz-executor.7: attempt to access beyond end of device [ 3141.497041] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3141.499134] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:22:40 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 61) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:40 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) 15:22:40 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:22:40 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 62) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:40 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60) 15:22:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0xff05, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100b3, 0x4}, 0x10000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) [ 3156.181981] loop3: detected capacity change from 0 to 40 15:22:40 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readahead(r1, 0x1, 0x5) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x121100, 0x0) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) socketpair(0x29, 0x1, 0x200, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000000300)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3156.220888] loop4: detected capacity change from 0 to 40 [ 3156.258690] syz-executor.3: attempt to access beyond end of device [ 3156.258690] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3156.259715] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3156.268234] loop7: detected capacity change from 0 to 40 [ 3156.288222] FAT-fs (loop1): bogus number of reserved sectors [ 3156.289049] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3156.350161] syz-executor.4: attempt to access beyond end of device [ 3156.350161] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3156.352115] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:22:41 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 63) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3156.378837] syz-executor.7: attempt to access beyond end of device [ 3156.378837] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3156.380167] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:22:41 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c00"/226], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:22:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) [ 3156.486507] loop3: detected capacity change from 0 to 40 15:22:41 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 61) 15:22:41 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 62) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:41 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3156.666074] syz-executor.3: attempt to access beyond end of device [ 3156.666074] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3156.667083] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3156.672824] loop7: detected capacity change from 0 to 40 [ 3156.677078] loop4: detected capacity change from 0 to 40 [ 3156.823158] syz-executor.4: attempt to access beyond end of device [ 3156.823158] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 15:22:41 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c00"/226], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:22:41 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 64) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3156.824958] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3156.854169] syz-executor.7: attempt to access beyond end of device [ 3156.854169] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3156.855150] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:22:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) 15:22:41 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 62) 15:22:41 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:41 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 63) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3157.000713] loop7: detected capacity change from 0 to 40 [ 3157.013831] loop3: detected capacity change from 0 to 40 [ 3157.137852] loop4: detected capacity change from 0 to 40 [ 3157.140278] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3157.236538] syz-executor.7: attempt to access beyond end of device [ 3157.236538] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3157.238724] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3157.259979] syz-executor.4: attempt to access beyond end of device [ 3157.259979] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3157.261041] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3157.265560] syz-executor.3: attempt to access beyond end of device [ 3157.265560] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3157.266416] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:22:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) 15:22:54 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = dup(r4) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x20}, 0x1c) r6 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmmsg$inet6(r5, &(0x7f0000000a40)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @private1}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r7}}}], 0x28}}], 0x1, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000000)={@broadcast, @empty, r7}, 0xc) sendfile(r3, r0, 0x0, 0xfffffdef) 15:22:54 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(r0, &(0x7f0000000080)='./file0\x00', 0x40840, 0x109) mount$9p_fd(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180), 0xa1d804, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_none}, {@noextend}], [{@context={'context', 0x3d, 'sysadm_u'}}]}}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) sendfile(r3, r2, 0x0, 0xfffffdef) 15:22:54 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 65) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 64) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 63) 15:22:54 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c00"/226], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3169.447002] loop3: detected capacity change from 0 to 40 [ 3169.453470] loop4: detected capacity change from 0 to 40 [ 3169.470015] loop7: detected capacity change from 0 to 40 [ 3169.492135] FAT-fs (loop1): bogus number of reserved sectors [ 3169.493100] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3169.507304] syz-executor.3: attempt to access beyond end of device [ 3169.507304] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.508432] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3169.512627] syz-executor.4: attempt to access beyond end of device [ 3169.512627] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.513695] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3169.577042] syz-executor.7: attempt to access beyond end of device [ 3169.577042] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.578068] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:22:54 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 66) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 65) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aef"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3169.643809] loop3: detected capacity change from 0 to 40 [ 3169.649438] loop4: detected capacity change from 0 to 40 15:22:54 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 64) [ 3169.703998] syz-executor.3: attempt to access beyond end of device [ 3169.703998] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.704827] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3169.707326] syz-executor.4: attempt to access beyond end of device [ 3169.707326] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.708213] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:22:54 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c001700"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:22:54 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 66) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 67) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:22:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) [ 3169.820026] loop3: detected capacity change from 0 to 40 [ 3169.879622] syz-executor.3: attempt to access beyond end of device [ 3169.879622] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.880475] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3169.882082] loop4: detected capacity change from 0 to 40 15:22:54 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aef"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:22:54 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 68) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3169.986242] syz-executor.4: attempt to access beyond end of device [ 3169.986242] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3169.987385] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3169.998925] loop7: detected capacity change from 0 to 40 [ 3169.999236] loop3: detected capacity change from 0 to 40 [ 3170.056832] syz-executor.3: attempt to access beyond end of device [ 3170.056832] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3170.057668] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3170.225134] syz-executor.7: attempt to access beyond end of device [ 3170.225134] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3170.227323] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3170.293646] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:23:16 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aef"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:23:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r3, 0x0, 0x0) pwrite64(r3, &(0x7f0000000140)="c44db89beba8da5605ef650a09e6ac3530b8a34c210212c3786ee6a32f96044d4d3b61397d80d583fcd043b3946c0ee19cf5fbfaf24463b1fa3dfab448c71ed6244f4413dbdd8d994d07e0b06c1d03160d0dd5f347bc3bf353fb9306f8349f5ffff5aec424790db80ba115800d282859e03fe967460b7df108d0c9bea2b744a565c5f1a1bba803cfdb618da8e92fda6ea515404cb74032b2dd7a372f86bac2457fcc59f718d2ecf2b1c045638b86a8ed2492ef0722d0607fa3ebe64995801a107094d50498ab457bb01ced91e8d6f884f3410f6278fe2ec195d3f0628cb2ea4b3bae5ab4a1e3d8", 0xe7, 0x2) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r0, 0x0, 0xfffffdef) 15:23:16 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 67) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:16 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 69) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:16 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:23:16 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 65) 15:23:16 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) 15:23:16 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) openat(r1, &(0x7f0000000080)='./file0\x00', 0x44283, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3192.018012] loop7: detected capacity change from 0 to 40 [ 3192.020306] loop4: detected capacity change from 0 to 40 [ 3192.025890] loop3: detected capacity change from 0 to 40 [ 3192.101273] syz-executor.4: attempt to access beyond end of device [ 3192.101273] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3192.101928] syz-executor.3: attempt to access beyond end of device [ 3192.101928] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3192.102967] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3192.103683] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3192.114979] syz-executor.7: attempt to access beyond end of device [ 3192.114979] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3192.116616] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:23:16 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 70) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3192.165660] FAT-fs (loop1): bogus number of reserved sectors [ 3192.166706] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3192.231911] loop3: detected capacity change from 0 to 40 [ 3192.978216] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:23:33 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:33 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e8"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:23:33 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x8010, r1, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3208.908288] loop4: detected capacity change from 0 to 40 [ 3208.912549] loop3: detected capacity change from 0 to 40 15:23:33 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 66) 15:23:33 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 68) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) 15:23:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:23:33 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3208.932236] loop7: detected capacity change from 0 to 40 [ 3208.965527] FAT-fs (loop1): bogus number of reserved sectors [ 3208.965998] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3208.967978] syz-executor.4: attempt to access beyond end of device [ 3208.967978] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3208.968874] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3208.973227] syz-executor.3: attempt to access beyond end of device [ 3208.973227] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3208.974123] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:23:33 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 69) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:33 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3209.121241] syz-executor.7: attempt to access beyond end of device [ 3209.121241] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.123029] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:23:33 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3209.167544] loop4: detected capacity change from 0 to 40 r5 = syz_mount_image$msdos(&(0x7f0000000740), &(0x7f0000000780)='./file0\x00', 0x100000001, 0x8, &(0x7f0000003ac0)=[{&(0x7f00000007c0)="aac3a1479e6e223c5f6680443db601e5", 0x10, 0x1a}, {&(0x7f0000000800)="f00cc843c0a51ec95cf11631ba38060cdfc0793827ece466fad1796dd5b7b1e19cbd220f9d2a0de12b6fcf0643d3db6f4b2579aa0586040b361bd55f8b6797b4466a6e6faf7f79a96ffa433dbb6e8c52f9457645fe5028aff59055a5b5c0a846699c1028c63ce6411eef0d580194886441307237b7706f798e880c5d8bd3c5ffccc00c9a874e14fc6189c1bb3516d4855a5344ee64bf774b2ada134934152847d89e35165e93109d08516d42074ea1bd4eb5bb6a8c505414a444d4924edfeb335c3524a7f64634697ee76d5051c33e36bc9051322d234d394c9e660ccea3242d49caeaa222c1fc21905a8ba1db6a4630e85924787b712288538cecea0aefd8f36cb26ec321e1244ac8867675e6da3de479c2b164dea7bc82525a124a07415b5ae5ccf53e129aba146a15d8d89b6a913303af9907588c9d5de44c9b9a5c2513503287b2029ac289bfd2bfc49a6835e6e3de9201b49114ff01ac72c1a668fee46ae2b5b94a34ad2905bd2b461067c7d9d4637b74f640bfff5d51675cde118626401e1f457256c256bf14c43020fcce46e92a1bb013f0340fd1e33a307f38f14474bdb81232b58f2d350cf69eaca89210990cc94241ec3d5730939f8c70afcb101329b1ade31096d828cd966e56205603d177c1a017e32423281c8a4e446a997552f7e1e0d4e2eee14857d7fdcc7814f843b4bc72b16ba535c8cdc3c6d18c22528b591bbb1b38634bcd2b8138d28397f3476f87a2a67357397dfee2d195b87d25221f3b70aed0916972c04c4554e6497798ab2e31bd899cc38a166123fe32f6b7444296586a92683661ff2cea09bd98857ad177c5680380c70d8459277db15bd0d6efa6d6c159afde5bf3c3a37cde6e0bc32b5bede036181324d637981bc718a87692868b11204da12bcc216e9fb2edf5726698ca4bf85ace8ddbea23bc8893828d53988a60936add7fcb2677eceec4433eb934fe1082dd3e23c6619c536d51d979351df2087dd37f751fa0f88e05383052449be865537f1067b1daf4fa2ae655cf91835b2766f82185b1dd45835a3e1ed0a53bd0449459390b226b2031e1a15cd1e2e9d3d0457c423d1a3a05ce1f2ddfa0401585476b8d78ef12ff1486b26ecb507c932e99eda7c1b7646b332358f6b4e2b2706d9ed11dcab510275813f80b76c06295d1537e86be53e5a103ff6878279f9d670fd3dbb5f18aeeeb16f4f8958cf12c3f3ae64a27ca8f93fbce0e57ee404a99a10bb569163230b5050eabbe3ac9f08f209a007bf12c7d39af0f3486584cab252b8de39ebeab867768bccac5c53d27f9189a650e821aa04c9f858bf16e766120554d1c74926b8af28dcde0ead22f25f3727e32bdace3fc4e0d71031a46263cf4a91332c77d30d0dd7c7f0a142b794f71890d3f28aa3f242be2fbf0c871cf7feb42974b5b76c904bfe15d7e759fb2dc88b76d85d3c18f4502c017c8c4f13a689b242abf0d9cacd6dda7abb59a30410951eef896de44b54686815634dcb53f42111dab12bd11cfdd42b3b09dbcce49abc493454f8cb365228c0df3d128f04f2a7cd4473df9b44e8b17ab728f22ba0480bb5983473726821c0b26be998cecddfc79cfe6ad3e83a5c9726591868b7d115f850a4fdb46d288f27dfb59f4f435d2741ec0dd239c3f7c43df5dad412a3e9d8e427e951f4cd41fabb2627179634a400e9ebe809de5d58f9efa741d36e7c2456607f616a6cb52ed5f4e9509ac4ff5955a81e153b54ad1d0ba33e729391bc3bdb8c37fbb348069a9fdf14c1c32f7099edfe73bd40699f6371a0f4e9e84844bff231876a22ab539f5952b37ce4b43b9dd6c1087c8f06312e555a79e13841a9d6b6f868d2da8938d12cc76d635b0edca8385a43a534c15eeac67207a7b811a3284d1c66d44110ade9781bb88370bdcdb9eefe794d7d9a9c6be888dad3fd57284c231144fa58cb93cf269c61d7a92bd015a459641a1efd4af16951c20ac7008573d5a90a768d355ff3a0a34a589ea7d3f60c4d0f3a921f91188991ad60f52ff6bf5340af0145ca95b9261e4e35c16ba51dd3bf6515171d43d5e0d97c8576a0ff03c6d4ed9a5cbc5b064239ac8827525280cdf0713ab7fbdfd83a3655c41c7e618e6257b1be1cea7774e0a6a431caf91676ee3e3506359f22cef2065ad17e1f8353197f881a0e288b49784ba94da8ff2fbac1f78659217bc21c4e722f818b81e72ded0df8fb9859c470f336219a12ecb40da601999c0f425c45df048f6e049dc6719f40eb2797bf75413d8491c6b44f2e9b16f145db89f87d4e356631906acaa8fb727a75419ab9b390cc148a57604c6aced5d563e0fb3296512cf1071d214c3fe0aab338fd77f338af69c1672548925489a4f773bba26e525dd7dbde44345b8c7eb2457154235d45f3314a70da737434e957209522d0d10f8e6aa0c57727ed0bfd2989479988997575a6a345562e357edecb53c3486e44e6a79d6882b4f0ef2378891ea57eef15245f0009ebf5035fcb88d05e5593f7e0d23ba2e67188447ee2ef6b0617970af2e11d7a183d7277a2b3844d056791f86b8175391f9d7cbc2523861b4158e0c5e6aaa81127d2ba467adb4cc60b1324404576c01421b8b52bdf188f89de0d4cd405ecec14f3c6528d7537a460130e3b913722f6f2227e7a0ef90f10ccae6b6876ed97d690e8e31644a6588fbc8ae6f447dbd808eb35f5c2990a2321b73ea83e7a2403b3289a64522c0de4683afe586dcec6de0f2171791f36ebcaa1a60bcbc4dc5057ca79905f5f01f2157b6d2b82fefecfc93e7c1c2e7e219bc0580a9c2aedfe6490361acc787e930802b0469d935686d39aeec768ae1c66a3b94477c5da508dce48974ae7c1115cd4d53fb58859379e702dadf0bd7ad1150a0f2ed97f5f9b5e9d9a0849f11c42e3e99cb6aed01b3ea45ec8d1f6e6adb42366a67a592a9fc44e5371c3bed5a7b4cf0ea5e1869c7c00ec95ced4de66ebef38a8094d9487c9300eb7ba5766c86383be424606cdcee432ebf6d4def27fd5346200c84123f83d1c641c70ab329b7017793ea3d11853078cd44909d658c07a6ea83bc4459da5768f5e1c4cdb4f1cd018bf4d07d92350dab780d669e2c7b7f868ffe27f83b92625e02d34180b83b3382d6e6586d1a2ebe755bd599e9d20ab20ca29aaed87e5d27d2da8a2508542f6638eba9c5aa62d7e8d162084c5cd3721e9a9bad2e8bd638f8b1b49cf82f4b03e8df6aebb3d5e3bfb817cced01c1063293bf57cd943877536ec7c94e4636ef87187ee5549e3665f6ea2307c6e2c04a91f68443fefe6c64fe669a3c829c46f853c4ccbe9a23571de2c630e0924fb0f3c318aa8a3f2872f002c1b6b2610f4deeeca5bff4f0430d99bea1bb120e0e36d4de840a7f2a121b11ce555ef25dd144ee73ff24ce7258505568b8a3577e591a9bad0182c4c9cb4cf226143dd737ee11afe3b7ab0e983789a50b0c9b6c4c4ec60fcf7d20be7c7dc81b720adbecd6dc28ed68e0a85ee3786efa6b761b727402b1a3e022d37166d8653800e446e3355303f7613c17560822aaa12dcd6c50980ab4bcb48c8fc88edbe11e4d5ad074a2447ee579b7405a7af4b23bbcbfd49e227cea466295dc4e2696cd36a07b05dcd169a95a0c2783de78254a0b30825db4c5e22ef7b16efb97a1591fe027a5c90a51ca446d1218e0b4c32a02d53e34cf08753089bc83348a37fa2e6bd37a87cf0cc41bc45f6fd52e77d89223cb75953b9db53bef58c599b61095e230a58eb857a4ebaf93d6e6a2b24918f67c0813823fa3dfebf1b3594e425a38dafee3fe64fc888f9b9407f6294e73ae28e4b6bae7220633253cf71ea2aa368e2c10d1219e0d87e8f2c5329607b904e3ddeaa409b5399b5924cc50eabb27c96a688aad7e3d3d5d397eb6db5ae299665ca4e9ea6878b28a73d2b88fff08269a134c7c84f895c24d1465bea689b61784980b6d162bf9d3dddb4070fa65ff473e82722f459d1bc1a8dfa2352579e46bc3a694b0fbf415d7db76ba3cb30d19c91d8d51a3a832025de7dace375d5ee95aa45d4cbcf6c9f807d156ad9db68bacb38ee34f003bceefe96c00a57b8ca5629f76ebcf122a8b9153bc0e8621f6f22f2dfc0c110a76393d5f89e4ec2b7671437e0aafcc47278fb1bf1e87acf924cd6ae5b147845a7b6faebfc24025e34577260ddc7e8ff7e0aa2e458ed83f8f5820a0b38e9b2119e777709a83168013289cde979b799cc5cf72dcb11c951ec6a3b6a087e316ffeeb8fa67a8966c9d133f500e899921bbbdf3652195bcb7531a63dcdca66332a99610fea54fea7884819c47aa16bed29cf1879194010f9bdb758e24a97494026126e02107e5aaba032ed9da0d5e2ab7f16d9bbbb98d36aa904515484d56d29c0ccdb0e03af90c2e7ab29ef02470d14037f2d1759e52f5f28e8aebeaeeb2e87f3f6a0a51996daa16d593166ecc072d82958abdfaa38e0be8ebebde2182b0c60cb805b3a6916e2526b7e12e1d750da621571c3af996f2246c12e3dce46cdb2064ceac6ecd58bb11e8cb190c3cae1fa9db4a5a99af3eb634f3c9e26779015e070be9637167793a09aa9c9ffe2e4e188b20beec8e7db30d4fbf05d9d9c152ee2c7daa415388c9819dcb28f5ac4669eaa0da9307023a3a0b87825e506c8e9269c273209fbb5862a924574b5a118d2b4f548b175f50f821ac830fb47ca03ef2e1a5eae26d12269f1be901600d0b96ddae5871ec0630965aa23ece8654189501d7c892429febd8f917c6b4616ca0f7e2b3b37686f6362993c46ddfe70ab1a617be831ebcbceb6638eb675bb13514a101724af4ed559603247748eb87cff816b50b89a0b2db28d9bc4b6dae1e1165c28d46575bbcb4fac87d6ce5df636bee47e7929bf8c5ff4e3c567dccf2a37042c63e10386d20c47667d52a12be8682a4b8f03c02f8dc85288998aab7da6e5688ca197749d61e13ee03bb364990cc92912e5b4b249c2a3525ccdc3cf23beb7c4a1c405d9df8c5d1d00547e80849c54dc2172b1a3225340f77b0f9fc4bad66a3c8929b6ee7526b0049e99ef18264e6a47bb140b9ea76a4fed7c092a5c30423dc187ed58d5b41b0b2e0efd7bbb108c804c3ac1dc1c45760a400983ef00fdce1c6a4271e9bf8844f36050c6db5ce1acfc5497c9e46e65c0c96f5dc797e3df26183515cbcd6902010444e7f68478742d03f59be169574ac1acd779de8cf314c1960aa0674e0c27b0d4d96e267f2f6fef4345ab2195fe263286d9534c28a9b5f92015b12b7b8d3d3ea9675ed8f4c705b7d8f5a3078279078d82a1610d57f40e8519cf070bf1ebf98839a80cb17a493a2c54d780a7ae08302dcd1ba8072e05d0071fab0063b026c7bb8652fbbbe01a9041fc861b6f861c16ba5339e29c158d0d462d18a7036d5f67c7fcebeb5662eef158fcd1dc9f1a27ad0b5dd68c224a79b1e03e5d2cacaccdaa962337b8acee265c9defc9e6b6d020b0583033aaa717486dafe754a2c96be9b585f62df3aa3c5736d2d4e543790e10f19230a8e67b6920c1975e05274ccf2d1fdbc5d8f1788fd8ef16e01c1443d62c0738e236aed9b5149e750dcd6376c6e0760b24b64d140269eb8a031f5abdd3d72051af9268ff92ea7576a942c3c66ccd6685a5e9728f92f69826943a872d13ad7908fd6fdadd8f7a7219091305ca2c31b7dce6e2d3b871d6bc7b84ab3a57b49bf7173ab733c168552b2b42b100550d23b40b6d69a38ed57c0c06b5f419799d7fa327b07a185398bf34c75628e9fc731cfe2301b9b7454d4175656078a7bad38ced202a85857", 0x1000}, {&(0x7f0000001800)="3a7998e4a4e024f96d3867b094132e15ee6805df880057c7c01e50452819dfc80afad0d75409829279bd4b27c08c7647c8e3d067d612d936ef73d910f5e1efa678", 0x41, 0xc65}, {&(0x7f0000001880)="bef092922eb66976fb941d21bd4c01b1ce868097d299a470266e1241a94c5a11eb1389f4f931c66705b2e3a2c24f037f7e45591447d6c2c23b1f059444c748771cb411ca834c29e3ff503a11a63621ca05bba06548615be7d4de5665f4603a7861e94f47f21770364b450c160ab9698427635128853ec4cdbe0a8eda2f0d8446e60edd2965333663ae4c0a5cc288b652c2c771f8506caae5c8f0f431d1a9e671dbd09207c757a9a70c462b70f394bd69f3467749996cd1516c837370fbf4c1ceabe4231216c43d566a9f255204566ea961619a4f30826a216a0e43bf5870c53e18a6df11418a76a004767dcbdb634e1f1db131c34b3d45629f268b7807260402a72ebfd2922049e957822f19d4f356f9d990bb5c5e0860cbaa761fec042216dfae6df2ed99dd9e2774601983b52f26588736401fb2958925c9e5ed866835bd30cdd37ceaf556efe6cdca86bc2651e1bd576f28ddbd544ae6408f68c30e352890ccc700ddc709d5e90a3ecbf1b73e488a553721bcb6f9772281af164c3ca8720ab61d0f2f66f843dfc6e4998709d764efdb134b44f63b9c90c24674048c2c0a20966a3a423327fd3abbc59dcd2979ca77020c2d34cbe3d577153a81b38e5e5c76b4a7ecf39359dd44fde0c08af54ea675f9bbe974e45205f32c04d712aac417da08a3f834272ab4e6290c947d4a4cbd3ba0a746a643106ca6bc9fead19ff3b9a426a72cdefc190f480bf77eec971085711b3e64000d0cb92e8e38a628870c5b078dedbed04bc70e3f53aacee7ac22725b08c84dbbf793ad767c7ee2abfd737b4e1914ac87e89666f1fbdbbe2375db0ecd26afc3226229d00953c1f6dff41c459faee901569326cb467a5eb0251010e6f7174c5ed2766b7afb571d80753e114f339ede2c1aed7c607dd56452d89c4028f0500f31560528ba7ffecb78de4e514e81a3ecddce91201f9ce1fd571b3aaef610dc36cf83a48f0fd218122a922d63f12b6052531f4b3c1921bc22508c6df8e384d905d0723258269c4e8bbbef987a958d84d7e54fa71bb6b44037619a9a6017d9a17a9c49a1d10f7dd61d3d662630bd980b32af0efeecb879ede810de665c5cadea9ef1c64acd6b7ccb7f677ae058df30553e517bc54a6323cdb38bab7ff6b6bc69283def53b6e9784e9769265772618b02e8da8f456d34b1ecf949be0e4b9298004ad7f7c52ef805188754c64a7adeb5fce5815543ac13288c82dbcbd24b151e2f6946605ff4f275bd994ab44726f095640939f7af1593ef5c70a136a4656ad769defddeaf77a12a62c2ebba0d5970f6c3ccf926acf50e874985879e30300fa5f0ccc99a23db065f2b49c16650623ec3d7dc14978d7a781a11e403e2d075ed4663820f0a19c35e9ad1d26f8d35df0299a1e835366a7537ec81e812c4c6fc6970a0cf1bdc8b44ab78fab43bedc6a581ad44dbbdcf719e0bcb4374ea67dff1a7c0a538677bf1d464cdb36f9b9f3dc3d21154d792841f2711685d8b095dc887cdd8ec3fb236cdca3e9027a4c6356f96d0be5f615c641a089c1284e214b37315ad0133498e1da0b214f051d7cbe8b1c8f0b93f2c28d411d57604fd9674ebd6cfebf9f461e58e62fcdaa26033ab63d82e53a30cee3a91286d3345208b80f7d7ba82f85db2c4318b5c8c0f6d3f1c9fa920b383eb1666e67415699d0520e660951c2796a586ef5c507cff624940647cbb76cfbd8ff2225dc1ef2180bedc6ed176375a550f35ae8b020776d037915942f320a98c248f9cfc867a4034ff23ab0bcd5dd053a9d23e3a5f25f436b8f9c76116157e0d5c7d9eacfcaae08d7651d0769bbdb55de4145f625e807024dd6e0718cad11d0813f957b3b70af520f003fc09972047ac172449c4dd46c35ff4187ba1d85d1451afd28e5a51837e7ec7893e619687707139fbabfd362a857330c2483be430adb934e2578d0a582b02d861b532450e75da5830f373a17d51418365105443b600413745dcaad9c51fa855ecde2a598eeabccb49de8e4811e681dd89b2d869384585e037410a9ebf0d7809b7fd2aeb3cb8b3cec30e2c146d1b81245ae630db73d2237b26dc330964a58ce4250b37c7d095ff27d6538251b364de1a0891b5f867cdbe5e482c5da196f7d241d9c7fea75ef7136b226e4c7328a4a3f6eadeb8653e54931fa3f9eb306ead3ebb4098f79125ba6fd92518c188020a0cd638b821d9d9808d39f8abecdcd79a8108e150d78db817818b2203717716a5c7f35f9131e89ab9e9944c5bb43a1432444806dd429e42ceb521cbae199efdfc7933037605061735b54df6cb1c9c41f5c9e71b2a282d8cf152f19b5e49626e26de727400f2f5181fc9b2eab5139bb3e5aecd8dc3d9dc118eed80ea7caa751755474d1b214ec1294d4a1e28aef896e4246b64f23d25ee163a79ce6f55e2bcb3af5e50d59faef3dbf6f8e0f7971f018a7118189946bd00c76dc78461b53f2fe30605bf9088e4651a74a1ee62687bf084f9846a9bff68707a602a712379b7ba2da565115d78711e5ae2e329d109e362ddc5aac3dd4b73d58cd5f91a0fff4a6830d0f67e20bd546e61e34a61fc82d9b0a983c8e8450a2f59332f8fc2e884aef453a7d213612343f837443c10281f89ebb74aa5ea9e6b5f8eb9ed62bcd387bada2f4beb3e0f68f3571d4f2a33bf77abc47e8a73ca047a12c2bc7419c9ac582a9c0c65d337ee33f4f94b95044b494f1653588e16e26e7d98133dc436eefbaf92595f13d9c7482f9b37f1633ebf0f44cd2ef3951dd08b7db7d5329a8646c925e4221c57542eac2e21559bcf6e5c26fd5f3ae7b687c00608e5bd68b64e28d36a389d53ccf57d29ee89730009a40d610b8e054f8b5bf19dbbe17350d73febccf0b08cd606d60e1c7468a1b6ff4162b32d1877c8a6af1c0f8863add70eb0a637fe1e507d5eea04aa0e27e7a8af5120f74208ae0dbcb51c8a58842403600a20b47fd48c15889ed079fb029626f28ed8ef462544eb25e8abda5fcaa2ef4aaf5f7f7493b28f5a418fc857d09de34d0d06b6beb728876d062cd707f919128c29504b80ffaece8a61ab832553ec4349ae1275993501378e6eb487c6c1ad11cc20264fbac62cf91f8176739f6632cc27598249b0e9a78ca45be0a48acddd05a6840a6e28e2ca2b6cc921479183ce0ae7e87d12e5c12618e53f6f58d45bae47eec10aba6f5fcd60c628fbc1f9fefddc326839dde706eb820199824102ca9b02ee898e890b80a65b96d87713eb7c0ac09bf56899c58795b0426ac94b41627fdc2fceb1b795eacc2627f684bbbd7b3ea3cfeea73d57ffa9c29676834a680eef546f34b2d63671ecb4137b45a46ebd9f99a44f6c89306f58869af33ad0e26b7cf65063b152a70152ea503746244b7e2584d274816962d770783a1e1edb3c2c5d72dc671c060026e8f87eeb27e92c755bfc5cee26d32531a9319673a6b5b27f861bd20c9797238d88a909a1d0d7cbbef8f14edd4845d9a57e779f0a1fe2d32e1f1f2fe32c09038a19f277e36a4898e1eb2d30d9438119ec60559f37cd9c5953404324b095d63d82ce8ceb1c2ea24dcea6434b3a0a59d0c3b75b77a89679590c3bc2132064e8704065ff5cc9e1b1dc3abbfe41ad98d3563a743c786764f4cac1aea547e2be8e7ee7a3ed057017f76d97fe4f4a8bf4ae16d0d183ade8fc8da17ae4f4f1f7c21276f45275b7149f71d4dc0ff8f97c95be653cc1781005190085e20e76d9901c5d39bc465f5ca80fae3884217c38b317df6b1ec9f89a6c46cf87f955333478ab7f87b355ce633ec92c0223d50dc3fd5f5e0eaf33a5ad9a757f6e5178bb077da2a5a7b24632d067eca1b848a579a9abfbddbc6878ae92b57c2fa26dad43a1ae5cbdd98b35d9b82ed377b370116c2d369aeac12c1287f8a3bb7142b1f377568125c481c7bbebb64abaf3ef469689f237262e0b3eb95dfa9fa4f464fadf73637289c51ffdbdd7ddee1c36df8bd9631b956a14d217cc0a5a3d6e6c7fb94062824b1bc1b52166e1059aaef67899cb958ec5f4a450a4ff892c74c9ec531bdeec105446640ee33098aba9a9f68b9f57165d2ad5a9186277540f3a55a23c6fdefd828805a13f0b9758518818047d90a3a96c412ae1e4ce6d89c926f45110b860514ae96aacc93844f0ef1f28044bc69c2422dcb6037f3075eb45e789313bf178444176d396d0fb644621f33fe43d0dea1d0b7406d2150038e1250a37cf0d353ff6dc5bfea2df0f53c9e5d8d9c8aec8f280b72317be9449046ff7d70a0fa411e3edd4493c9a11aa2590721f8ce7e69dae50667d544bf52bf9515e5d006d727661699589ce49bb94e8c3feca776fb25cec2d50acb8636b9d745ce1fdd0ef64feab0947479f6e9fec0944edc486074e6ae7703cc6cd35ae16770519d2360849b8ddf046239b31261e30eba65a1717bafa5e2a271bae1728c63fa84042220203c7616a37c11345ea7e61d41ef1eb31dcf86e20ab1b5b5cdcb34710bfb67de3c62b36ea8b2acfa8c987bb73f9e11d61e90e07aadc3f97807c9bbbf2d9ecacc97f2fbb8e1ce5ee2cf7d1a62d00e4595d0d4aea71c0d73438d29174754b3af3c4c64b84c3ad27d1408f5c5f958935b870532fb177a9f43b69c1a807ee352ca861c103fc26f962a29f71ea1767aec0030d33791ea7eb33a84a4a454fd32be89ffa385e59b5ce0923fcfd3c5ec9b94bffb8b617ef0b1591678ab234437a787bfa1adc609f8edbad6991eea1762c8bb4748460756bd83fe132619ab17302e8a836c8b842e23ef1628b4efc69012e4fd4c6264ee042cf276d51a770e07b2b8a4a4f7b119a6dc29cb1e1ce14e59d1c965d78018edc2a7d00a2d6e55db688bb118c5d6aeb1d5af16bc7dc107e42954daa6eacf67d92c1c4af80ce1f4cc811e8e7c3ce707cc8fb18ff23a3a664ad33669c82e23769d64619b9f18f078e6f26b567558795cdec486cfac679734369eac5fd643f705569f5f104d708b50efde529bb7d87c928b380fc6013a004a20599f60d5e30f3275e271e03af6522d0e7d65c4e37f23effacbd601dbec97946ae8c70c66acddc08227c6429d5db38fc351d83d4f01a0deef60ecc671334469906fd29535143a8e2cee156b1f36cfedaf3106e0495c4189544633f227b7b430bbf42e62275901c66669248bb45ad807af6bb608c5041389cb04ad859f5b70d3b58a37af502b902d8fec8be6e54144d6b88417f1a674ddc003ae671c59f1075d166fb757f9793abd5d38d96b838fc8b26f547af20e176f6ae5a8208e74bb1f53e7db4b743feda886adaf22334ae3acb6ca45574a9be85e5feca407edacc377985ef4344a65287648d3c0cf387552355278b79a97c7b47059c8b54811bd47fd13dca70df0ad8de70d8305e5c3bf8941da05df872e3ba28af23e3ec4304f2dc5df37615d641a895ff89e91e7e3852f69b0bba23d7aaba2f94278de5298cfb166b945bcba7b98c616d3c9f6eb7c0a27df5efa1f43355fbb205acdef5dab95492dee8f15abf2f08a2f891b4eb4e73cac6c6895a926ecec170c87bc01c6151de41aabdd8bf75ab8b09f8508cbc5f69c18069417fd31bf6f01d9663778da36bd7e603eee2b5cd348eecad526c132552f701ab274568e31eb6604cedb7117ff94387f9f528249783e607c5d7f12aaa7539f222d5baa83e02927aec23d89c8fd5167c4eb10ac0ecd121c013c229474020b0b294300daa55d004bd7381e82d78bb6466a198bcd824172871c4975e500401eaf4cc9a4fb258a2d9495b38d4495d7fdf9ef9cbd4c494f5c5f1918569fca53593", 0x1000, 0x297c}, {&(0x7f0000002880)="d1551845b1c53a04f580213cea2b85fe1d7eea0094b125697985862540568921bc9bcecb61a71ffb8998029285efda63d4fdf98a1f7662c6bf4ea9f72146a1a44f14090d3c430d7415cb59d89c9d78ebf72545372d173ee0db5c9466c598f7ee5e5823729e071a703fa8276c3999006544ce3e97d8d6c0f6ff50b962f8a781f1b6ab35a1ce3b0c6b6a2b8b58aed2c7b28000cdc4a6c402efb188b0e8c51ea47521c983a02c462e7b78359e41bb9452ebeb960be4e963e8d7f389db531efec14ea89a0de0312684fb2b832aec64af92460f7fe5b1b8ef8c97e06cf8058d1f201f1a67374fb3df32494e06f557", 0xec, 0x8}, {&(0x7f0000002980)="0cbaab0b9d20496d537aabf05cc6e7d7726d0d7f5a105dd2cfb32dcb9ff9c5dd6e6807edc57e9efc9c83efc710539e9abe8066eeefda58905e03b02eba7f19d7c7607e477cf4fb7bbcba3412be501801eb677d6ad9db9590518c21d08bc2cd4c5c04d84fc798ed75130830c406d021b1404d99ab9aab831521c733d4975c", 0x7e, 0x2bc5}, {&(0x7f0000002a00)="1f3f45de5b1f889329b6bfb251be7fc105f13935dd051f006794c467fed8f94cc8774e88cee252ab065181daaf26333bf1be6f3032813344219687ad4e942b8e5f52f8ca788f02e3caed52ca8cc0bd6a3fcc512d61cded04e1dc4ec9640fa2e14db09d4a578e782939b1e5b5bb77efde0c53f61149c4dd7042d6b4edf28d0888d169858cd3bbcc9488085c155e0d1a8f138e6d1aa407088824023d8d05652ed68d27afb4cd728141d409a0a99ea2b6250e4887266057a084b24d003ea233fb69a75fe90204dd98b76659491c4088f040ae4bba7cbbf54d95e6d14a840558c1598ff00da2e1db12fe213edc4448b929603e8d2fe285bb2246f27203251f32a85577515490332be27a6d0f8f805467048312f9a219dc54aaa80a8c7c7e01fbb6a108a795884ae7125b437409d93257b196e9416246ad14197fc345325d37438df9d4e9acce8956f3d14c3b06c656750165285fb83c98b726dbb98ae3511b4623b611c1be08d9966ebc40ee47b8f4ef6750b315631e4b25531eed3ba1963d6b60b5fdb0c918dbcd6509b670512d2290cfc41d23547023de9fb6f870df509e3961398dd5dc15b5b1e739afa8fe691130529286206dbe33b323393161a1801596a743452e67a18d98a75464e5974e45978a78cb5b9515fa82e9536271f66a65aedb6bec9fa780649267bba2652c5ae1d72775875b900768be497b060e045be24556ad4f069e82801f79a2ace161de7eaf90ab06a60cd3a90af342f9b58b837ccf23bfb825b8f231de40112574655714914c42c2d932585696431733923ca1c6a86ab9c7ae4833675f5567196edfdee04c64542ca98009e4a21ce36543f76b39539820a46d3d135c214a5091793d35109b0828a74bf79c0df896d65105554591ee3b30c8029d32009dd05a706f1650bd71a751736ce1fb990e1286a03e1da0c24e1f2e1715edccff26c169a34b3a6c105ca3a106df023de3a2b5c915fd726278b311a043246ac54cacdc5dea16165df80575b4973b40b1666a09e92a19d289dc4e205be150e868d0c717715bbf865477803deff959b94b876c1b8cbde0f331c010aeb49c370f5e79e9ff1d84a6b8a2fd986a65f5d72cffda21a42cefac1f04117918380befa910b042c2599b43d1cc0c6c10d20b72a173e87f7326e36ff86ab0d6ebdc33d07b14336995655510d7845bf008a947f690cdee89a547d91c94fe1088a1dba6803ab334c61d89f2f5c44bd23dd7ab1a47871a6806c954dd0ef73e30c63c11d03dd341832054da4b5adf889d428425712a494a461a1d949fa2cc4d934a6a7c3a203a6a518de05ec1a7047316c3b3478dcf51868426017bf4879d56b33312b562c4e7dcd4525ff6b75db66652e003c5b5a642b5eaa0caca988bad53c858bb726560541b7ecb74bf597b46f51aab123d7e36c10b466f7d10e23b0f258ed9bacbc4d56f6efc6fa5ca35bb49046212a334d50af643129c22317f2627ce38a5dcb0935d78b9978275081186fb649c9bf1e494a004a3939a9624ca92ad367ae7d7fc71b2f20505503b168c0fc9da42d74b7338c3d7e4d27de49b73596bbacab29d58afe57911ed682c52283bfb12aea034a781b254e4be2709163e7e79401af6fd8fd0d23ab8f8a918eec942660bcf7d09ffea03952ad8c637876d87fca63007fc4cd3b95db0aa9c8136027e80ad99f79f9725bb291f0c6e7146a2b8133dc7aee358b5cbe3aea7cf7792f432bcadf1bb5bba005960f5d56a29b0fc0da347558d10ccc752d84353bbfa3a39afdc6bc470aa2fdf465bed2a905115fe771c084439d92a536c03c03108d9205b1da82082317ac0aac6125311b238bbc8a71ec2b773b2e6583fcf43efeffa0d4795831fd4ad5a74ebd40edf24a16ca021e410d8b2bcf7d3347d08d56aab0cf1e451e725b7b7d7d0562afe7a7121dcf8f6804189eaf08ce8aa482250cdd29b69422cfc69533417922fdbe5533291951cff473f0c8bc7d93f972bc205278081a559104a85ad2bc80801714523386cd0fb5dc1ad16e2ba5a3dcf6617c9936d2b8d98440c589639b0434263874c3a50e35b53967d90353bd345185f6e5ee62af7633b6604e57b9e5afea03ce54cb4712454a1eb70ec742ecc2cf7d49be4162945740bdb96408ad9b282f6119d1f5e704f99dc06fd6fb62fece54f19b0ad7a0aef12bc02eb32ccf78167faa4f287e73283cea8f8735b5395e7dd8591a3e6a571a9f0197f0e70a2bb38678d9bf5bae3bab99299f5e94c779020bfd440ef8caa9961c61c68da2a83c5fa7609f5884f44e8bbee2df47775fe71829ba6c599fbe917eb11b44084a39c8e2561f2a08c34edf0031a8f69fb350f2fe4abefa8957dd6a89aa6a3fbabdba87cab6edf9cce569fbda54b370747c56d852739bbf4764b7373825d0b279cefee2d2d9200a64ae94677099fe704fed60a33915f29bc7574b566a20c964ea92c316ae355f76c442c86ef4036e2b5a71fdc792d2ad0daf5def5cc5fed9608f7406a7e2db72f8cfe73aa4eb1b2fc0882c6488625863c54c147bbe0a652185db3976755c612a07939bd1ceb5091cbcf40b3e1af503632dd539a565ec5770064a66416af4fe736e6877851cf21a5febcc763feb38700b966df4875ddf5f2427560aebd22bfff06302e191dfbae5f3d38711e645def4de20cb6b9581e09160bd514f9a779312d62b919abae22d3b4b9d3023c174e747ea1c2e37b23e7fd4baf1388d0e269a3d07ffe87ba1e4249bb8bb3d35e97a04fe0ebe8713901abaf8a9d1f2dfe7d44557e64b96ee86c4f6c79dd4db187df7b16d8db23f718bbe1e04bcce36e510b22c6c03b0f0fa8064a83a153d65b34f30aa97b80ba726bad07949a462d3b544aa4812f9b16fe2d4ac6c8bdaf431ed9fbc4bcfc1d465591e0d6db4af7086018fff8ca68eac3a1fc979f3bfae996ede9d23b9adf720fd71fe8134f8cf8d0b5bc513badf0731829070b7ab2676370511b93e3db46bcd2ca9da296432d8194fd513db1357e1156853db8c577d2f83fe416dda9070e19b6dea9240c0e6b62296a3d16e5c5eaf2d4939eecdbecb10f7e31688f8f56b6bf059fbe1c5813ec33c744a4f850b60219977cc636dc7a9640985f0060032978116f8b31537f08652466dd5723911659d57338b621bc9adc7e15952c6f00e0fc43feb558ff586121b962f14d1505dc09796757e408befb70b4c7187d81f0ceb668d18ce651a0f1269cffb104b19f7989174f1012285253cca18df2a9d972de3c23126271a1cd23d3e54b330c072956bca2682f9c08e976c34ef6df6b4c9158f4245f38566339abd24992c21e53b690924cb63b5e0f284a32419fef91357f657ecb68f61fd46b68496f5bb0bb9ac09a0ad2ba4575eb54493f35035b45d8633771d3d39e411d5f178f2facd64c6ca4bca7885274fa94749eda3ba2dc4ced661cf7c7456feafcb253ed15b5e34717de778d9c467ef18e3efd11a9fa2a425780507068f9dff1a42bcfbc0ba1471c221f022fa83f89a82d02de469e968442b513dff8658c2d90d52ad3a5b2930f3da5a12d42b55ca9637ad20c1af4bb9e089c89837ecb5ce27acc0609ab833d97fbe725c14db5f08baa289a5c7cd9705e49a4017f6472898911bdd8dcf0ebce8b6fed2ff043f692facfc10e46012196d213871e0131e09980eb7de93542a6bc48eb8e1352940434083fa0e6dbffa8a4c6b629fd31114dbe22e965a3c2905f7cf33936b6af0194c99641e59d29178d8d35ac7f56bcb850284b254bc79e4048961c5b3ea3cb223574d035e1595a00251c95a98707832eb660725c0ee40096aaf05f2e879b578f0ff14c7a65af19b65e67d1762bf324335f67e32188d16b7fa6a64c67f38dfe62c7ee3698b61bfdc8fcf0b724c62a2e1be687e8adb43c6d406f09d39b277afdd1cdf92a1a6bc1dbe224e3fb9eccfb58ec48551bc6bc8ebf40e138609758538b9d1547231857469c4a44e23ef7fe119ed3bd4021df2a310080e3b7c781dbba5a55d8ab3faace58b45b0680fafb6fce2b3442abeafa27222fff6312e4e71864277a99377e89a97959ea0abf3acadc5cc9bb65901a59df910c77ff59a87855a28749615dd04a3bb870641d5125ccac15f2d214f73a380e09710e62c09a3dd5d6135f2080c4540fc28aed36280268ec9698f0816eca336f8c2ba392e83ae85f1899cfe5f2be8185581642359a8294aeed1923f7061121e6cdf988110f236b37c5fdf7eea4dccf75d111a18201eb24ca2bffd136652f54f8ceab2c74d33c23c983d1b66e5b817d225216a8e34c55c1024371c5163ce327ccbfaff198072b127c4388f432c646aa04b99f683a0c7bb717a9c3f496f539c8442703a8eb8bff61170040461247e84fe108779e1668fa7c95bab3bfe1063b14d5a1fd67ee15bda09c9d10e091ec0f65cd343d24ba021b81719be3f2d77bb24a8fb325dc27a2ba22f09eaa7eabf13b43f43b0ee6e75da34d79d407fad2ea6f8e2318a95c33a9c113fc9c58e9650fc6fc46550b92a535d3225bd608f3f9a06b423d440431aa7e14907c3e2b9c2589ad6b194a8cd448599e64e6912ae78e07db232548e876bf29d3b84b5deeaeec8e47f7be0fe4871646bba3c1f47d4e2039c9289714115a389e5c29c7964d3446069a10ae52ced148097cc42b4db18816e0b88f6223e9c199427add5c59d381b663b748d7e6750d596a7e5605a177e75c16e8ce7c7038460f86746f45160c8ae2cd8df0e341efff99a2b0c68b451c26cdfaf49d8b4e49e7a8ea0321f6938b80b90b21a7d6b184214be9b48a9bf4895836adb2cbf38d751e5d1b9974d4fd38f83afa9409912cfd69bf669ab9338e7167bfcdd06574f4bcf19eafdf7e07d42ae0a511953de6d773afdd2ea531e127d09a944f09ee1e75556ea48a1cec878351a12a782915bc972e0ff0e448f1ed46f9902c40e38dfd26c28b2df1d1f3066dda8b445e5117db95ad06c7e4f680cd3e3003a527c656002f1e4747b1839079d5539ecfe58ed9ea210148833a0749c06087cfa3113a0a9ddaf661b983f2dcdcc41d967bd4613de879651f5b1bd629ca767cca87c8849d16d06f871c7cd5b51c0398658c38e65da08d11bb47faab3e9a44e843f0112185be8f6d64d3d6c67a495dfb8a824f7817f0a2f72c34fdac05656858a1bd9c33ee6686a31d2976fc30cd24e9bc1f7c57b68593f5af2bd8d2b11d97f1ceed73c3d83094d4e8f5bfc8b1ba74d583aea71cb16eec93d35a982b7439ba940be7e1266adee33f61c59bce41cef2086286a3b5d7235c9a0f71c00b8e876a75281ddcc2b9c8e17356b1ab07388f97c5a4816883d7c80b0da9e8d13e4bc80e67ac76b4ec752f85f1e0b088f8f21c262795126c230cab0bc1c47c1bd3df6782c84d3f3a27cc1def53abc798cb8387ebfcac59517c54542aae3eba57e7d96e07abab9d57f78686d1ef25482fd32286b9256959cebf43adfa5785cdd81f97a99a52b89f56607d72b2e84959a42473d5e8792e498a22d0d88d60b66d4f9af1c7fbe6126a3adfda3ad964906fafdb085f38e90f0574e50ad4dc93fc87a7cd02d2440b45d3074bd327bed904369f4717c72a22d39b7b64a61a20946e8ba58553f7d69ba37ea345a800b8d43bbe5dba2207c53b4d170889fd1c63058a4a7a256936574a3e0f396fa864987bf72a0a34df8bbf63b023b2e653e5c64b33bc4c643ac700fe847152cef8cb85fdab58c8504620f2ee0dbe0bf1d34da235ce0e55bada1aedc0bbe51b5a4282007a664e98085b62b823f3c56950e3634cfe43901089b8c9817c28", 0x1000, 0x9}, {&(0x7f0000003a00)="db2f8c4bee464992f00aef6ed31c33d7b7093fafa160b7bcca901f24bf72cc419f365168996cfd38219d2d2f4a9e73fa6c8461eee4d35db71c3f8495c0aaceee1939602c77b6e49161e6cc78c753a0f8c0ac46d8a57fdc0371d78912fbda4363b0795d5de9056aa9977db965ec61387921ffe1dee25baf6d12e5bd012235888467445120cfb1f3601df2f6ba354af8e509396a631f8b6067f8ea4af6ef83bf802e0147abf38d1f1469bb66eff43c5a48a6d0fdbb52", 0xb5, 0x5}], 0x2800, &(0x7f0000003b80)={[{@dots}, {@dots}, {@dots}, {@nodots}, {}, {@dots}], [{@euid_lt={'euid<', 0xee00}}, {@uid_gt}, {@fowner_gt}, {@uid_lt}, {@dont_hash}, {@permit_directio}]}) openat(r5, &(0x7f0000003c40)='.\x00', 0xa40, 0x0) [ 3209.187892] loop3: detected capacity change from 0 to 40 15:23:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) 15:23:33 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 67) 15:23:33 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e8"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3209.280760] loop7: detected capacity change from 0 to 40 [ 3209.316845] syz-executor.3: attempt to access beyond end of device [ 3209.316845] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.317810] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3209.320917] syz-executor.4: attempt to access beyond end of device [ 3209.320917] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.321916] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3209.413660] syz-executor.7: attempt to access beyond end of device [ 3209.413660] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.414664] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:23:34 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:23:34 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000b80)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e468916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f40700000000000000000000000000000000000000000000000000000000000000000000c06e9eacfd00000000000000000000000000000000000000000015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f49cf36b7483b25af4ea5c52eaf6d8e6ed27eb2dcb734942f6b7a9cbe40333378e4e8c97d2522ca0217ca00c3d375993be6977a1fc5c98622fa5d01027ac31d56b3598730055231124a63c16c553391a7141643211c98ce36acc8384d91564e9cf830d72f1377e0a9631c1bdce3fb8e2e2f787d97052a3c572a1558d96d6df2b6966210eb235adf38764a3769802d5f24bf981597331453b0000000000005e294e67c88a177daa649d8a572d73008da367e38abcab9520e237fad92c0fcc0ca60970e5ff479484bb44d3b66d14f1847c7ed5063853995d22155518eee3d4257f8c2332883dbe06d800c3d779e24edcb54d0a59231e1e422a58f617cb521daaa3916fd19aff986d43f8e5086468518bfe9b1107ad8d9bef"], 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2}) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(0xffffffffffffffff, 0xc0109428, &(0x7f0000000740)={0x3, 0x1}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:34 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 70) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:34 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) [ 3209.663468] loop3: detected capacity change from 0 to 40 [ 3209.695988] loop4: detected capacity change from 0 to 40 [ 3209.740971] syz-executor.3: attempt to access beyond end of device [ 3209.740971] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.741854] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3209.744316] syz-executor.4: attempt to access beyond end of device [ 3209.744316] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.745236] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3209.780323] syz-executor.3: attempt to access beyond end of device [ 3209.780323] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3209.781464] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3209.818571] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:23:51 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 68) 15:23:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="f5", @ANYRESHEX=r3, @ANYRESOCT=r3, @ANYRES32, @ANYRES32, @ANYRES32=0x0, @ANYBLOB="04000000000800000000020200ff0000912a9732f53ba32d"], 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(r2, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000000)='%\\+\x00', &(0x7f0000000040)='./file1\x00', 0xffffffffffffff9c) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8162, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x400000, 0x6, 0x100}, 0x0, 0x9, 0xffffffffffffffff, 0x0) sendfile(r5, r0, 0x0, 0xfffffdef) sync_file_range(r4, 0x9, 0x81, 0x1) 15:23:51 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e8"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3226.429315] loop7: detected capacity change from 0 to 40 15:23:51 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:23:51 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) 15:23:51 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 71) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:51 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x2000, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000740)=0x2, 0x1000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000b80)=ANY=[@ANYBLOB="cc000505dd0000004c020020ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf0000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000bcb7f4eef3ba386a19de3999bb1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb4000000000000000000000000000000000000000000000000000000000000000000000e43ec0470eb6959925e636b88e7de008e922c24acff49240457c16f79486cf5b4f5a3e6e9fbe92b25f6a28db5b2b35a5e6bdaa1f28e7f0badcac9ac88d14a962192af0f600929b4d54f6780f2fda59c2c9975c16cc56e17cee3272938f59491583a3a5d7909ab3e6a1bf312e5170257d9eb3579766aa01ad5a5693b84e7cc5aad0eb693d16fa1343b357d7614109099a210034d2d4622db112a611079fbec9d35e5b3b3efe1e95e49a5d7c1d7f2afb95eb5cfe167c3d1c8b798dce4777e55f13d62dbe11f08f27025019025797ea0d5368b7aadeadf1031e5d41be51618e1b3be26a98b03919dd4b0c4098635a74400e2bd3592a6f0043c2c27a828b27ee811aa057ac3c2e70549668d409b6f46e74a95e121d85f503edec0471b8fd4edac3cb6214680b0a7106a68f66a906ba844ce5b727132ad5799a30d8e5e8"], 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:23:51 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = geteuid() mount$tmpfs(0x0, &(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x800040, &(0x7f00000001c0)={[{@huge_always}], [{@appraise}, {@uid_lt={'uid<', r1}}, {@measure}]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x800, 0x4) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) [ 3226.537958] syz-executor.7: attempt to access beyond end of device [ 3226.537958] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3226.538897] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3226.541829] FAT-fs (loop1): bogus number of reserved sectors [ 3226.542272] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3226.554775] tmpfs: Unsupported parameter 'huge' [ 3226.558026] loop4: detected capacity change from 0 to 40 [ 3226.561875] loop3: detected capacity change from 0 to 40 15:23:51 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 69) 15:23:51 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3226.706786] syz-executor.4: attempt to access beyond end of device [ 3226.706786] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3226.707767] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:23:51 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) 15:23:51 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3226.772801] loop7: detected capacity change from 0 to 40 [ 3226.925019] syz-executor.7: attempt to access beyond end of device [ 3226.925019] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3226.927431] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3227.376902] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3227.394677] tmpfs: Unsupported parameter 'huge' [ 3227.405112] loop3: detected capacity change from 0 to 40 15:24:07 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:07 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 72) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:07 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a403, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f00000003c0)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000800)={{0xcc, 0x5, 0x5, 0xdd, 0x80000248, 0x7ca, 0x1dc, 0xfffffffd}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf"}, 0xb8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x40, 0x0) openat(r4, &(0x7f0000000380)='./file2\x00', 0x0, 0x14) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) [ 3242.722328] loop4: detected capacity change from 0 to 40 15:24:07 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) 15:24:07 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:24:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getuid() fsetxattr$system_posix_acl(r4, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r5}, {0x2, 0x1, r6}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r4, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r3, {0x5}}, '\x00'}) accept4$unix(r4, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000000)=@req={0x8211, 0x4, 0xfe, 0x80000001}, 0x10) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r7, r0, 0x0, 0xfffffdef) 15:24:07 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 70) 15:24:07 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r1, 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r1, 0x40049421, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r3, 0xc038943b, &(0x7f00000001c0)={0x7, 0x10, '\x00', 0x1, &(0x7f0000000180)=[0x0, 0x0]}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2}) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r4, {0xfff}}, './file0\x00'}) sendfile(r2, r0, 0x0, 0xfffffdef) [ 3242.755058] loop3: detected capacity change from 0 to 40 [ 3242.806199] FAT-fs (loop1): bogus number of reserved sectors [ 3242.806702] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3242.811072] syz-executor.4: attempt to access beyond end of device [ 3242.811072] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3242.811991] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3242.818328] loop7: detected capacity change from 0 to 40 15:24:07 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 73) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:07 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) [ 3242.933023] syz-executor.7: attempt to access beyond end of device [ 3242.933023] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3242.934069] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3242.961233] blktrace: Concurrent blktraces are not allowed on sg0 [ 3242.978841] syz-executor.3: attempt to access beyond end of device [ 3242.978841] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3242.980648] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3242.987232] loop4: detected capacity change from 0 to 40 15:24:07 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 71) 15:24:07 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3243.069436] syz-executor.3: attempt to access beyond end of device [ 3243.069436] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3243.070246] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3243.139624] syz-executor.4: attempt to access beyond end of device [ 3243.139624] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3243.140546] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3243.192795] loop7: detected capacity change from 0 to 40 [ 3243.360106] syz-executor.7: attempt to access beyond end of device [ 3243.360106] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3243.362029] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3243.628228] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:24:21 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 74) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:21 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:21 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 72) [ 3257.332002] loop4: detected capacity change from 0 to 40 15:24:21 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) syz_open_dev$sg(&(0x7f0000000740), 0x9, 0x400) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) ioctl$PTP_EXTTS_REQUEST(0xffffffffffffffff, 0x40103d02, &(0x7f0000000780)={0x0, 0x4}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:21 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) 15:24:21 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca92"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:24:22 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r0, 0x0, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x9362, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x200000000000004, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="de5a94e22784f151d629db01", 0xc, 0x40}], 0x8080, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYRES16, @ANYRES32=r0]) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000340)=[r0, r1, r0, r2, r0], 0x5) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000000c0)={'rose0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x46, 0xffffffff, 0x5, 0x4, 0x1, "2de711", 0xaee371eb, [0x9, 0x8, 0x4, 0x58c, 0x5, 0x7]}}) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x405, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r4, r3, 0x0, 0xfffffdef) [ 3257.357109] loop7: detected capacity change from 0 to 40 15:24:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCGPKT(r1, 0x80045438, &(0x7f0000000040)) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000a40)=[{{&(0x7f00000001c0)={0xa, 0x4e24, 0x0, @private1}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="24080400000000002900250032000000fe8000000000000000400000000000aa", @ANYRES32=r4, @ANYBLOB="0011f804"], 0x28}}], 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000140)={@remote, @loopback, r4}, 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x82b1, 0xc0, 0x0, 0x0, 0x0, 0x0, 0x108, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r5, r0, 0x0, 0xfffffdef) [ 3257.371921] loop3: detected capacity change from 0 to 40 [ 3257.409652] loop1: detected capacity change from 0 to 264192 [ 3257.481929] syz-executor.7: attempt to access beyond end of device [ 3257.481929] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3257.483711] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3257.580977] syz-executor.3: attempt to access beyond end of device [ 3257.580977] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3257.582471] syz-executor.4: attempt to access beyond end of device [ 3257.582471] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3257.582535] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3257.585311] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:24:22 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 73) 15:24:22 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 75) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3257.710097] syz-executor.3: attempt to access beyond end of device [ 3257.710097] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3257.711789] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:24:22 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:22 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) 15:24:22 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) lsetxattr$security_ima(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780), &(0x7f00000007c0)=@v1={0x2, "866543815435b4a067"}, 0xa, 0x3) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3257.918766] loop7: detected capacity change from 0 to 40 15:24:22 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3257.946691] loop4: detected capacity change from 0 to 40 [ 3258.113928] loop3: detected capacity change from 0 to 40 [ 3258.155867] syz-executor.7: attempt to access beyond end of device [ 3258.155867] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.158181] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3258.199323] syz-executor.4: attempt to access beyond end of device [ 3258.199323] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.201275] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3258.265822] syz-executor.3: attempt to access beyond end of device [ 3258.265822] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.267641] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:24:22 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 76) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:22 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 74) [ 3258.377050] syz-executor.3: attempt to access beyond end of device [ 3258.377050] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.378934] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3258.387919] loop1: detected capacity change from 0 to 264192 15:24:23 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) 15:24:23 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3258.547253] loop7: detected capacity change from 0 to 40 [ 3258.564452] loop4: detected capacity change from 0 to 40 [ 3258.666239] syz-executor.4: attempt to access beyond end of device [ 3258.666239] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.668108] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3258.672704] syz-executor.7: attempt to access beyond end of device [ 3258.672704] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3258.674422] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3271.028514] loop3: detected capacity change from 0 to 40 15:24:35 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) r4 = accept(r0, &(0x7f0000000740)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f00000007c0)=0x80) write$binfmt_aout(r4, &(0x7f0000000800)={{0x107, 0x4, 0x1, 0x271, 0x4d, 0x9, 0x322, 0xffffffff}, "d7c0327b397f673e215fbac983854442f111db78273b2a630854b3c4f264dd9b1efa67f1ffd074b848e5c92d96bb7e32", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x850) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) 15:24:35 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:24:35 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:35 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) 15:24:35 executing program 1: getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xa, &(0x7f00000000c0), &(0x7f0000000180)=0x4) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000001c0)={r1, 0x3ae6, 0x8}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {0x400}}, './file1\x00'}) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) faccessat2(r0, &(0x7f0000000080)='./file0\x00', 0x10, 0x1300) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 15:24:35 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 75) 15:24:35 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 77) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0xfffffffffffffffa, 0xffffffffffffffff, 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x101) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000005c0)={0x0}, &(0x7f0000000600)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000140), &(0x7f0000000180)=@v2={0x2000000, [{0x0, 0x2}, {0x5, 0x3}]}, 0x14, 0x3) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x80, 0x97, 0x80, 0x80, 0x0, 0xfffffffffffffffc, 0xa1, 0x8, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5f, 0x1, @perf_config_ext={0x6f, 0x7f}, 0x8104, 0x3f, 0x80000001, 0x0, 0x5, 0x16, 0x1, 0x0, 0x9, 0x0, 0x80}, r3, 0xb, 0xffffffffffffffff, 0x2) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000380)={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, 0xc) listen(r4, 0x401) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) [ 3271.088970] FAT-fs (loop1): bogus number of reserved sectors [ 3271.089688] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3271.100072] syz-executor.3: attempt to access beyond end of device [ 3271.100072] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3271.101328] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3271.103204] loop4: detected capacity change from 0 to 40 [ 3271.148257] loop7: detected capacity change from 0 to 40 15:24:35 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(0xffffffffffffffff, 0x82307202, &(0x7f0000000880)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r2, 0x0, 0x0) write$binfmt_aout(r2, &(0x7f0000000740)={{0x10b, 0x3, 0x81, 0x2f2, 0x260, 0x4, 0x3ad, 0x309}, "730ff04926649661ba50417aef9526674692ba02d67938f460f15a7b3d", ['\x00']}, 0x13d) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a3ab75cfbd75b09d0978975e40645ad7e748c02edee87a648308880f9b506cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efff00"/696], 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000)={0xa0000005}) [ 3271.266311] syz-executor.4: attempt to access beyond end of device [ 3271.266311] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3271.267852] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3271.298947] syz-executor.7: attempt to access beyond end of device [ 3271.298947] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3271.300481] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:24:36 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000000000000000"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:36 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 78) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:36 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 76) 15:24:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x701342, 0x20) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:24:36 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) 15:24:36 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3271.647886] loop4: detected capacity change from 0 to 40 [ 3271.714272] loop7: detected capacity change from 0 to 40 [ 3271.766269] syz-executor.4: attempt to access beyond end of device [ 3271.766269] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3271.767576] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:24:36 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000000000000000"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3271.899277] syz-executor.7: attempt to access beyond end of device [ 3271.899277] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3271.900710] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:24:36 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 79) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) r2 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040)={0x105040, 0x42, 0x10}, 0x18) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYRES64]) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) fcntl$getown(r2, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000200)={'erspan0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x7, 0x10, 0x4, 0x7f, {{0xb, 0x4, 0x0, 0x7, 0x2c, 0x66, 0x0, 0x1, 0x2f, 0x0, @multicast2, @multicast1, {[@timestamp={0x44, 0x10, 0x54, 0x0, 0x7, [0x7, 0xe651, 0x0]}, @noop, @timestamp_addr={0x44, 0x4, 0x7d, 0x1, 0x7}]}}}}}) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, r5}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x400, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r6, r0, 0x0, 0xfffffdef) [ 3272.066252] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:24:36 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) [ 3272.194454] loop4: detected capacity change from 0 to 40 [ 3272.355271] syz-executor.4: attempt to access beyond end of device [ 3272.355271] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3272.356800] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:24:52 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 77) [ 3287.738935] loop7: detected capacity change from 0 to 40 [ 3287.762182] loop4: detected capacity change from 0 to 40 [ 3287.770657] FAT-fs (loop1): bogus number of reserved sectors [ 3287.771090] FAT-fs (loop1): Can't find a valid FAT filesystem 15:24:52 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file2\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) unlinkat(r0, &(0x7f00000007c0)='./file1\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, r2, 0xb) r4 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000740)={0x0, 0x80, 0x8, 0x3, 0x81, 0x40, 0x0, 0x7, 0x22, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1000, 0x4, @perf_config_ext={0x3, 0x4}, 0x9050, 0x2, 0x4, 0x6, 0x2, 0xdde, 0x4dc, 0x0, 0x8}, r4, 0x1, r2, 0x8) sendfile(r2, r0, 0x0, 0xfffffdef) read(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000700)) 15:24:52 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:24:52 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000000000000000"], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:52 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) r3 = syz_mount_image$nfs(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0xd1a, 0xa, &(0x7f0000000a40)=[{&(0x7f0000000180)="ef33f62262204e748b85e8a3e0e86147f416fa7d551cbe7973d3079107dce631e2c6554b2f18498df8be8da97b15315c4905940f786a9ef84d158fa6397db1f90e2b5026f3ccee89d4d874d9b5260aaa22733cdbc7d155c87f99eb6062c24950fa2735dd5a192ab2d04f3f52910d03a989eae9df", 0x74, 0x8}, {&(0x7f0000000300)="f408f7727705335f91b3fc0144cbb26cf2a0fa60022a62c71d2e022d2e40e823d435c8576426ffd62b29d35e2de2c1c9935abb287089ffff5865f86bb04f8eeec8aa05aa1fe8bb372a519928100873b0633495f047b5bee0935ab998e7e135507018b994200617c132bc865b2cdb34222b536029cedf7a8a6061b183806675fe5c78469ddf150e9d3ead44e68e0d5a97bd5e6084f7bcc905cc7e1ea632a9bd23824ef065545a329c507e309f241e137d801ed407d590e6858163a9051c01a28e67d8a402b1114fa32b990eb70f3362348b6fd512f1ff9b7cd2d406b9edf65e2553d07d25f0f0843c6efd78629fba31a2", 0xf0, 0xf49}, {&(0x7f0000000400)="68f6c0065c59dc01bb89c191d2e1b7b3bbaf92d882c950025493234ba118a89fe5253d88598c7f868aa1f7ea8dffcad36cf2502e3926a2c75bd4772795939ff89e40aae63ba1f5bbd6fc24a68f8605b87fdcdec95af5e38d72cb88b2958bd532baf37cb49e1b00b5e2328dfef39c97dbdf721b4f34db5a1ece211e5d41a647db934ab5aba1cc1cd69289e2e4df3d8cdf313202c39276ca1c42ee7f90bf6915fe6bc6deb41be6", 0xa6, 0xd126}, {&(0x7f00000004c0)="7d10d6b962e3696f4823b897c4dd176044af0d61a3fac2df2ddd3c92c6b90dbf592462d86f94268b737330ad03817381290be2410eee04ed490125f6bddef2227a4472de01053c32c41a07ea02928abcf2d672c2c3a9612a353de1750c47eef0f5ef7e9305d5f13318d3c626e15a2151b3fca7682802cdb34da14f9bc80b758e6efa15fc3342a59135c36a2769c79c283472ea1a9a886510accf9e5d72edb8225010f9258d3303be7f850e8f6f3a3cfe33c5dfb94efdda00ead0bb11263f", 0xbe, 0x9}, {&(0x7f0000000580)="bbfb16e55df0c611ca99090db303720810227532481d346dd01a39c02c76743527d7fe0312e2e437a2844ae18291b25a21d0c662d63bc8eabaaf267bcf51647f1aced7190bec3de9cff803a65f4626297b9cfd8f4e3b79ca8064728d1fe3308cf65becae0d57c6f2286a9140bf996135e7dac36a8982ceecb1c65a0f376679fe6d4f89e506cb2ac23bfd985524029560", 0x90, 0xffffffffffffb61d}, {&(0x7f0000000640)="10e9f043e17e6900c52467f670f1f40cf7910dfbde79f3e4292369527b68d961e75fdbf398d8dfa54d3dcb6d9c122e7b64583a5004bfca822648a7956740fec8efa48c9fde8cbf2bcc90b7331955afe2576d53028fee8c7f1158ef4722f5eb900c47a90a50526d243572d4bac624f8708619ba9f17469c0dd0ebef91e5378c593ced2914cf6cf7ec5addb0d3656f5be3a7681869f0fdd322a9a269e9f0226129aadc8695e7949b4e146bc69e1c74a2a32f6d6c6534fd016518ff88d5c4af6a1ef59321814749be1ced90e2c1a514ae2838c1b04c6289e4cf93ec9552d1599d93", 0xe0, 0x2}, {&(0x7f0000000740)="43fb48ebe3ea1c8d38c3524db2e540a5b7425c40692df97aa92bdd6478cabf3ec63fb7108152e107d9ee728ceb06c0ab463c58ea2104304a186ecf00a12169ed6715d627ebc5fd92e543296ec9f88622e1ca43fba960bf8c73ee425a408c3684e48a114b39202332d43bb167360109c1fc0c419dff22094b9e60ea7329f3c20660453839496874a9e8377570acd7049f0f73d13ae0305492f286834cfc45a97c6078f855b62d0d6bfe435687b279e019c78bb74f9e8c88c06bddcdf64b6caf7d59303911a326ee5526", 0xc9, 0x4}, {&(0x7f0000000840)="6c0a26910570507362d14ffd28614be35f55df10536fcdbc1e21679c32a4bd7b063a21fdb2dcdfd5db9eacf7d723618cf7b2772438d71c3a1f24b7ab32fb188c9f7ec332a59211975c8928d16881bd5ab1a480451061309fdaef5207df15c84f8d01b98190e6c56f27bd1efe8347f26eb99e024a138b957109b2cf05e87c", 0x7e, 0x8}, {&(0x7f00000008c0)="b21f0cc94bbd27db19816b29acf40636a6f914b07583a3aa372fbea3312e4cccfc4a0442be2bf549b56a09872074380ef01615422f6ee552a3e7a73083af8ab5b241d6904713680884b7aaed4c3e3fd6f25fd0f74bc1d351bb102ca2a91f8ebcf72cd65aa3d0f6663e390ce55842eb69f33c6a17d931cf853af92e8fb120803398127e626eb26e7cd6de0cb4dedee0582a69c1fa7b8bef156ffe59b34b4570f58afb27f80b4b7c6c9f9ca9d6e4eaf5632137c27c43b716e8d5f78336991b61145a3846e5fcaa4d93c69767a00b44614f1a35b4c7caf68e06", 0xd8, 0x9}, {&(0x7f00000009c0)="0abfcc4e956e11d34e28d4e43c1de37a27a495eda7e96d6b610c2bc201a534551c6d2928755bc3fb57124528cfbfd4c7adf54058d01c99700d1cbf39ad85ed5e333021a23f8ed9fc6d6a75f5fd5b41af9ead0323f3", 0x55, 0x7fff}], 0x10000, &(0x7f0000000240)={[{'!.)'}, {}], [{@euid_eq={'euid', 0x3d, 0xee00}}, {@appraise_type}]}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000b40)={0x7, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x0, "8dfbc777b100ff"}) ioctl$BTRFS_IOC_INO_LOOKUP(r3, 0xd0009412, &(0x7f0000001b40)={r4, 0x3}) 15:24:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) [ 3287.836069] loop3: detected capacity change from 0 to 40 syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) 15:24:52 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 80) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:52 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000400)=ANY=[@ANYRES16, @ANYRES16=r4, @ANYBLOB="11000001", @ANYRES32=r5, @ANYRES16, @ANYRES32=0x0, @ANYBLOB="040000000000000010000200000000002000020000000000"], 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000000300)=ANY=[@ANYBLOB="b6f90d4563f8f7e26c1d2a4c8aa9e9de7fc35740fb0c0cb83625f48ce63972bcf44f5dd41ed0aac36cc0b46dfba866137bbddc2fc97370b9f62772599b9478d03253f9be79f09fdb4833c18b1b51952029b499ccd10b76ab720e0f41bab7defbd2585f61c792d080a97d978d0950fd8fb3fc1ca836fd10185686ea4005b175ea5474f565", @ANYRES32=r2, @ANYBLOB="050000000000000000"]) r6 = accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) openat(r3, &(0x7f0000000000)='./file0\x00', 0x0, 0x27) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r7, r6, 0x0, 0xfffffdef) [ 3287.859164] loop1: detected capacity change from 0 to 16310 [ 3287.863123] nfs: Unknown parameter '!.)' [ 3287.888153] syz-executor.7: attempt to access beyond end of device [ 3287.888153] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3287.889153] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:24:52 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xa7984b630dc8b8b7) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 15:24:52 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 81) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:24:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) 15:24:52 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 78) 15:24:52 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/449], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:24:52 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3288.125509] loop4: detected capacity change from 0 to 40 [ 3288.199095] loop7: detected capacity change from 0 to 40 [ 3288.427915] syz-executor.7: attempt to access beyond end of device [ 3288.427915] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3288.429954] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3288.453955] syz-executor.4: attempt to access beyond end of device [ 3288.453955] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3288.455994] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3288.656958] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:25:08 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom(r1, &(0x7f0000000300)=""/4096, 0x1000, 0x3, &(0x7f0000000000)=@nfc={0x27, 0x1, 0x2, 0x6}, 0x80) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:25:08 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) 15:25:08 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 82) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:08 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 79) 15:25:08 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/449], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:08 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8086, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:25:08 executing program 3: r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) shmctl$IPC_RMID(r0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000640)='./file0\x00', &(0x7f0000000740)=""/160, 0xa0) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) [ 3303.697188] loop4: detected capacity change from 0 to 40 [ 3303.713201] loop7: detected capacity change from 0 to 40 [ 3303.718589] loop3: detected capacity change from 0 to 40 [ 3303.723327] FAT-fs (loop1): bogus number of reserved sectors [ 3303.724268] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3303.849180] syz-executor.3: attempt to access beyond end of device [ 3303.849180] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3303.851633] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3303.955251] syz-executor.4: attempt to access beyond end of device [ 3303.955251] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3303.957218] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3303.986864] syz-executor.3: attempt to access beyond end of device [ 3303.986864] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3303.988807] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3304.004818] syz-executor.7: attempt to access beyond end of device [ 3304.004818] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3304.006636] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:08 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) 15:25:08 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0x7, 0x9, 0x2, 0x1f, 0x2, 0x6, 0x9, 0x136, 0x38, 0xc2, 0xdf1, 0x3, 0x20, 0x1, 0x0, 0x5f, 0x14c3}, [{0x1, 0x0, 0x3ff, 0x1000000, 0x7fff, 0x6, 0x6, 0x49}, {0x2, 0x6, 0x8, 0x6, 0x9, 0x5, 0x8000}], "4943be2fba6de5509977e7c3352cf1e3e1226fd961415c4902c44196a2da3c253daf77bf2afc3f9f7d69face5a8b", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x8a6) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:08 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/449], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:08 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 80) 15:25:08 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:08 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 83) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3304.309809] loop3: detected capacity change from 0 to 40 [ 3304.478051] loop7: detected capacity change from 0 to 40 [ 3304.483222] loop4: detected capacity change from 0 to 40 15:25:09 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3304.558293] syz-executor.3: attempt to access beyond end of device [ 3304.558293] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3304.559806] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3304.630992] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3304.633276] syz-executor.4: attempt to access beyond end of device [ 3304.633276] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3304.634815] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3304.648836] syz-executor.3: attempt to access beyond end of device [ 3304.648836] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3304.650549] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3304.663506] syz-executor.7: attempt to access beyond end of device [ 3304.663506] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3304.665634] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:23 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xb, 0xffffffffffffffff, 0xb) r2 = open_tree(r1, &(0x7f00000003c0)='./file1\x00', 0x8000) lseek(r2, 0x7, 0x1) r3 = openat$cgroup_int(r1, &(0x7f00000001c0)='cpuset.mem_exclusive\x00', 0x2, 0x0) sendfile(r3, r1, &(0x7f0000000240)=0x3, 0xa42e) mount$9p_rdma(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180), 0x404, &(0x7f0000000300)={'trans=rdma,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@common=@cache_mmap}, {@timeout={'timeout', 0x3d, 0x2}}, {@sq={'sq', 0x3d, 0x7}}], [{@defcontext={'defcontext', 0x3d, 'sysadm_u'}}, {@seclabel}, {@smackfshat={'smackfshat', 0x3d, 'vfat\x00'}}, {@subj_role={'subj_role', 0x3d, 'vfat\x00'}}, {@seclabel}]}}) sendfile(r1, r0, 0x0, 0xfffffdef) 15:25:23 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/451], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3319.312953] FAT-fs (loop1): bogus number of reserved sectors [ 3319.313858] FAT-fs (loop1): Can't find a valid FAT filesystem 15:25:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat(r1, &(0x7f0000000100)='./file0\x00', 0x4042, 0x1c) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getuid() fsetxattr$system_posix_acl(r5, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r7, @ANYBLOB="02000400", @ANYRES32=0x0, @ANYBLOB="040000000000000010000200000000002000020000000000773a2a75e7226ed55accfd2500931dbc395b1332cd3c1ec9c740855b2ac315e57947a7c8954d398b163af7d79e2f3abef941ea1d491cd7eb509043897b89d3ca9175ead96ea28828d81e0112c2b87f9af8f49b979674662009d151010e89f849fa3de74d5ba410bf2215b46be25e7dbd14e7047a37ef0b3aba2f55ba61396140e3e6cc3361c2cf06fc77c33ffbaf82063bcb17b061edbce8cbd29a7c4b41f46592cce06ec78e397c4ef41cfb3d42d00b1aa5fbb54e0307a7dbf45814c1f0adaf5bf12dce9fe610f1f390420c59d937647dc81b645b4e462c5b57e7b4bdf5349b3a8a9ad283f334b18a104ae81aa8f0903ceb728ccfd5dea20a6c4288d953745ae90e5fd7f6ba9f38216f403659f82074ad319d9e83ecb56151beb167182c166a1ec7e9403a04ca368e53cae6c21b237986ef43bdc711a118a8240c1a9b1dae16c509f1582260e8d10bcb0b1989183cfd7abcb325082d320693d90957ee755780287d52489fa8279bffa57c87cb8b6946af107def93edf4498233fa5fbfbc18bde364f18bcf62dc381d10b28c88e6ab"], 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r4, {0x5}}, '\x00'}) accept4$unix(r5, &(0x7f0000005dc0)=@abs, &(0x7f0000000140)=0x6e, 0x0) openat(r5, &(0x7f0000000000)='./file1\x00', 0x121100, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:25:23 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) openat(r2, &(0x7f0000000740)='./file2\x00', 0x533003, 0x12) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:23 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 81) 15:25:23 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 84) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:23 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/434], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:23 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) [ 3319.355848] loop4: detected capacity change from 0 to 40 [ 3319.359740] loop3: detected capacity change from 0 to 40 [ 3319.367312] loop7: detected capacity change from 0 to 40 [ 3319.370742] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 3319.630024] syz-executor.4: attempt to access beyond end of device [ 3319.630024] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3319.631813] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3319.654975] syz-executor.3: attempt to access beyond end of device [ 3319.654975] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3319.656821] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:25:24 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:24 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 82) [ 3319.755968] syz-executor.3: attempt to access beyond end of device [ 3319.755968] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3319.757769] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:25:24 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/451], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:24 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 85) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:24 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) [ 3319.963190] loop7: detected capacity change from 0 to 40 15:25:24 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000007c0)='./file0\x00', 0x1, 0x2, &(0x7f0000000200)=[{&(0x7f0000000a00)="601c6d6b646f7366d8a02b00080101000440002000f8014a2e908716811a2e9d0d3652ac338351318b6e614f39bdd8a5de93c24eff91f47672e5af41b0a94d0ca4971cf435f6b4fa77e96b231d0c22f4c2da89badf8160bb14042ed0499b5a0059cce88bc5fc54834d14b2db18c6a411b069af09bb24c12f5d7350d676b421e3005a2558a20b98230e03b71a30570e1b1c014e4c844a6e5308e0c50749b8fbfe1c6e0f288ee2ad241076c1d28d1b6faa6656628ba678b78c58caedb744186f0a90be69d9436285d6faf901c0f75c031b01fc4c1a67cb45963ed10dc05830081ecfef29ba7ce9cbf62f3ebcbca53745d92f152e73e59ec55f2fe6db0c4d540100a52b90891990802a391313e69241fe9254ad189599283a354a89bf3354fb786c669f2bd5f62a548ba52f359d0f8bdb8f20832cdd570e4e9a536dba65c63e972953c0b5934715f344e40444b6cd96715521f598ca57af6adcdf4ce96295c12fa7eb7de805ff993f88b8ea2add1aae99538b26bb7ce0aa4ec7fce4032c4ba7017b463627438d2a66cf13a10483174a80ce18117ac0b23693fcb92dd6dcf579275a94e745a3b3000000000000", 0x1ab}, {0x0, 0x0, 0x8}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) openat(0xffffffffffffffff, &(0x7f0000000800)='./file0\x00', 0x300, 0x10) r2 = memfd_create(&(0x7f0000000740)='\x00', 0x6) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000780)) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) [ 3320.023714] FAT-fs (loop3): bogus number of reserved sectors [ 3320.024617] FAT-fs (loop3): Can't find a valid FAT filesystem [ 3320.043876] loop4: detected capacity change from 0 to 40 15:25:24 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3320.250186] syz-executor.7: attempt to access beyond end of device [ 3320.250186] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3320.252241] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:24 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/451], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3320.307287] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3320.357124] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 3320.392568] syz-executor.4: attempt to access beyond end of device [ 3320.392568] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3320.394731] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:25:25 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:25:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 83) 15:25:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000000)={0x3, 'veth1_virt_wifi\x00', {0x3}, 0xfaf}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r0, 0x0, 0xfffffdef) [ 3320.823173] loop7: detected capacity change from 0 to 40 [ 3320.906669] FAT-fs (loop3): Unrecognized mount option "./file0" or missing value [ 3320.961555] syz-executor.7: attempt to access beyond end of device [ 3320.961555] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3320.963590] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) mknodat$null(r1, &(0x7f0000000040)='\x00', 0x8000, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r2, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) sendfile(r3, 0xffffffffffffffff, &(0x7f0000000180)=0x6, 0xb9f) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000080)={@empty, @loopback}, &(0x7f0000000140)=0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r0, 0x0, 0xfffffdef) 15:25:40 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:40 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 86) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:40 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = syz_open_dev$hidraw(&(0x7f0000000740), 0x80, 0x214002) ioctl$AUTOFS_IOC_EXPIRE(r2, 0x810c9365, &(0x7f0000000780)={{0x5, 0x5f0}, 0x100, './file3\x00'}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) 15:25:40 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getuid() fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r3}, {0x2, 0x1, r4}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r1, {0x5}}, '\x00'}) accept4$unix(r2, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) r5 = openat(r2, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0) write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r5, r0, 0x0, 0xfffffdef) 15:25:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/436], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:40 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:25:40 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 84) [ 3335.777379] loop3: detected capacity change from 0 to 40 [ 3335.779950] loop7: detected capacity change from 0 to 40 [ 3335.792424] loop4: detected capacity change from 0 to 40 [ 3335.801884] FAT-fs (loop1): bogus number of reserved sectors [ 3335.802456] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3335.837855] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3335.852549] syz-executor.3: attempt to access beyond end of device [ 3335.852549] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3335.853422] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3335.870260] syz-executor.4: attempt to access beyond end of device [ 3335.870260] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3335.871152] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:25:40 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000080)='./file0/file0\x00', 0x100) io_uring_setup(0x5cf9, &(0x7f0000000180)={0x0, 0x8bc0, 0x2, 0x3, 0x198, 0x0, r0}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3335.951910] syz-executor.7: attempt to access beyond end of device [ 3335.951910] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3335.953724] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:40 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 87) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:40 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:25:40 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:40 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) write(r1, &(0x7f0000000740)="c531ec920def6c72b0b750b2fd09e527dc89f8ed158fd4ec1829103706cb3178cd6c2328386e31840b7d5a20b442f5b2f81d0956674fd2fd615dc8bda069ae2a470199a12c225bf81509899b4940dcf72f40ae2c725e73012a13fbd06ca3107d229b5e90738d4e5aa0cbde3f8bff344b1bc444b8c99d2c235ec28422bc1777b3d51c30ff5c440dd9d603e63a2a3db791a14efee9c811b696e16c6b36559fe1776a7eff4e12ae2baa35544358c41e20217c250c620e4c2e8bfcd2f1a08fe4dba964ede17a1ea229e9121f24edc7e3b50b81bd09034853a98cfc49aa696d7b1480f3bf52092678b26b03da3f2059f54b7d5ea76f126c472a33b4f80222470b3b6193cf5f4902739458f1a24bea7a5277cccf547f437fa12109b8db3e2b9516996652159d0bd3a7d0d37f6dd728cca0f36bae17c5113585159b0ecab0ae1b2dae5b5223f3ff81bbda782c97fad7497b78b9ae74dff0b07bbdae66d06e4fdae16930b8e5d4f54165a257066ecac966ddf93172bb66b53fdd6a2ea6892d7301baa620c903ca44510926e50d88a09ed1566a02d9919911a9aa0c0abeda3032e22bb9fec7c9918c132ee1c937e5ef8381d56df989e63fb285a5aae5d80b3139d2eb79b508c2c8bf187d890d0ec569b0753721d4cb60920b57a16a11b4cddbce6788af34b0d643708c7e661ba9e61affdc92ddb2bb3a884839d291999e33107b935662f9c8ee29a0d14ddda6c2c9e16e4665175e5655aae903e1f5f5130526cb1aaeda3cd411a690cbe5416799204c6e24ae3e14221c6a08fde77aa2f4d0d7a3b9ce15d0e49146507fc303c7c401fd8d779822b85b6b3f8b878c587cc371e6bdc67bd13eea9a07ece01ced6d66b6836b59bf0846b9b1d2e9851651bb8117a5d1949856c69e96e49f24706275ab00a9e2b5f66d9e3dd25a319324068742d64641087f81b2047332c63405a3221347757972be23e93f76f503ea86300bdd32b55c2691529095e776b240d4ff4ab1b64abc380637947a4d7b925d45a1e8d092e726c8edeaf7f1fc5fee4f647b40159a07050c1e195082aebf0b8242144787141d6f9ebd0a4730ba899bf6657dc6eee28bd49ab377df1ed55138ec00d8da79b4697052210e7c4b37d0c98b2dcb071438f3edaecfb95cfadd14eee475713eb04389baea382f32d475259081b0527d7d34f13199044c737754a4b398aaf6b8bfc6244599b3fab588bbb442ff1ce44a1f0e5b600f3e48a1936ade878e0225a649a5e11982f3265b5b57bca69156e9d028593f7271880404de63a81925390c703f5cafc50f6452bfc230d2dced6e9d331f3dae8fbc81392f26e364e242f1b309f28197505adceedcce136c37698cde377aa8fc1c391fc2c54bfc9db690aa03a6d3de2a4b77de2601984491cd9c832aaf717131b97c33efc4888b0e09995b6f391b45cde931c51de119143ad23a630c4c2c77979e440cb7932d6f6d0e41a04b55d11f1b5ec0146980a1e79569b6760de79fe265dfa874f6dadddd42276af53e7fd4ef065a765d0369323d4ea16d4a911b25cb43654cc7eaea6c5dbd5f621349f1b08db08488fcfe1462a1f475007551b881a1356aaab111500b32a4b824f411f85045da750eea7a1cb339faa96cd069bec6961306c7c1084877c660ba8d0cf9dda100fdf8418758e99624b427dd2800d0723cea275d321dad2b01bc5a6845ea60a405fa740b8ebf24ca2ed044fe2f5e1abf76edf10f6322a88da1fdf14dba48604e207a90b590e6605b309bc227f320aea77dc1e042e47d64d4f37525f1a30b6c86b8b23a38fee5f437bb52420e3c7d828190bf3fa855ae5c570e1825596a6fea7fe2d3be2f979d4d7ba422ade240eafc0c1cdb5364f8a8e3cd1c79f2ae585fde7a87082dcc936be8d63ccc918be536531adcf5137990ae8618f249d0e48291182f423ae123570f1ba5f5f8b4c5e0d937d33c614a38ffdb1deab3dae176d94fca6deb11878cb82d5d87dbfb2fe5effc263044338844c84674fac828de1ede0e1a025050fd3ef7f3dcbe9d56e16ae08a7611923197fd8dfad03d3ad84cd2d3e0c097968284db58e8a568df44bb764d900a6e00650ab2532f538ea8b55f4724d6a8bfa18f70e536be7e0049478f47378b70b98d93eb18b995c4c40349c0fb3363600b5742d04494a43f95a7cf62948fd62aa934476ebb712d0cd89b9d9434c245700319e1191b97317d70c34582b237a2e9927bff0ddef25ce949195ab258e5e7bedb366853328bf941275fea1675d807d04fab408560bc57f474e54665edfa1f5199e7c627d99771c79b53c58433f0cebe90c7e07feedaea3d8b120339551035ab56ef9a215ea2807c047f1d905884c1efadd2cabafc83930b3aca036625246fd115379fa9e6483179b248699629b0f934e545b69dc429e15f3a7cfdb9f4b4d13a04c217b993fba25d7132b0d9c2238c6261cc012c35eca8f4d80d9868b08845e14f487574f42d70e38d8952212fb0e29c3ed2a75731ed7e36446004d59b41142c70b686d47270a32be9792b26e9fb04d69df57ea0036242cf41510138a87fef7a2fa3a953fd7a95f83aa9e09bc492dc05e6f10bf07c3d40bf1e6eb5933cfa97f00a0c0bb59ec552b719e5db81a578948f3b9c16aa37aff0ce349d85dbb980458d8901e6788346b08fafc62754a16a7da1e258266f7c87f3c9d6b4781eefa3db4ea164860f168b2766e1aec0e67a400d41c83242ff1a07854d997e71cbe8b7623b76b6ff974d686c6a47075b8f4c5c788aae0b4a193994cf4a6bfc194d18bac829762027d9f5d44586553230c399ceeba577650c50b96e188c104c1326b212eef94d73548de5634a30d0d43d7d58adae762582d1ba3c3aa26aabb66871ff3ecbe5ed8fcfe64e25ca3dd49b426eb525b826bfa24e84616d40e066c2c5fdfac9bc9b6c1f7959f8eb08aaae850d788639895d7a95ad5ca72dce24a0f00827bf9a3b9ca67561f0263bbc400966fdfdcac86b517e9df8246e338a17bb62a5d6b509d8a0e67e6d5b3fdbee857504ff196b8fabeec2d170a1eab152892b4d5b5b17e6da81bbc3724206ae05638d1c362a56918d6ec9a1726402727470803b6118cc61fee8783085758a1349acad8394e7a4f088b2e7b73b6053a55ce14f8d6c488a6bad1172753223b0ab5c6b9d30804d3ee77959f0579f16b3df11d199596b85d4cf7a429412876bf239eb1d0c2edc6baa73019bcc182e5011786e85fad33b62a1c87fc4adc42bb7036eb354b3144c9121f972b12ba32d940f308504b9d25536228760bce8d65ce18004cab212169b8821862c1e686d4baf46a0dfe0b847edbd01cb1ad9a6f009a18917105badf21237d8a2377a6e4ecd92dda57101a00d3c993edff4dc0805716b95115e7490e6898fd2b9e07595651f70bd81aa2fd7773ca7995a0ada926c246e1c80a98d320ce81feef3ebc172c6b4ef80466e24d242af7325ee82977bd556102a552a8d555bbd069061f03a858fdbbd247be27d49325f4d68e97e11b3cd30bfa604350ca877e20db3070d8f6999e4afaba374331f164f6ff019351bbe7767b6a1da46f37f5940e6c6e1114275d711a1737787849b7ef9c5230daf7851cbaf7bb87de2b58c566287be19522dcff7dd654cd3b81f51cc62654cea22e8d1527c226955b7da36ea95ee050e2cd822f527164f9990dbfe263d4d9a0f807991bcfb301290d1afb5f5c4456baf413f5b77ab46dc2c82bb1115631275a38824093e341bb8a7e3469ce27cf1bff606b47e568ad3d9d6f2c43656e384588e554c940fbe175cc52c59b5e4f0c2e122b8857040c8cb9beaa54a7d3a33a8b92a8f9237d3b6db2a3c87778bd03f7a3b903f013473fac544b46ce5f0fb3272106801d7b9f3ea1a9912005782494ccadc13d841e2246e1b71f98d605903d3f9f48e88c853dcdbeb5eb107024f5641a5017d88febc30dc6929164bc62fe0710c48c4ca8973fb4c9cb5bc24350830659eb5abbf962f8d2c0221155f3143f89fecf36c2bc4a3021b8d10a93e554fd219a14cc5431340716830027a265033a27069bd7f51c1eaa961194f3bb69c09db91e7c19baa4c92c00d0ca88015cb83f057660dea74ef04872fafb4908036d05da7850be754b3c837d2444c3dab9c18f1199f7920b2ef8bdb370ad7a48805dbd1de040b85adbdbadfbe05b83ba6e4a0a2a2f18efbfb5e757ae252e3ab45533d8f710b4bf1a4fee0046693819c3d2785c76a7e59306c4807a6df8fd6a228fdcc7a8a052cf0dd973cd863a89c4342d8cfbef1e625e7ee6aad07928a9b1b86bf6c4223c2ede04ffb8e07cb5b32ccd5d944ffc96693841503d4124106be54a4a122ece7026e39ff50194eb87117973a6e68687dce8834bd73635f4dd207562207a8260652f300fc955d87b1c73185dc5e6b9e420abb81e0028aa7280a0b486da5aa7488364bcfc1c698fc4bd491d7c0521b03a0b4f57014fc18423bc68a8a36a221e5781680601743e7e2ec7c826cafd20333c2f36f2dd0260644593b990318e287ade01eaea5f9d4e4b2f187a3687f872b181e79148bff3f7ab510d09689eb5cd965e80da1d03b57d621c0be7e66675769a0a1e7afd315ae3c15201e3b64e2da0a01b929745fe5eb9e9179b865c9675e54b0fee394813d71a6fbefc06ec89df7bcbf81d209dd6c5fab76d32e75406504f9a0ebdcec7d7386ce45e2f598b94360aa847905f6d3854a77ced785ba2b39959d555ff86a7010b9430469518318efbcb8b4335ae26175a098d27abecb94b67c0b7b20fae07cc94f7139730f7838872bb4ac444388437f9d3266105121560f9c861c81d0fb155934c1e5980191b60cc88280a25660b407438a44445cdbe9bc7a9ac1d26b82ac24ba450270fd25c0c2ffa41cd40fb8b34110986f755cb6bf544c84f8169e9eff66e37e46cc41c259058963bc00e014bfd791ff87c2b851ac556f4d31ccf6f715bf40df06d0744eff9c38b51026adce0487dee50f596c5ce701facb23a1324a274e70c6d69b515deece422f33b50968413ff8516501a8fc15ac3e9a5fb10fcd053ce1d98dc9b6daba93a2936bac36ce917b548a35d96491d6e0c8281403d236631b8cf1575dae28e228060f285a8ce848074d91a7ac0595c6f0bf7ba99b5841d1cc23a72b5c16d9525323be2e3e0dda2f7758563c95a5dc4e12cc2a7e13d7c79d4653af746dcfa6c5f832896d1eef09fb6572837a56b098cb257431ff4f2b8b1d286aa3d7174bb2fef165a0a013c66c7f418242f7caa183021e2d9ee6278f9099b5cbb8c07980a52465fec00d2e616d60c5ffdfc91a5e1882ac208d0471f55129bbf0d33a4d4d43874e7754c6484c560f59a722cb8352e0fed29f6b780395db9f2a8d233f4bf27074c989a7ac424fd843fc3323b85e3eb9dc76f95b4eacc9956780b9ae61369732e77286a4836c53e0095c1303994b481d4211fc4335525b0ae43fb869ab5414c873b0eacae13e78321b4eba1e6a0fc3778f417cb60e0bee0e26baae4881671bce33bead7efc7ca435ad3077997a59d2573e564dc3aa0a2a8b4db6469d39322d5e20afbc51a4840aab4de8be2187fa27fae05b9587e965895f1ab4a976eccbdac88888dd29645a328c00bec03d1e96e3e0697afce1c09af44236ceb2bbb50743da0a2dd3dae229afd21036e832c8129bd7b5c1eb1a41de2a77c69487e578cbac15254b2ea1305ad2aa586c463418972937ff01e8382631caf87bca9fa993c9a912a2fd76bc3f87bc481cb0c3fc989c02b2c4c04e81be4ae04e3e277a79eff92098be66d9", 0x1000) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) [ 3336.053446] FAT-fs (loop1): bogus number of reserved sectors [ 3336.053989] FAT-fs (loop1): Can't find a valid FAT filesystem 15:25:40 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 85) [ 3336.088663] loop4: detected capacity change from 0 to 40 [ 3336.110953] loop3: detected capacity change from 0 to 40 [ 3336.204678] loop7: detected capacity change from 0 to 40 [ 3336.278142] syz-executor.3: attempt to access beyond end of device [ 3336.278142] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3336.279902] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3336.281925] syz-executor.4: attempt to access beyond end of device [ 3336.281925] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3336.284140] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:25:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3336.446052] syz-executor.7: attempt to access beyond end of device [ 3336.446052] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3336.447962] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:25:41 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 88) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:25:41 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendmmsg$inet6(r2, &(0x7f0000001140)=[{{&(0x7f0000000740)={0xa, 0x4e22, 0x8, @empty, 0x401}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000780)="515be391edd75852edbaf14c1964e65ca098b861cfe74a583930e725dd3818013b2863773a997c2ef05be6f0d2c3101d4c644a282865a2894bec9e4a3afe0c9674354cab31d09b5ce3cf1755fde868837618412617c3815caf1fb740143e0744944e12a344def4dd285080ea445dcdba8fbe5d0f92feab85ffbdd073c2476c079d25ee981a5ae53f10febec18b1fe56513b58725c653152850baebcc9cb5aeceeef87549273f2dbf5c34addcb007cc6d4ae15b4ba30015dc7884ec53068592a34fab4f769ee824200bcbebbdfbbf0becd08b6637b42ab3b80ecca9d5bc81f8442542adb24b9f9c79c9d083758b15af", 0xef}, {&(0x7f0000000880)="c0945f65c6000369f14934cfbde0456c8cae8b814fe3354959c3da002b5f217eb90341aa29fcd6f7653f35d7866d56c79298bc656e34bec29001d986af05", 0x3e}, {&(0x7f00000008c0)="ec0018c3e18822e7e6ae93002eb42f44b3a324466223402fd418edb9c29db71057d905ab7d8693a1288ce51b319611f0f6e802dec23ada977ed59b237f0f406337ef737f2438fafbd8568a91e551b9f55d117a36d2b7cab64b3d61f1ffd146389195901625c6cc47da714e1b7d0115684ce614d4d37231092af3162f9ec70f9133b001f689ee1dbc1ad62f493d87d125e3a263b88656dced8d9d429f66b1eaf309f065f58e032c2b7c7f2087ce03818731a531381fcc976c2a61d111b20092f4f385bc4f07923e00d0939729f9f01a6f3b06b872f70c4d1263d93ed3211279f877907539bfc40e055f651b7ca1fde583f8", 0xf1}, {&(0x7f00000009c0)="7d7390652c1a0eec05a379d2b57e272350a90c93f7691fd6d2f82eb6aa33039f879d24263f0a147f9a6324647840dc4f65309964e9633ddc0b1d8049fd2e3257993778e0bb8c7242bbc94e72bfdd335a17f322ff74b7ed9c5fa873b89ed16ca1707f1eebcd9b66a8de4a9be11dc2b30382bf5614f0494af865351d", 0x7b}, {&(0x7f0000000a40)="30edfaf4de2244c2d9d29296433c7f0f677184f32a711d69fa5bc4eddab3d612a4de1eda6e070177a3e9d8fbe5e1b7e14de9b743264fb0d409493c8c9f820e63d6a4068cc1edb79b64859a848ba74d84bb5a89dab76308e00f9f00ab75dc1c33b37b", 0x62}, {&(0x7f0000000ac0)="1bb0d8600473db4c65133c1c95ea7bf9a019e86be223cc61f09760b495448bafcb011f70074d2d631d3823a0d08a4a1c6521ad12521148502c1e551ba1ed202c", 0x40}, {&(0x7f0000000b00)="18e68d11b8c31610fa03a3f08f", 0xd}, {&(0x7f0000000b40)="c8f4c406efd3eff990c084af895c", 0xe}, {&(0x7f0000000b80)="9cfe8ad7848aa7572f2d919db8159313df99835be72f254c6719d98424d8fa66f369759a5fb8b7944d2a93660599609c955c0d8e4f8442081627c2ee2b2cdd030d951d4575cc700dae748d9606ae2add0a68a4863a2482ed2aab5e8aa846b88d7a6b045011a24991c91718d5475e8b09893b92f042f2311820a082f9718d12c6091b83c531189e7afc6bd2d49b5e", 0x8e}], 0x9, &(0x7f0000001180)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x2}}, @hopopts={{0xe0, 0x29, 0x36, {0x88, 0x18, '\x00', [@pad1, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x20}}, @generic={0x1, 0x4b, "21a63e0bceb495c3695bbf9d21b647c6f3bec553a43c44b1daa523332c20fd15b73612d6a881f4cace82f110f003f34799e2e9073eff666365334f8592b5e9c25a663099e40dd070a222d5"}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00'}, @ra={0x5, 0x2, 0x826}, @hao={0xc9, 0x10, @mcast1}, @generic={0xd6, 0x2c, "4493bc561bea4fbaa50fade036f88071078f61916e46c127d88e6aba0e2a166642a4fec7a7e6ec6d5293216c"}, @pad1]}}}, @rthdr={{0x18, 0x29, 0x39, {0x29, 0x0, 0x2, 0x4}}}, @dstopts_2292={{0x100, 0x29, 0x4, {0x67, 0x1c, '\x00', [@ra={0x5, 0x2, 0x7ff}, @jumbo={0xc2, 0x4, 0x5}, @generic={0xd2, 0xd3, "de82f72b004b517bd39b41c312bb31fc4816d8d0fad295cafa997126b711555face51117195b47a5c45e3290ceceb7a25bcf5a5f6dc8afa741c39776011a7fc3e4995485bf27d693bf70c88058786456515f7347d1d676bca9ed230e9431e7636d6c09911ddbb37b05b6682e97c618fb78da345eb6083261b35dfd0145f31073ac20bf231876e5769161d43e736681f737bd3da78d88a6de5e4ba45c42548dbffa0c7abd15b4d7a2a43de75361011f22151dd01e65c21d06b998029bf1eafc2df43883a583e5a601051c2f9e466b64bef6dea1"}, @padn={0x1, 0x1, [0x0]}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x7}}, @hopopts_2292={{0x1f8, 0x29, 0x36, {0x29, 0x3b, '\x00', [@calipso={0x7, 0x40, {0x0, 0xe, 0x99, 0x2, [0x8, 0x6, 0x3, 0x4, 0xb6, 0x1, 0x1]}}, @generic={0x6, 0x197, "d8cce6d8ec53665c4dfa1361ec1f2e85dc1e058c89b419e92a75002edf82a42c2151c0482364a86d49b30d2ea4f6be7380922ef1af6f0443730e909e7c4cdcde3785facfad72fc74a2a1c01a59ce39b2f71448eeee53150b25894e34d690cf7863850f1376d30f941c5b94ea9161aad7ae716c821292c5ae4ed010ced707ea0b359bc9359d18f04e0ba42b63de3bbd44bfb8b407cc982611d77fd0eb106d05af97c0a9e33c4eb7c7346fa7a8d2b9e0c0284da09da5d20c94ad447233696553962ec19ef41b92b6f69155a45c0487abaf11330068a6d81561c90d7544ecd97c2d49b82b9d761211d415cf8fd647c25c1df6205857e5a78594ecbe0dc3d9a6250c294ab7b3d15760f2f79fc122640921ed88f33a64c86ad67cf799d33cea68ce343b651152a1b14e6e5c816092f3bf89c7b6f247954bb18127c1b8df3ed105c5cfcc28ad050b82aed25ce5f1840293814e49b95303f9e8c87c7c22231a8890fb61d79613a700f399e8fac02ca6c800913a8bb80afeef0a2c1ab68e9d273d365cfb40e20c90f91b7c38854ba4b719d97eed817e376f2e8f8f"}]}}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x84, 0x2, 0x1, 0x9, 0x0, [@dev={0xfe, 0x80, '\x00', 0xd}]}}}, @dstopts={{0x98, 0x29, 0x37, {0x2, 0x10, '\x00', [@ra={0x5, 0x2, 0x20}, @calipso={0x7, 0x20, {0x1, 0x6, 0x7, 0xaf7, [0x4, 0x1, 0x3]}}, @enc_lim={0x4, 0x1, 0x8}, @ra={0x5, 0x2, 0xd5ea}, @calipso={0x7, 0x20, {0x3, 0x6, 0x8, 0x3f, [0xf1f, 0x7fff, 0x155]}}, @ra={0x5, 0x2, 0x8}, @ra={0x5, 0x2, 0xe0}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @remote}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}]}}}], 0x4e0}}], 0x1, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) mount$bind(&(0x7f0000000d00)='./file2\x00', &(0x7f0000000d40)='./file2\x00', &(0x7f0000000d80), 0x2024002, 0x0) 15:25:41 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:41 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:41 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 86) 15:25:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x381042, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x81010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) [ 3336.763287] loop4: detected capacity change from 0 to 40 [ 3336.791287] loop7: detected capacity change from 0 to 40 [ 3336.832599] loop3: detected capacity change from 0 to 40 [ 3336.925680] syz-executor.7: attempt to access beyond end of device [ 3336.925680] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3336.927631] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3336.992249] syz-executor.3: attempt to access beyond end of device [ 3336.992249] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3336.994170] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3336.996704] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3337.015167] syz-executor.4: attempt to access beyond end of device [ 3337.015167] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3337.016859] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3337.041621] syz-executor.3: attempt to access beyond end of device [ 3337.041621] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3337.043301] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:25:41 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 87) [ 3337.233134] loop7: detected capacity change from 0 to 40 15:25:55 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:25:55 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getuid() fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r2}, {0x2, 0x1, r3}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r0, {0x5}}, '\x00'}) accept4$unix(r1, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) openat(r1, &(0x7f0000000080)='./file0\x00', 0x4e4b00, 0x2) chdir(&(0x7f0000000140)='./file0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) setxattr$security_selinux(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000240)='system_u:object_r:ppp_device_t:s0\x00', 0x22, 0x3) write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r6, &(0x7f0000000340)=@abs={0x0, 0x0, 0x44a2d628}, 0x6e) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r5, r4, 0x0, 0xfffffdef) 15:25:55 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 88) 15:25:55 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x5) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) clock_gettime(0x0, &(0x7f0000002fc0)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000002ec0)=[{{&(0x7f0000000000), 0x6e, &(0x7f0000000080)=[{&(0x7f0000000140)=""/192, 0xc0}, {&(0x7f0000000300)=""/174, 0xae}, {&(0x7f00000003c0)=""/248, 0xf8}], 0x3, &(0x7f00000004c0)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000000540), 0x6e, &(0x7f00000008c0)=[{&(0x7f0000000200)=""/15, 0xf}, {&(0x7f00000005c0)=""/237, 0xed}, {&(0x7f00000006c0)=""/221, 0xdd}, {&(0x7f00000007c0)}, {&(0x7f0000000800)=""/155, 0x9b}], 0x5, &(0x7f0000000940)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{&(0x7f0000000a40)=@abs, 0x6e, &(0x7f0000001ac0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}}, {{&(0x7f0000001b00)=@abs, 0x6e, &(0x7f0000002e40)=[{&(0x7f0000001b80)=""/176, 0xb0}, {&(0x7f0000001c40)=""/113, 0x71}, {&(0x7f0000001cc0)=""/4096, 0x1000}, {&(0x7f0000002cc0)=""/178, 0xb2}, {&(0x7f0000002d80)=""/153, 0x99}], 0x5}}], 0x4, 0x10141, &(0x7f0000003000)={r4, r5+60000000}) syz_io_uring_setup(0x2de4, &(0x7f0000003040)={0x0, 0xf966, 0x1, 0x2, 0x158, 0x0, r6}, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000030c0), &(0x7f0000003100)) 15:25:55 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 89) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:25:55 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:25:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:25:55 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) readahead(r0, 0x20, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000740)=ANY=[@ANYBLOB="6949e280dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf00000000000000000000000000000000000000000000000000060000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000911cd4d80be45f35bf203e0fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004733b229c04f9c48801d65ddc130174fdae32ee0484cce63889ae86682f6dd04fdbe00cfc5e224b7b0d83e7f411ac03446ce4e7736a05a20bdba54ca457f9aa7c9ccb511c8718f46daf9"], 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) [ 3350.826781] loop3: detected capacity change from 0 to 40 [ 3350.846136] loop4: detected capacity change from 0 to 40 [ 3350.870599] FAT-fs (loop1): bogus number of reserved sectors [ 3350.871106] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3350.876005] loop7: detected capacity change from 0 to 40 [ 3350.903521] bio_check_eod: 1 callbacks suppressed [ 3350.903533] syz-executor.3: attempt to access beyond end of device [ 3350.903533] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3350.904882] buffer_io_error: 1 callbacks suppressed [ 3350.904891] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3350.964672] syz-executor.7: attempt to access beyond end of device [ 3350.964672] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3350.965556] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3350.974192] syz-executor.3: attempt to access beyond end of device [ 3350.974192] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3350.975285] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3350.977271] syz-executor.4: attempt to access beyond end of device [ 3350.977271] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3350.978173] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:25:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:26:09 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 89) [ 3365.075440] loop4: detected capacity change from 0 to 40 15:26:09 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x40301, 0x0) fallocate(r3, 0x0, 0x4, 0x1) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendfile(r4, r0, 0x0, 0xfffffdef) openat(r3, &(0x7f0000000040)='./file1\x00', 0x2, 0xa) 15:26:09 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r4}, {0x2, 0x1, r5}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r2, {0x5}}, '\x00'}) accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) openat(r3, &(0x7f0000000080)='./file1\x00', 0x0, 0x10c) sendfile(r1, r0, 0x0, 0xfffffdef) 15:26:09 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:26:09 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 90) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:09 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) read$hiddev(0xffffffffffffffff, &(0x7f0000000740)=""/2, 0x2) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:09 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3365.167316] loop3: detected capacity change from 0 to 40 [ 3365.189126] loop7: detected capacity change from 0 to 40 [ 3365.203937] FAT-fs (loop1): bogus number of reserved sectors [ 3365.204942] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3365.291660] syz-executor.4: attempt to access beyond end of device [ 3365.291660] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3365.293563] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3365.300676] syz-executor.3: attempt to access beyond end of device [ 3365.300676] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3365.302619] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3365.348641] syz-executor.3: attempt to access beyond end of device [ 3365.348641] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3365.352260] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3365.363089] syz-executor.7: attempt to access beyond end of device [ 3365.363089] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3365.365038] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:26:10 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 91) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:10 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:10 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 90) 15:26:10 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) [ 3365.693046] loop4: detected capacity change from 0 to 40 15:26:10 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, &(0x7f0000000740)=0x4, 0x4) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3365.822421] loop3: detected capacity change from 0 to 40 [ 3365.832010] syz-executor.4: attempt to access beyond end of device [ 3365.832010] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3365.833661] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3365.866997] loop7: detected capacity change from 0 to 40 [ 3366.016872] syz-executor.3: attempt to access beyond end of device [ 3366.016872] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3366.018381] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3366.045081] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3366.054834] syz-executor.7: attempt to access beyond end of device [ 3366.054834] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3366.056847] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3366.086890] syz-executor.3: attempt to access beyond end of device [ 3366.086890] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3366.088296] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:26:24 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) 15:26:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@multicast1, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000a40)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @private1}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r4}}}], 0x28}}], 0x1, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, 0x0, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x80000000}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x44) fchown(0xffffffffffffffff, 0xee01, 0xee00) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, r5, 0x0) sendfile(r6, r0, 0x0, 0xfffffdef) 15:26:24 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:26:24 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:26:24 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:24 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 92) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:24 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 91) 15:26:24 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') newfstatat(0xffffffffffffff9c, &(0x7f0000000740)='./file0\x00', &(0x7f0000000780), 0x6000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3380.281369] loop4: detected capacity change from 0 to 40 [ 3380.341996] loop3: detected capacity change from 0 to 40 [ 3380.344148] loop7: detected capacity change from 0 to 40 [ 3380.353587] syz-executor.4: attempt to access beyond end of device [ 3380.353587] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.354621] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3380.356672] FAT-fs (loop1): bogus number of reserved sectors [ 3380.357575] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3380.426490] syz-executor.7: attempt to access beyond end of device [ 3380.426490] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.427486] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3380.455318] syz-executor.3: attempt to access beyond end of device [ 3380.455318] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.456315] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3380.508666] syz-executor.3: attempt to access beyond end of device [ 3380.508666] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.510669] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:26:25 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 93) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:25 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:25 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0xfffffffffffffde3, 0x0, 0x0, 0x10, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:26:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 92) 15:26:25 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3380.599148] loop4: detected capacity change from 0 to 40 [ 3380.637174] loop7: detected capacity change from 0 to 40 [ 3380.654238] FAT-fs (loop1): bogus number of reserved sectors [ 3380.654818] FAT-fs (loop1): Can't find a valid FAT filesystem 15:26:25 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r4 = memfd_secret(0x0) preadv2(r4, &(0x7f0000001740)=[{&(0x7f0000000740)=""/4096, 0x1000}], 0x1, 0x1ff, 0x6, 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, @perf_bp={&(0x7f0000001780), 0x5}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) [ 3380.733932] syz-executor.7: attempt to access beyond end of device [ 3380.733932] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.734933] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3380.736686] loop3: detected capacity change from 0 to 40 [ 3380.738872] syz-executor.4: attempt to access beyond end of device [ 3380.738872] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.739763] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:26:25 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 93) 15:26:25 executing program 0: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3380.849772] syz-executor.3: attempt to access beyond end of device [ 3380.849772] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3380.851020] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3380.960015] loop7: detected capacity change from 0 to 40 [ 3381.116262] syz-executor.7: attempt to access beyond end of device [ 3381.116262] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3381.118208] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:26:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) 15:26:25 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 94) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:25 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:25 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:26:25 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:26:25 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 94) 15:26:25 executing program 3: stat(&(0x7f0000000600)='./file1/file0\x00', &(0x7f0000000640)) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000bc0)='\x00', &(0x7f0000000c00)=""/203, 0xcb) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x200000, 0x0) ioctl$KDFONTOP_GET(r6, 0x4b72, &(0x7f0000000b80)={0x1, 0x1, 0x0, 0x14, 0x13f, &(0x7f0000000780)}) [ 3381.356904] loop7: detected capacity change from 0 to 40 [ 3381.366659] loop4: detected capacity change from 0 to 40 [ 3381.385942] loop3: detected capacity change from 0 to 40 [ 3381.470650] syz-executor.7: attempt to access beyond end of device [ 3381.470650] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3381.472431] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3381.511643] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:26:26 executing program 0: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendmmsg$inet6(r2, &(0x7f0000001140)=[{{&(0x7f0000000740)={0xa, 0x4e22, 0x8, @empty, 0x401}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000780)="515be391edd75852edbaf14c1964e65ca098b861cfe74a583930e725dd3818013b2863773a997c2ef05be6f0d2c3101d4c644a282865a2894bec9e4a3afe0c9674354cab31d09b5ce3cf1755fde868837618412617c3815caf1fb740143e0744944e12a344def4dd285080ea445dcdba8fbe5d0f92feab85ffbdd073c2476c079d25ee981a5ae53f10febec18b1fe56513b58725c653152850baebcc9cb5aeceeef87549273f2dbf5c34addcb007cc6d4ae15b4ba30015dc7884ec53068592a34fab4f769ee824200bcbebbdfbbf0becd08b6637b42ab3b80ecca9d5bc81f8442542adb24b9f9c79c9d083758b15af", 0xef}, {&(0x7f0000000880)="c0945f65c6000369f14934cfbde0456c8cae8b814fe3354959c3da002b5f217eb90341aa29fcd6f7653f35d7866d56c79298bc656e34bec29001d986af05", 0x3e}, {&(0x7f00000008c0)="ec0018c3e18822e7e6ae93002eb42f44b3a324466223402fd418edb9c29db71057d905ab7d8693a1288ce51b319611f0f6e802dec23ada977ed59b237f0f406337ef737f2438fafbd8568a91e551b9f55d117a36d2b7cab64b3d61f1ffd146389195901625c6cc47da714e1b7d0115684ce614d4d37231092af3162f9ec70f9133b001f689ee1dbc1ad62f493d87d125e3a263b88656dced8d9d429f66b1eaf309f065f58e032c2b7c7f2087ce03818731a531381fcc976c2a61d111b20092f4f385bc4f07923e00d0939729f9f01a6f3b06b872f70c4d1263d93ed3211279f877907539bfc40e055f651b7ca1fde583f8", 0xf1}, {&(0x7f00000009c0)="7d7390652c1a0eec05a379d2b57e272350a90c93f7691fd6d2f82eb6aa33039f879d24263f0a147f9a6324647840dc4f65309964e9633ddc0b1d8049fd2e3257993778e0bb8c7242bbc94e72bfdd335a17f322ff74b7ed9c5fa873b89ed16ca1707f1eebcd9b66a8de4a9be11dc2b30382bf5614f0494af865351d", 0x7b}, {&(0x7f0000000a40)="30edfaf4de2244c2d9d29296433c7f0f677184f32a711d69fa5bc4eddab3d612a4de1eda6e070177a3e9d8fbe5e1b7e14de9b743264fb0d409493c8c9f820e63d6a4068cc1edb79b64859a848ba74d84bb5a89dab76308e00f9f00ab75dc1c33b37b", 0x62}, {&(0x7f0000000ac0)="1bb0d8600473db4c65133c1c95ea7bf9a019e86be223cc61f09760b495448bafcb011f70074d2d631d3823a0d08a4a1c6521ad12521148502c1e551ba1ed202c", 0x40}, {&(0x7f0000000b00)="18e68d11b8c31610fa03a3f08f", 0xd}, {&(0x7f0000000b40)="c8f4c406efd3eff990c084af895c", 0xe}, {&(0x7f0000000b80)="9cfe8ad7848aa7572f2d919db8159313df99835be72f254c6719d98424d8fa66f369759a5fb8b7944d2a93660599609c955c0d8e4f8442081627c2ee2b2cdd030d951d4575cc700dae748d9606ae2add0a68a4863a2482ed2aab5e8aa846b88d7a6b045011a24991c91718d5475e8b09893b92f042f2311820a082f9718d12c6091b83c531189e7afc6bd2d49b5e", 0x8e}], 0x9, &(0x7f0000001180)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x2}}, @hopopts={{0xe0, 0x29, 0x36, {0x88, 0x18, '\x00', [@pad1, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x20}}, @generic={0x1, 0x4b, "21a63e0bceb495c3695bbf9d21b647c6f3bec553a43c44b1daa523332c20fd15b73612d6a881f4cace82f110f003f34799e2e9073eff666365334f8592b5e9c25a663099e40dd070a222d5"}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00'}, @ra={0x5, 0x2, 0x826}, @hao={0xc9, 0x10, @mcast1}, @generic={0xd6, 0x2c, "4493bc561bea4fbaa50fade036f88071078f61916e46c127d88e6aba0e2a166642a4fec7a7e6ec6d5293216c"}, @pad1]}}}, @rthdr={{0x18, 0x29, 0x39, {0x29, 0x0, 0x2, 0x4}}}, @dstopts_2292={{0x100, 0x29, 0x4, {0x67, 0x1c, '\x00', [@ra={0x5, 0x2, 0x7ff}, @jumbo={0xc2, 0x4, 0x5}, @generic={0xd2, 0xd3, "de82f72b004b517bd39b41c312bb31fc4816d8d0fad295cafa997126b711555face51117195b47a5c45e3290ceceb7a25bcf5a5f6dc8afa741c39776011a7fc3e4995485bf27d693bf70c88058786456515f7347d1d676bca9ed230e9431e7636d6c09911ddbb37b05b6682e97c618fb78da345eb6083261b35dfd0145f31073ac20bf231876e5769161d43e736681f737bd3da78d88a6de5e4ba45c42548dbffa0c7abd15b4d7a2a43de75361011f22151dd01e65c21d06b998029bf1eafc2df43883a583e5a601051c2f9e466b64bef6dea1"}, @padn={0x1, 0x1, [0x0]}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x7}}, @hopopts_2292={{0x1f8, 0x29, 0x36, {0x29, 0x3b, '\x00', [@calipso={0x7, 0x40, {0x0, 0xe, 0x99, 0x2, [0x8, 0x6, 0x3, 0x4, 0xb6, 0x1, 0x1]}}, @generic={0x6, 0x197, "d8cce6d8ec53665c4dfa1361ec1f2e85dc1e058c89b419e92a75002edf82a42c2151c0482364a86d49b30d2ea4f6be7380922ef1af6f0443730e909e7c4cdcde3785facfad72fc74a2a1c01a59ce39b2f71448eeee53150b25894e34d690cf7863850f1376d30f941c5b94ea9161aad7ae716c821292c5ae4ed010ced707ea0b359bc9359d18f04e0ba42b63de3bbd44bfb8b407cc982611d77fd0eb106d05af97c0a9e33c4eb7c7346fa7a8d2b9e0c0284da09da5d20c94ad447233696553962ec19ef41b92b6f69155a45c0487abaf11330068a6d81561c90d7544ecd97c2d49b82b9d761211d415cf8fd647c25c1df6205857e5a78594ecbe0dc3d9a6250c294ab7b3d15760f2f79fc122640921ed88f33a64c86ad67cf799d33cea68ce343b651152a1b14e6e5c816092f3bf89c7b6f247954bb18127c1b8df3ed105c5cfcc28ad050b82aed25ce5f1840293814e49b95303f9e8c87c7c22231a8890fb61d79613a700f399e8fac02ca6c800913a8bb80afeef0a2c1ab68e9d273d365cfb40e20c90f91b7c38854ba4b719d97eed817e376f2e8f8f"}]}}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x84, 0x2, 0x1, 0x9, 0x0, [@dev={0xfe, 0x80, '\x00', 0xd}]}}}, @dstopts={{0x98, 0x29, 0x37, {0x2, 0x10, '\x00', [@ra={0x5, 0x2, 0x20}, @calipso={0x7, 0x20, {0x1, 0x6, 0x7, 0xaf7, [0x4, 0x1, 0x3]}}, @enc_lim={0x4, 0x1, 0x8}, @ra={0x5, 0x2, 0xd5ea}, @calipso={0x7, 0x20, {0x3, 0x6, 0x8, 0x3f, [0xf1f, 0x7fff, 0x155]}}, @ra={0x5, 0x2, 0x8}, @ra={0x5, 0x2, 0xe0}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @remote}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}]}}}], 0x4e0}}], 0x1, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) mount$bind(&(0x7f0000000d00)='./file2\x00', &(0x7f0000000d40)='./file2\x00', &(0x7f0000000d80), 0x2024002, 0x0) [ 3381.597320] syz-executor.4: attempt to access beyond end of device [ 3381.597320] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3381.599249] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:26:26 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 95) [ 3381.713733] loop0: detected capacity change from 0 to 40 [ 3381.810779] loop7: detected capacity change from 0 to 40 15:26:40 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 95) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3395.413856] loop3: detected capacity change from 0 to 40 15:26:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:26:40 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='./file0\x00') perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$binfmt_aout(r2, &(0x7f0000000300)={{0xcc, 0x1, 0xff, 0x354, 0x81, 0x8, 0x93, 0x6}, "cf1d71de8abab58d49ba3da7038ccb28e9b4923b1b52961030ddb2c4b5798cb760e58b454d89fcb0157f0fcdcb3ea9f8fda62e570e4b03552e767bdec6ecac9dc1bbe0daf255509124b9c67acfa8127dd433bbbe92324f", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0xa77) sendfile(r1, r0, 0x0, 0xfffffdef) 15:26:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x39}, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r3, &(0x7f0000000000)='./file1\x00', 0x14002, 0x1) sendfile(r3, r0, 0x0, 0xfffffdef) close(r0) 15:26:40 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:26:40 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:40 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000007c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="01800000000000002e2f66696c653000ac7633f85a113761df9765fdda5130b61350e6a9416eb49b7de28359bdd21770aa7271bf2c32743378d42979e7ecbd36976fc4dad88d"]) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) 15:26:40 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 96) [ 3395.422131] loop7: detected capacity change from 0 to 40 [ 3395.423976] loop4: detected capacity change from 0 to 40 [ 3395.428454] FAT-fs (loop1): bogus number of reserved sectors [ 3395.428903] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3395.504154] bio_check_eod: 4 callbacks suppressed [ 3395.504169] syz-executor.3: attempt to access beyond end of device [ 3395.504169] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3395.505784] buffer_io_error: 4 callbacks suppressed [ 3395.505793] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3395.510966] syz-executor.4: attempt to access beyond end of device [ 3395.510966] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3395.511954] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3395.527128] syz-executor.3: attempt to access beyond end of device [ 3395.527128] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3395.528428] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:26:40 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3396.277274] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:26:54 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 96) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) 15:26:54 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:26:54 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:26:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x4042, 0x8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101000, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0xff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f00000001c0), 0x1}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2, 0x0, 0x0, r5}) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) ioctl$SG_GET_RESERVED_SIZE(r6, 0x2272, &(0x7f0000000040)) fchownat(r1, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x100) sendfile(r4, r0, 0x0, 0xfffffdef) 15:26:54 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:26:54 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 97) 15:26:54 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3409.784836] loop4: detected capacity change from 0 to 40 [ 3409.810657] loop7: detected capacity change from 0 to 40 [ 3409.817753] FAT-fs (loop1): bogus number of reserved sectors [ 3409.818185] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3409.842064] loop3: detected capacity change from 0 to 40 [ 3409.853414] syz-executor.4: attempt to access beyond end of device [ 3409.853414] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3409.854280] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:26:54 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 97) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:26:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a97107745000000000000000000"], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3410.010089] loop4: detected capacity change from 0 to 40 15:26:54 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) 15:26:54 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 98) [ 3410.119621] syz-executor.4: attempt to access beyond end of device [ 3410.119621] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3410.120767] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:26:54 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_TDLS_OPER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010029bd7000fbdbdf255100000055d50800", @ANYRES32=r3, @ANYBLOB="0c0099000800000043000000"], 0x28}, 0x1, 0x0, 0x0, 0x4004080}, 0x20040051) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r5, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0xf7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x80000000, 0x0, 0x0, 0x2, 0x4, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r7, r4, 0x0, 0xfffffdef) [ 3410.234949] loop7: detected capacity change from 0 to 40 [ 3410.347305] syz-executor.7: attempt to access beyond end of device [ 3410.347305] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3410.348255] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3410.625167] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:27:10 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 98) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:27:10 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = semget(0x0, 0x4, 0x23c) semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000000)=""/200) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000180)=0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f00000001c0)={{0x2, r2, 0xffffffffffffffff, 0x0, 0xee00, 0x6}, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x891c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {r2, 0xee01}}, './file1\x00'}) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r4, r3, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x809c0, 0x0) tee(r5, r6, 0x68, 0x4) 15:27:10 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:27:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000000000)="39fe85535e00df77df050ac31bef579655cd034a41b0eae8055fe3deb0feccc310e8a1088a9a67844a132bb81e0d3ad663b47584374bba8e635294a834c0769005e4ff83651537c12dd9488b19ac79644027cb75ab79fccba0d3833ddbeafeac5ecc159afb015dbc16157803e42144ed6c", 0x71}, {&(0x7f0000000140)="272b585d426800917393fc3a4bcb66282e54c642a42a9daece62904bd3a14f9dc0fb94df032baedd85c63364b13e5d7050b221734598056e5fb89ca53a75bdbb77ef99367a283e8f698ae7eab4fb0f0b4114b4c4e1b71f2b5044c49f3d762a", 0x5f}], 0x2, 0x7fffffff, 0x9) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r1, 0xc0709411, &(0x7f0000001400)=ANY=[@ANYRES64=0x0, @ANYBLOB="07000000000000000200000000000000f2000000000000000900000000000000000100000000000000f03f00000000000000000004000000090000008100000005000000000000000180000000000000ff7f0000000000000001000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ccea3d9a07289fc6679ebc94a67d699dd8a7cfaf8ed3741ea8996a8c31af599391f90eb1ae96c562492e296778a61"]) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000140)={@loopback, 0x7}, 0x20) setsockopt$inet6_buf(r5, 0x29, 0x6, &(0x7f0000001300)="48fcc89e8b98aa2072d8031b1e6886c510e91fb539b01a33dab19b822c1bd127e329f0b208f25be7847ff1bf7a42172a4e862e3801fe9b2f4cb81a5affad78d007208429a54aed5d6d4dd025fba3cd79d7368d206fb8bf39d259123aa394d6443a9aa95dc4e325444dee541daca542b2a1e97ed85aa55c684c20fb8dc4ef95ad6fdb52af4079a727ebb1bee39f868277fd25e240a1aa40f2551b7c3c11b772b49800259cf71146fb1c7d0e940bd04a6014f9445c4ccfec2d0fe60d8725eddc95bdd6e5099eaec8f993263bb296d4f9506e27a2ca4350ae07f3f5726b593fccb8ca1fa46e11ee9fe43af8051f1c6732bd4e7e1e", 0xf3) bind$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e23, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c) ioctl$BTRFS_IOC_TREE_SEARCH(r2, 0xd0009411, &(0x7f0000000300)={{r4, 0x8, 0xfffffffffffff973, 0x4, 0x2, 0x81, 0x8e4, 0x7bd1, 0x401, 0x0, 0x200, 0xfffffffffffff801, 0x800000000003, 0x4, 0x402}}) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x40, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) sendfile(r6, r0, 0x0, 0xfffffdef) 15:27:10 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) 15:27:10 executing program 0: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:27:10 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 99) 15:27:10 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000740)={0x1, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) write$cgroup_pressure(r2, &(0x7f0000000280)={'some', 0x20, 0x38, 0x20, 0x608}, 0x2f) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3425.530749] loop7: detected capacity change from 0 to 40 [ 3425.535210] loop4: detected capacity change from 0 to 40 [ 3425.543167] loop3: detected capacity change from 0 to 40 [ 3425.546104] loop0: detected capacity change from 0 to 40 [ 3425.554834] FAT-fs (loop1): bogus number of reserved sectors [ 3425.555614] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3425.692664] syz-executor.7: attempt to access beyond end of device [ 3425.692664] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3425.694510] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3425.700097] syz-executor.4: attempt to access beyond end of device [ 3425.700097] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3425.701763] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3425.744738] syz-executor.3: attempt to access beyond end of device [ 3425.744738] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3425.746301] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:27:10 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 99) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:27:10 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 100) 15:27:10 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a971077450000"], 0x154}}, 0x0) 15:27:10 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) [ 3426.010701] loop4: detected capacity change from 0 to 40 [ 3426.020678] loop7: detected capacity change from 0 to 40 15:27:10 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(0xffffffffffffffff, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:27:10 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x101042, 0x40) sendfile(r1, r0, &(0x7f0000000740)=0x7f, 0x80) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) r5 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_TREE_SEARCH(r5, 0xd0009411, &(0x7f0000000780)={{0x0, 0x5, 0xa8, 0x4, 0x9, 0x9, 0x3, 0x4, 0x6, 0x8, 0x4, 0xff, 0x80, 0x7ff, 0xe652}}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000001780)={0x0, r7, "7f1a7fd085f010971f2770cfcbddbe11c6aab1aaee56696d2a725f125406377e485f930ceabba60f377dd501db86b2cdf575d3f493f36f95cce0e96c145a0385e2c205f32b61a74e068bbbe8564ce06dc42cae0c5ace9eda7215bc96be08f4adf3e7b6dcd23ef216d2806199c072801bdb7bcdee20e02309c4c26eeeb35a4646847ea13aaa5434c07a5a82b220fdedbbd6375f5c32a0cafb4d8f5c25cad61b842553148b6441ab4f607a778ab67d380a6b35f407688ae78938445d48cf1a641845319e312db3f955e6a547e70369b70e523b1fbe02c4e800307868da3781d4c4358ecb25ca76d4159528c398c30dd8f7884c3f658cc59630b92b9a70ce938200", "b51c11200b9e6b09dc9ff1de73c6f50f5c0d09fe5c729620ea7993fb9b629e9ad93a30d02dedd388a1297110dc479e18b2d494c9e31c7d7f02d0ced2e8092be43fda8779dd060573ac416e5107e73f83ed3613c8d24163dabdcbaa82d4303e108706bd91568f87c0e8903893032f425fe374029ea68c3b8f450543d2a118dba95fad6a45d7f9aff7e75c5cc5ea922ee3ab0e0d90aef22a99af8eb18c6190835fa1c73692bde091c23678d3a08f1371d7936a75b2e44bba9d71618f312678dd583d74222492a5d9009269da9efc98354967dde1b7fb2f6d6d2876cc8626ff1e845b558dbc45659d8c148368613c3728bbb2f54b4919105b7e3befb147b32d435d03b808dfbf450200d93d9b429c77b12642bf931a94d359f35ae8e7744f9b45c07654eed5c9481941406b382a8771b904fe208d53089178aa167c2f238756989f233969da8f30b2135e7eb6af0072f6d8c83b89a4b89d92989c74307fd122670f08dd46aae8fab232a69a8abc497ee1e8ffdd702bbcc9ee9a15efc8b7dc62c24e499e1a12d524613c6bcbb810c717eccf3c531d0012b8e31b0b425fe1a7ac97210f0db55c963aad12effb6f1e518d3e8fb96f651004d39d28803f6d809477c94ea9d15c8c8565ad535ee3e1ab0ca145cb791e972ce85514c7b3ecaf21227a396ff4bc12a13155b11f8e2663875d5e5e7ab7fc20880ad5c1c257ea9fed87904cb41ff4a09aa99388e634b927bcb3e8224ac58d9f911804a24bcff3a1b488ce16e354f5b8e900391a40f7c3a0f5c78abb04c23b3def0541b1f478c140fc5f163ddecf74f5a2e83155116d245427abd395fe2be8cf9a93bacb23e2f101b6a48d28abf4da5b954223a66e388e52a445c631c31c12dba31d7f1a9dac3996251ee718bb2330ad9d188f5290c38600a4fe7a7b7523dd67fe2f53a3640d3a9ea01af2fc2ba9c3ccfa06172c905d7a9366c9e62f845822d5889ef9156bde9a7e434f8f9ec5967600bb9f8b9486b9b9d370afd6d6adc2ac700319c0f5f259a1b583c4e74ba579e3636f25984cfb2310b19ab3515de57d024cc0935cef61ae3fb3c417e0bdff42ed8ede699b97f83b2a8b2f00f867df1e95a784e66430f947c4ea4e3491415fbfe7b13237f10434b4aa929e4cbd177ec135adb3186ea743b6c34ac6f4e50f175950f88254a3cdc578e1227c3488d1f0d41abe0fb344af90001f6b0754ef3098b634c88fdf95baa4607d349d2e56b46a6b88f4f0689b1700571f02a2408b86a7180be7a4ec37c05a08e4641e97d8eb17dcb084b62f903a680cf3aa87fa971a9eae8db7f62ee16601e2c3ea9e1210cbc5663368849798b0c8048df9648930f638619ecdbe82502cbb066856c7c131789ea306a2bc858e26a9768170afd372251f4bddbe46287afd60bd11b27d9bb0b687f897e3752708b4583d83f159464b726cf2335ee3fa416fde5c1d5e04525570776ea7fd92b107c31838a8aa1fa6ca4711b07b212ce993b88fdc296ff6f0795dba7d57149a874cb9b82164ccb418862d0c3ad3d7df09ca8d356a1a4aa7255360c6137ad80258166524b017ceaa0d803cf0e474b467a23c2be44928db1eef773af62656c6e09382e08a970231bc6b443a08602371f52983dc0ec4f815c92dfb8f49e255faede59d2b381c01000000d5b6ba8bd2536de884a1a78c601a555b8f9646877e274ab1f90448f3e47a8f2b3bbcc09fc2c8aaa83e07e85657313f2bbaf4134b3d42eb3d9dedd8f59d8e75afdaed9bce51a4ba4cd71ee92f76256f2a4ee848fdb3dbed99cbdf0b9b5bb2cd6f97db604bc491ea8d539911d2d1eabb4076cfca8fc8bbfcdc0fac4d78db60ae94f11b06ee6f629d1e458e7cd10b195af57d7709bd217f3aecdf85113092ac33dd3b1fd69ee1c63932d447ddc8d2fe7f06766cab0e86946a3bf82b3c751ede6287e353a2b3a158429df00fa04f3b47cea3755f5b868bf99bcbd33572a9337610b030d7f9ded789fdd198b7953429a07e7a83c2fc3e0dd68963d1c692d10ebf0aaf3c12e999dbd84e90b363a31a3fc5154c06c68bd54ae107b29715a2c6f8676f458c284c7a4f0e06e06c9e65c62782a8e5e0a5274893b23146c03f5f0858fa72cab2610c1e32e12e22fdf8f6bd59bb264d9af1c94c5208d34b863f2bddd9fd1f0644ed96d5b5a90acf00ccc2cf86f9c4dd3a5c4294b34929833d1b9d9ecb3673eb36af31695d863e4d09cbb2b6cfa222e00d8fbf0c902ce72b44ef04fe42bbeccd1b9dc2e67c67a7b5ea404322e30f47e394c2176e8257ee42e62c8560ba2c45ca78e25ede6d698facaad68859d42231b8f75ac249b1340a4a61084749fa5aee98ea8610d7a7b7e32e8362129b182a678a0deb5450f27211498b50d8f901deb904a790fcd015ece054f10631ac1cb5e45d0f03266472dd3065f5d813bbe8e9d29689f7aaff89b18443dd7c5fcaa21757e67f824ea34030a288c1f63668f8e4eeec20e9054bba89dcb423cf03571d22276d5afb4462181fc7cc4e36143f9f1df0fb04557d9ca0bff058ed2ecc8bf72f58af9c8a7515fcff5b04d449c0a6491525009afbfc055c5ef2678b2572f5d00a612ddf49fa6eac49c4db3ae2c04f454451fccda95e11b14b78be4a2e1e7a23b1e53bb5639a75c26a017294f5db9ed4b07fdfbff40edcff6ce441dbf7fe564b756cbb9a4372279a69469f58f84f63b983b723d3fe4831ac4e5250d8deda536354506b0ff3433157e2a4c2b49593a5484c07a2a9e48936172ca5e5916819abf780e52f70539e83648028d87f2d7c4f8b7e3dc7b1b1b7c7bcb57b217496274e02b78c47f5e57d36f9257d57784f259341b2c787be7861262c3e013a3f562b6009765f71af1c27122243ecad7bb6a0121627d1648044951f3a67b07a2ff2505404b46af6c18f2bc77ea771886e8ff5c4f36774e5d7e904c42303e0c7a23a10e828f1fb05a5c24390b78da4b2a7ea2ecbef42d5138fec672c50db6bc2d4319f190b6b92ecee97f5b11a8596fffe750cf87842b729294c394f1fcc39023f56c46198998eba3c0288c12629f0215d7996ca8dbe61a26acbadcfaed9b6506a0baf1f06db63c4b2930bd95e937a973fdddc1c0e50226b08d2dabf99fe988f02f7b776b490309b65c0520b8d056f8c1117c8d4d73d4b5d12cf310bedf42cd3af08865172bd36352173fb68fcc6ffdc29bbe021a9f05076ce06bc25eedc5401ba8beb3dbda83cd47212c953983d888c8b18502c3fc27b0701acec3dff0297deb4ac63bdc8fb85e167a7a807fd6bcca65343ae393dd74af4ee6c8fb47902ea4e04cd5a97db4a4df367268d44f5c68ba1bed8a208cd17de1beeab0dfd199442c781ab424bed16b02f0fd44e804c18a7baf8e8703f37fb6696426c3496710bdd832dca000328d1f254b49e62354f7bd00e4c00fd0e77bd9928b53807e51f18917b47d06f67d5eeec41ec653a591872b5f1322a5bf46358d8316d11a5bc24d752c4c65d57ffcdf38cd7cfa3489c299a712c85de968c26336ff090739c527871464a83106e134a43f8e6a184f6cc75349385cbff6b40d42ae00a336aa5a7b74e16d8bb040f4476f95c606a11371307939f08964d30338ac44be6b8fb49e07f3e2319f5a5c348ad24f2ec5aa03051be27db170b30fcef3c06c236921e6f65bd788c403d7a91b1f0ca1f40d96ba288daf65a639e2a619c4aa2d10b6cc84cb982f600cbf8ea39ac7e2c898d3816be2f410641bd7e22bd5973bf7b3174a5f489e7fc92d7ad493d75f3a2f228266d33b23de2934c12238ef46a9cb6c93eb9638638304273485ce825ff72c33febf8c9bf73c4cb3865759b5fa9aa027c2d53918b3484348923d244665ff545c7c863c2bf41bad65139d256d042851db52408f36769639db1834a402e26b5eeacf21934c37b6893a4c41adafbd2abe663b24e54a5a52c84fd907b1e721c38ee939e3e44033b31e656b597211d949865653244d1d1129f22a1004ec4e4c3ba60b0a60a07d6e5eeca3531bd799a85f98204bb8cac1d45ebfa8a1f92816fac723be4aa8e876b2cbd55b6fc1d9b3ba14141ed46969091642ef815ee89681e448776441e351ce5f70b838ce34816786efa348b3a2554bd32d9e4f56ae1e08654f9a0e2d81cadf1f5b3a2e61a5b827b4c3e96e094b522adb42831981a6cbb693eb8901eefcbfd584cc4d1014ceb64b53cdd8db2eaf9f6e254b58c4de3a7c189765ada12517cd4dea3dc3f2d7293117b62c68c8733fdfa33ca1f3d041b3ad67ea134d9d254863e43e23a71e9b28058b7ecc0dda3e5faff54dc0ce3db743481b0eabfecd2c8eda86d175b1eb627ec6f82caf5695ca443fa68da8ef6adb30d97ee11207035097ae1fb6c84cca77f96dbeb1833abf123435d7f482c394e459fd1c3de7ddf2389b2582251d970c68a8bd356998d7d6e4f4f353fba439510ba0b621135fea1bdf2e38f6e2f4068159c231a247931a690c49c61e68e2b6a7713e50df0f02667d01c8c1630330147826a6a81f4df60ac0c73456b7f6f4c373dfda30f8bd0c27b09060c10c4fde63c85804f4c8fc9eb8597e3e2c66bc6c9a82837e995730a70a1003548f18b4eb74506bbdb36b4ec76af67af37165e6b5027aa2e411b58fe188bb80c777325adba459aa65829b0ffc99caeba7218a74548510f932b5aec3b1a265a78dcf24ce441886c52ce780fbc32c067033b23b0df2f7f0addda742fd6953dfce24b5f093650f2c0c501a006df9d0a5806d8e7dcd0fe68209aa46fc5e19272dd57fe4ed6d60141a8fdef8e88211cac93527171a0994ba8dc29f6aa9a63d4f0d150bc3847a537dd270381ad4340143a473efb8bed4f5537aa4115be1f65a21bd888bdfedf981083a8d67c8fc7fadbc189b2ae27bf38f0fdfce7aeb48759c606ddc9a22b9c247a5a40214d8d8354e33203217c8cd3d8731102fe06dd1651a6eb1d665b11ce8bddeb5028552fe9d3636b6537fb6f7e1cce48f82a5544b43683681814646048f785bde2146cf9ac76eee38911583b4526f9a5a950e336b762eac292900e28a4f529f01398098535ff8d97fa391bb9327957d59ae7b5940597ef2fba9ace5a61b5fa6a56897f0f4e012b1b7c40c585d1f2e8d04a77b2c27eaac59809ade2e5cab84532ead084635c97a97f1a4b6f5a6d8dfeedb02bc8e4f8e5c55fa7fc2dff674e4d5940cb3a161bcf6c4ed2cdbc4004ef25ceb8121cb55835645897c7872774fad9966fa6229b56fe700a0d36492af7c86cf1bdd0f3fc5f0e1cad55325845af75eda6622b8799171d7dddfbb2954b489f4497b04c0a1aa2c69b67c4a57c1062304b6801beb245bb6db46b5f1cd5aaeecfa27c635d7c7b546c70c1c32482bba61500"}) read(r6, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r6, &(0x7f0000000700)) [ 3426.256956] syz-executor.4: attempt to access beyond end of device [ 3426.256956] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3426.258937] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3426.299237] syz-executor.7: attempt to access beyond end of device [ 3426.299237] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3426.300999] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:27:11 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) (fail_nth: 100) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3426.352675] loop3: detected capacity change from 0 to 40 15:27:11 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(0xffffffffffffffff, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3426.413745] loop4: detected capacity change from 0 to 40 [ 3426.436918] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value 15:27:11 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:27:11 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) [ 3426.524622] syz-executor.4: attempt to access beyond end of device [ 3426.524622] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3426.525913] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:27:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r2, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) sendfile(r2, r3, &(0x7f0000000040), 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r5 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r6, r0, 0x0, 0xfffffdef) [ 3426.652884] loop7: detected capacity change from 0 to 40 [ 3426.720524] syz-executor.7: attempt to access beyond end of device [ 3426.720524] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3426.721715] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:27:26 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000300)='./file1/file0\x00', 0x181003, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0xe, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) fsopen(&(0x7f00000001c0)='ecryptfs\x00', 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000240)={@dev={0xac, 0x14, 0x14, 0x10}, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x180) r3 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x101042, 0x1e6) r4 = openat$incfs(r1, &(0x7f0000000040)='.log\x00', 0x80080, 0xa) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @dev}, 0xc) setsockopt$inet_mreqn(r5, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) getpeername(r1, &(0x7f0000000140)=@hci, &(0x7f0000000080)=0x80) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0xb0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x1}, 0x0, 0xffffdfffffffffff, r4, 0x9) sendfile(r2, r1, &(0x7f0000000000)=0xfffffffffffffffd, 0x1f) sendfile(r3, r0, 0x0, 0xfffffdef) 15:27:26 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) 15:27:26 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:27:26 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0x137, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) 15:27:26 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(0xffffffffffffffff, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 15:27:26 executing program 7: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2, 0x0, 0x0, r0}) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000300)="603c6d6b646f7366d8a02b0008002000f801338966fafc1bf7aa3829e5698b178ac7e095879374067742704669b012e0fa6a22eb3c1dc531759f8a42e529690ea419e18b65262fb419b9f3175ae6365e211fd4ca82e4cf55d6a6f20104000000000000ad6d18d96c235ec2f4fd0091d7e7b185703eb259f5320fc53c036c30f095fd5fb5aa6b88ea38c8ab82c1555629289dcb01a0280332f0bf5dbc5e19107c64c2655c965c", 0xa6, 0x8}, {0x0, 0x0, 0x2800}], 0x3200831, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0]) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r2, 0x0, 0xfffffdef) 15:27:26 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r4}, {0x2, 0x1, r5}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r2, {0x5}}, '\x00'}) accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000100)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000000300)={{0x0, 0x0, 0x7, 0x2, 0x6e, 0xd1, 0x2, 0x0, 0x0, 0x6, 0xfffffeff, 0x1, 0x6, 0x710, 0x4b8}}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000001300)={r6, r7, "583127ff5d1c94d033303461f98fabf0694d2ad7d7b14d108b78fca1cd60976bbb0e32e52204ac9482ce553b13a5c8275d32269f780409388e4a80451a5e684128963929731a98103372b7d6f910cbe4fc2711fe46cef6f2d37dd25069e00deeef23239fde47110832558adac99a4a8926254829cb097d2aa1797def4998d0eac6c9bab89e7208908c30ba11b2b7b5065335f9b261c38d3941ee8105436e4cce4d428d8d0506d391a0adefed38503022bdba800c9f7992d5b15cfcba54f4bdd5130e410c85d5260e3c9291f51330ebfa88b58c68c8973e5101c25e19edad3357022b449cc992e58b81f23abdbf8d5149aa719320c0420d5e1504b1c1fcd8a9f0", "4ed601f734875848e46d5ebde65124f7e7ca74b152efb8e66127f54c35384bea3c92e10676c72ead5edc34f678acdd2b7923e9bf5de4fdfec3e8ba38edc4bd90e02552ed9f86710496c62779cdf1e302ee2d0dfd447355718f2c347652ed507350eae195f1e1cfb50dd0e21787d06509c4c0c4e11d00c35d4bb216b31497d76e9c261d73bce7223d8e266371a9067abf1fb8f7e49cd0ad757a99c77b7f4fbbef95c908fbab7253035ae378fd2b4cc3217f136f171bc0b6b2dfc7ddbc9be5c8fbaebdf27b89dad2b154823d485263569672bf109ba178a691950eecd81923950e00e511a9e003da2aaeab2eea18b6441bbbc5cc4e992852c3b705c407af272c4358bdcf9ce9154fb6476ae0bfa7f7cf3939f9365a0b5cc0a330b1ebd339c804003c8d55cedf0bd4bc4411d09472c5aef7d9ca71bd3903589ef7452c6af45c13ea92c78fdfac948078c0786d980e19dcbff8e683ae48751b08dccb68ced1ff18e25f0bc1dd3175a7b66b1ed724e09f17284b0137f22069de71826e674ed396034b2cc86d5964ec55ff71f07a3e1146bd77e6a12f550106676858ed8ea59a3f3fa433395107180e87836f8b65ac77a761ba3663c0facf2945a46c3bf067ec4e7062ffc725774a714b907b791267e3c02df1c6b83a1d1c0357c1faed52280f1b1e0e34e4c7a028d232b7434dc4f32c4e1c4870c4734beacf85df6d1df7fd385b44d120c1985eef471740fb0835e7c569a839e3d24fa44e46110a0b3c28b6d3b539dbbf0f2044979deeb6b7619ce55bef546cc8d4cba7cfa169eea9f14428969e0a4ac16baffc3e2b3e165d8496761565f034abd4d5eef4b045427498215d266b612a95f9ddb835a1bdff753b884f20f6f600add3bc13cce95b09dd606a0c5d2b8953bb2c08aeba4e163c4eb765e0fab0c17d6e1688ca3d61ea19e72c296803cfd69e9c398ecfdc730bfe2e7f665b967d422ed14037957a6d7f16afa301b799c81ab2a418f9b1dc9edf53754f53783752583423c4a842780dce9643922d26ffba2eca17e42cf7043e40e6e85e5ffb2f89db3dc62bc96471d548ad510bc84442e83db11178bf1fbe3ed2dfc3e61b2249fb7cc3e48fd8b41ea5f9f608d9c5d0cc8d6456f6d64ed97f20f7668c48847a19294bab9acfabc2bc3d2f84c5a33ab509f1fd5552da7dacabaacb1899d8dc5ddedbb9c5108eba482491eff51b228c459d42a949f17b71be0344678dad5558c854f6a49a23cb54e815f644eeb0610ec21724f6338d02a29b1ea1a59f1aaef4ddd20b22621e2ce942b212ed0e817a22593d0e9b5344fef5345fbedaab9155c43881df8ecf8420e8d744f77be7c9974e385baf60a13a931d680a2224eb3586c8e256b1f165b3dc0a191aba1062c1dd9d270e3b9d85fc901d0c2ece0d4087bed03f6dbc31156b473a2efe6ca798d47603f93b6f2d0e761833e172f858b738b7b740eba4a27315d1728e4804e33f1bb44d0771b95e7c8b090723256a3675701b41a890fa7e2b0f31f46adcd6e2f153de719395373780906270d394eff473d18996660325396e19c526687b308a393590d515b922acd987a8eca9903cd2ebfd510951af457b8d1c4120c005154e72cad50b2b7d8ed163a9440feb8603acfb504c466ab16c90bf0759aa713d888f4e915fd68b7bdd56e4cecd28286df0284b9318f037bf2d42472819eceae5a5014e44b2b2eba3e30a24c861d81d7802f6f12251e66e2e52b00d75f6a7ea52662c014b9f93250de005ac92bc8ac46830f65e1927bd98d8cfb80c9b845b5b6e19e8f56cb126d30e445bcd4ef91616a1096ad5183bd29a777d9eff4eaeadad4ef20f075a3a6e51080656478b0e834f2d2857598e6e2c855ac9ee8240344c8031f4007a079e424062bfc5960f3b28f8a91cbdcb50b2daa11d7174fdac59c6e1a9dd9d467e9acdd94f40d74be6d9e4e5a74e104d1f50b21f1136e69069605d0b4f8932dbc5c221d6df139c72636a1a9fe0fc7bdabb4e4f2454c9396b335406cc28b688719f8a01505bafc1e39a8406551b09a028276ebdb46635a3667289164db95de5446d1f5e8e79687734c39ad8f02e4c33aea39c7b07e1487d2ef01d4aee13bdf1a7523014fe9324853d101792c68bf70547af3f7d6531304223d87cfe3dd7563e78d93b80faa77323fc0a91b9bb1949c4794a30e9a8b39d13dfee36d15b0e1df0336d66732d4ad71ed8936c17b8d073dd448e221cc503f96b0a2396289d093e8a19362c953ac1f74fea125d417a4f3e348838d8ddaffd94d430de4a6a276451b5914154ab15104b7feb16df3b39d90294d6fd36dab87ef1b4ed1d59682de98a8e2b016d5823d96fb271997183837586ffa3f6066ab2d15e3faba357d5f776c3eecfb92de2e55c8b49cacea3289abb1d295afb36f10476941ddaa8c0ed8285a642d6b8fc8376d7120e2a0f5e33a6898c48e39577710dd3f5f59376e35add057cbffd84afc8f895b2ac2772ff08d1f2c0b941f3999bc56a24e48c97ba89cf4e1a4697a686cbf942881411f101a46c2d00a1d190ca733f28e9bb4c15f67b9e611a97082cfc1c8c8bbdc1dc41c754495d050f138553d5a27ffbe593ce3a56691efc7429e422482aa509a6fec6ae5a91cdff9da440f4c56d0a7903ea6f6eb9b0943733a0395eacecf35862222af4600c30ce26cdcd14ef2392ae4bce9ac48c8a2ce90aef106c88e3bed53840fca0a8955541e31d9a2ef3b2edc7f1f2a6e6f1b477760107413846cd7196f54fe7cc507f14338f3e8193ce0057d189f5249484d2785863a8f4c81040454ddf04b38da594d096f362276b1b94acbda3788a6c698230bc670da5b74e5121706759fd91833bd981577b4cd4d31dc2cf1edf7c78cb31877a3258cbf5eaf6752b077e119d10a5d8ef436d05643b312ee5ee869a084f5ec913440ff1ef58eda89f1e7ee6eee7aaeb94c93ba5a703fdd508ebb1f98cb568064fac6244995268c70538f6ab6100e2602443246861877a5be82d7e7ac4eb31e70c7876e0c1ef6ce12d760d7c292ad2f958b07dd122065f8907385059fb506e2921029434404139fab186de3ab17c5dfd0a2d98122d328bdd2adf5cd6243db1d4e05a1a492f68b4aa3cb10450e76140f2acfe39df1fe8446245c7d39952f3b5d0c9c5d0922da9de4bd6bca0d460ce5ed40c2e61dfce808f31fa3afd5d1bbb8f1f5ec1f5cf7f8ff5045f2f3de90df0df092f605d1410691faf601c0ab1d288f9ffc85011a82fba2fa90c99ec83a513874eb1d42d8fbcfa608a9306b03ffe1f954b1bc6fb6a88db12443c10fee5cdafd9ea12f6da8663fc2ce29e33946240cbed26ab924eea6ea099b081305db1015da729bf90a0fcdf5fbc8dab91d0b134314ffca7bbeaab345aca0270fa1e801e31193188dd0940530117569d7a8c04f7c88bed9161dd7aeeaf911d4ae37917ae45ae73393587e80ae3c135e0455518911a9b59723312ba5b58d7948328a60a30b50bb171849b0e0e9d732dad2721730997f577264d37978c0bdc9dc568f1c7fa5e2484f79692e581503b8d96a4576461eafa48defc3fcd67b13f646a3a369d06b110d0027b5b23c3327dbcf551d523dbc268550a37a1965bdedab6a4af03d602529c2d8e06d2a5772f11003301be8108778bdfb259c8f5a0fc3fad6a97ba3ee493f02b3f7ded67861d87d0e7b59a6b4f50df9651209c91d5b41e9c49f83025e57ba56e7e26df22be8b6368cf61acd67d33e4225b185c95e6d5d4e89429a36ec1d90a3e3f15c14ee66588b0f0f79427cf7cfa2c7697cff89940a9b7741b607aeca1b320b7cc07847eec859a08fbdd05cd164bfd209c79203a72aac76dd6f0b618737bc09d979c7342d5b4c0c202a26af6629d1729e7645cfd7b7fa1a4bba34a9ddc904e28a31f5a9eec94e3d515c1ed18688746868bcbd327bb4bed1374df08e1bee70475770f6dfff38e6a43c6115bdbb886f12b1dc58b8c77dcba6efaa2bd841cb414534416c07f9f40207d774956cab72265f25f99ff4e557be8bdd3d61e4f674b980e143897762f2e3ae868f5d6f974b24fed344d6cf77b21e700249ea85b2e5a0ff6af34acfaf5647fb853aa03adde7a6dbf90ce0edded356f02bce452e9048196f789a8188f466068ee4568a28e562425043b7f4a29f8aac5c1efdc62d6a9660d23501e32f5c52248ea097da045d9c85fb205b77625179c06ca66adde63753f0b8dc0985980f60055593e8725e76870227b8742d0ce0dd724bae182c19c0f9426f43228b75e14d11c1b30c09b1228c921af051e0d092f09dfc74f2d6f32c6dcc17b0d74d5b6e8f02b32698d71227c185a3888326ac5d7871292e9d14211e669f775c72bd429ffa58ae18f6dac547994da628adba3cb5b3d05886f3f43b4ee3b19fc85441b4f8ae2118c143838094aaf29944de1a049b69399741f05fc880a45b5cb4957119f74371739d5477a6ac38364469745908ad5ab092fbc2aac564a0b08749135453eeeee6871c13decc975e434efc07e4815cff4cb00a9834d357e8263a3f1a30667b1c8917b5b5a2bb2b63fb82dbfe2f3e713616b401b2e631ceb4847859228760288806c67773d2a1148979b24e9557f2e54de947ffcac48fef1a6b0383dd6283557bec81b4f08523d963c0abdc42bc1f807cc45377baaad3dc64981eeb78a9cf98ec911dba455fb867dc3fd5df52eae4860af5e02231fa5e49e3db5f1d4fb743f7a9849143554c7a4aefd93dfda24284fa8a0494685da0a88e5c7bc7e82e5798f603f121b4a5c57ac3c35c1a5c8586bd79a77f6866c1d19f7f14e25a1a3bae193d820d760857ae1b40efb70d291d5e4887b2ea511db92cc961fd8d6a95d58c530cbf629807812f46378affe670e91839bb9d6ac3c48e08d54150df2482857f5774409dd33f57f7cc2e7ce7098f15e9a818898c8b61904b65a0dc63567626bdce94b921abfea1fdc41975808d754a0056437f882284cc9272e93de8e24cc02e5c68fbdcdd9e79e3a9f2317abebb887ff20e01d7fb7f8b2dffba4a35f5bdcf620871a50b74eb51cf0860626fc86a62db0b3969594788883b870c68951bdf64eaea548b6099d8948070e55c1b93d33a4ca82179e532a97f6f0d739d4f2c60892823d20c4bb7a0721ed33520677c29c8feea9983f076249ba8e1e89fdb1cf199d0f53c8c6aa5f13de4096104b86add30e80b91beab3c131c78cc71d067037fd65fee32e0610357e88e7452afa3b61840024206dd17e98c0bbc6e39f92ac83ab2ae00d7eca63c07480e9d7033fa23f2ac9a1ab0bdd7efc39f10786079d9ab9f002fd0eb99fd29efe946e79dd720dcdadf2f6b29454c1d6e99775264da0cd990d9adef352a069436539939c12c8ce4fa21417b4bb5bbd765d35d4b92287ba9d8fbeeeb1e97198db1224"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000044100)={0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}], 0x7, "850011b3dc2f05"}) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000080)='\x00', &(0x7f00000000c0)='./file0\x00', r3) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:27:26 executing program 0: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) [ 3442.306181] loop3: detected capacity change from 0 to 40 [ 3442.309927] FAT-fs (loop1): bogus number of reserved sectors [ 3442.310826] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3442.358032] loop4: detected capacity change from 0 to 40 [ 3442.375278] loop7: detected capacity change from 0 to 40 [ 3442.390025] syz-executor.3: attempt to access beyond end of device [ 3442.390025] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3442.391065] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3442.450446] syz-executor.3: attempt to access beyond end of device [ 3442.450446] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3442.451552] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3442.487133] syz-executor.4: attempt to access beyond end of device [ 3442.487133] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3442.488311] Buffer I/O error on dev loop4, logical block 10, lost async page write 15:27:27 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r5, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x80000000) read$snapshot(r4, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r4, 0x5380) 15:27:27 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = openat(r2, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) openat(r3, &(0x7f0000000740)='./file1\x00', 0x0, 0x1) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) 15:27:27 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3442.851789] loop3: detected capacity change from 0 to 40 [ 3443.185042] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3443.206864] blktrace: Concurrent blktraces are not allowed on sg0 [ 3443.209644] loop7: detected capacity change from 0 to 40 15:27:41 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffffff, &(0x7f0000000400)='./file1\x00', 0x80000, 0x179) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mount(&(0x7f0000000300)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='udf\x00', 0x2000000, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) openat(0xffffffffffffffff, &(0x7f0000000240)='./file1\x00', 0x301000, 0x11) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r4}, {0x2, 0x1, r5}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r2, {0x5}}, '\x00'}) accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) mknodat(r3, &(0x7f0000000180)='./file1\x00', 0x80, 0x101) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3456.896165] loop3: detected capacity change from 0 to 40 15:27:41 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getuid() fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=r2, @ANYBLOB="02000100", @ANYRES32=r3, @ANYBLOB="e8a77279d3b8414802000400", @ANYRES32=0x0, @ANYBLOB="040000000000000010000200000000002000020000000000"], 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r0, {0x5}}, '\x00'}) accept4$unix(r1, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) write$P9_RREADDIR(r1, &(0x7f0000000300)={0xb2, 0x29, 0x2, {0xe7a, [{{0x8, 0x1, 0x6}, 0xbe, 0x1, 0x7, './file0'}, {{0x8, 0x2, 0x2}, 0xffffffffffffffff, 0x1, 0x7, './file1'}, {{0x8, 0x3, 0x1}, 0x2, 0x85, 0xd, './file1/file0'}, {{0x8, 0x0, 0x8}, 0x5, 0x1, 0xd, './file1/file0'}, {{0x40, 0x1, 0x2}, 0x0, 0x4, 0x7, './file1'}]}}, 0xb2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r5, r4, 0x0, 0xfffffdef) 15:27:41 executing program 0: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r4}, {0x2, 0x1, r5}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r2, {0x5}}, '\x00'}) accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000100)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000000300)={{0x0, 0x0, 0x7, 0x2, 0x6e, 0xd1, 0x2, 0x0, 0x0, 0x6, 0xfffffeff, 0x1, 0x6, 0x710, 0x4b8}}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000001300)={r6, r7, "583127ff5d1c94d033303461f98fabf0694d2ad7d7b14d108b78fca1cd60976bbb0e32e52204ac9482ce553b13a5c8275d32269f780409388e4a80451a5e684128963929731a98103372b7d6f910cbe4fc2711fe46cef6f2d37dd25069e00deeef23239fde47110832558adac99a4a8926254829cb097d2aa1797def4998d0eac6c9bab89e7208908c30ba11b2b7b5065335f9b261c38d3941ee8105436e4cce4d428d8d0506d391a0adefed38503022bdba800c9f7992d5b15cfcba54f4bdd5130e410c85d5260e3c9291f51330ebfa88b58c68c8973e5101c25e19edad3357022b449cc992e58b81f23abdbf8d5149aa719320c0420d5e1504b1c1fcd8a9f0", "4ed601f734875848e46d5ebde65124f7e7ca74b152efb8e66127f54c35384bea3c92e10676c72ead5edc34f678acdd2b7923e9bf5de4fdfec3e8ba38edc4bd90e02552ed9f86710496c62779cdf1e302ee2d0dfd447355718f2c347652ed507350eae195f1e1cfb50dd0e21787d06509c4c0c4e11d00c35d4bb216b31497d76e9c261d73bce7223d8e266371a9067abf1fb8f7e49cd0ad757a99c77b7f4fbbef95c908fbab7253035ae378fd2b4cc3217f136f171bc0b6b2dfc7ddbc9be5c8fbaebdf27b89dad2b154823d485263569672bf109ba178a691950eecd81923950e00e511a9e003da2aaeab2eea18b6441bbbc5cc4e992852c3b705c407af272c4358bdcf9ce9154fb6476ae0bfa7f7cf3939f9365a0b5cc0a330b1ebd339c804003c8d55cedf0bd4bc4411d09472c5aef7d9ca71bd3903589ef7452c6af45c13ea92c78fdfac948078c0786d980e19dcbff8e683ae48751b08dccb68ced1ff18e25f0bc1dd3175a7b66b1ed724e09f17284b0137f22069de71826e674ed396034b2cc86d5964ec55ff71f07a3e1146bd77e6a12f550106676858ed8ea59a3f3fa433395107180e87836f8b65ac77a761ba3663c0facf2945a46c3bf067ec4e7062ffc725774a714b907b791267e3c02df1c6b83a1d1c0357c1faed52280f1b1e0e34e4c7a028d232b7434dc4f32c4e1c4870c4734beacf85df6d1df7fd385b44d120c1985eef471740fb0835e7c569a839e3d24fa44e46110a0b3c28b6d3b539dbbf0f2044979deeb6b7619ce55bef546cc8d4cba7cfa169eea9f14428969e0a4ac16baffc3e2b3e165d8496761565f034abd4d5eef4b045427498215d266b612a95f9ddb835a1bdff753b884f20f6f600add3bc13cce95b09dd606a0c5d2b8953bb2c08aeba4e163c4eb765e0fab0c17d6e1688ca3d61ea19e72c296803cfd69e9c398ecfdc730bfe2e7f665b967d422ed14037957a6d7f16afa301b799c81ab2a418f9b1dc9edf53754f53783752583423c4a842780dce9643922d26ffba2eca17e42cf7043e40e6e85e5ffb2f89db3dc62bc96471d548ad510bc84442e83db11178bf1fbe3ed2dfc3e61b2249fb7cc3e48fd8b41ea5f9f608d9c5d0cc8d6456f6d64ed97f20f7668c48847a19294bab9acfabc2bc3d2f84c5a33ab509f1fd5552da7dacabaacb1899d8dc5ddedbb9c5108eba482491eff51b228c459d42a949f17b71be0344678dad5558c854f6a49a23cb54e815f644eeb0610ec21724f6338d02a29b1ea1a59f1aaef4ddd20b22621e2ce942b212ed0e817a22593d0e9b5344fef5345fbedaab9155c43881df8ecf8420e8d744f77be7c9974e385baf60a13a931d680a2224eb3586c8e256b1f165b3dc0a191aba1062c1dd9d270e3b9d85fc901d0c2ece0d4087bed03f6dbc31156b473a2efe6ca798d47603f93b6f2d0e761833e172f858b738b7b740eba4a27315d1728e4804e33f1bb44d0771b95e7c8b090723256a3675701b41a890fa7e2b0f31f46adcd6e2f153de719395373780906270d394eff473d18996660325396e19c526687b308a393590d515b922acd987a8eca9903cd2ebfd510951af457b8d1c4120c005154e72cad50b2b7d8ed163a9440feb8603acfb504c466ab16c90bf0759aa713d888f4e915fd68b7bdd56e4cecd28286df0284b9318f037bf2d42472819eceae5a5014e44b2b2eba3e30a24c861d81d7802f6f12251e66e2e52b00d75f6a7ea52662c014b9f93250de005ac92bc8ac46830f65e1927bd98d8cfb80c9b845b5b6e19e8f56cb126d30e445bcd4ef91616a1096ad5183bd29a777d9eff4eaeadad4ef20f075a3a6e51080656478b0e834f2d2857598e6e2c855ac9ee8240344c8031f4007a079e424062bfc5960f3b28f8a91cbdcb50b2daa11d7174fdac59c6e1a9dd9d467e9acdd94f40d74be6d9e4e5a74e104d1f50b21f1136e69069605d0b4f8932dbc5c221d6df139c72636a1a9fe0fc7bdabb4e4f2454c9396b335406cc28b688719f8a01505bafc1e39a8406551b09a028276ebdb46635a3667289164db95de5446d1f5e8e79687734c39ad8f02e4c33aea39c7b07e1487d2ef01d4aee13bdf1a7523014fe9324853d101792c68bf70547af3f7d6531304223d87cfe3dd7563e78d93b80faa77323fc0a91b9bb1949c4794a30e9a8b39d13dfee36d15b0e1df0336d66732d4ad71ed8936c17b8d073dd448e221cc503f96b0a2396289d093e8a19362c953ac1f74fea125d417a4f3e348838d8ddaffd94d430de4a6a276451b5914154ab15104b7feb16df3b39d90294d6fd36dab87ef1b4ed1d59682de98a8e2b016d5823d96fb271997183837586ffa3f6066ab2d15e3faba357d5f776c3eecfb92de2e55c8b49cacea3289abb1d295afb36f10476941ddaa8c0ed8285a642d6b8fc8376d7120e2a0f5e33a6898c48e39577710dd3f5f59376e35add057cbffd84afc8f895b2ac2772ff08d1f2c0b941f3999bc56a24e48c97ba89cf4e1a4697a686cbf942881411f101a46c2d00a1d190ca733f28e9bb4c15f67b9e611a97082cfc1c8c8bbdc1dc41c754495d050f138553d5a27ffbe593ce3a56691efc7429e422482aa509a6fec6ae5a91cdff9da440f4c56d0a7903ea6f6eb9b0943733a0395eacecf35862222af4600c30ce26cdcd14ef2392ae4bce9ac48c8a2ce90aef106c88e3bed53840fca0a8955541e31d9a2ef3b2edc7f1f2a6e6f1b477760107413846cd7196f54fe7cc507f14338f3e8193ce0057d189f5249484d2785863a8f4c81040454ddf04b38da594d096f362276b1b94acbda3788a6c698230bc670da5b74e5121706759fd91833bd981577b4cd4d31dc2cf1edf7c78cb31877a3258cbf5eaf6752b077e119d10a5d8ef436d05643b312ee5ee869a084f5ec913440ff1ef58eda89f1e7ee6eee7aaeb94c93ba5a703fdd508ebb1f98cb568064fac6244995268c70538f6ab6100e2602443246861877a5be82d7e7ac4eb31e70c7876e0c1ef6ce12d760d7c292ad2f958b07dd122065f8907385059fb506e2921029434404139fab186de3ab17c5dfd0a2d98122d328bdd2adf5cd6243db1d4e05a1a492f68b4aa3cb10450e76140f2acfe39df1fe8446245c7d39952f3b5d0c9c5d0922da9de4bd6bca0d460ce5ed40c2e61dfce808f31fa3afd5d1bbb8f1f5ec1f5cf7f8ff5045f2f3de90df0df092f605d1410691faf601c0ab1d288f9ffc85011a82fba2fa90c99ec83a513874eb1d42d8fbcfa608a9306b03ffe1f954b1bc6fb6a88db12443c10fee5cdafd9ea12f6da8663fc2ce29e33946240cbed26ab924eea6ea099b081305db1015da729bf90a0fcdf5fbc8dab91d0b134314ffca7bbeaab345aca0270fa1e801e31193188dd0940530117569d7a8c04f7c88bed9161dd7aeeaf911d4ae37917ae45ae73393587e80ae3c135e0455518911a9b59723312ba5b58d7948328a60a30b50bb171849b0e0e9d732dad2721730997f577264d37978c0bdc9dc568f1c7fa5e2484f79692e581503b8d96a4576461eafa48defc3fcd67b13f646a3a369d06b110d0027b5b23c3327dbcf551d523dbc268550a37a1965bdedab6a4af03d602529c2d8e06d2a5772f11003301be8108778bdfb259c8f5a0fc3fad6a97ba3ee493f02b3f7ded67861d87d0e7b59a6b4f50df9651209c91d5b41e9c49f83025e57ba56e7e26df22be8b6368cf61acd67d33e4225b185c95e6d5d4e89429a36ec1d90a3e3f15c14ee66588b0f0f79427cf7cfa2c7697cff89940a9b7741b607aeca1b320b7cc07847eec859a08fbdd05cd164bfd209c79203a72aac76dd6f0b618737bc09d979c7342d5b4c0c202a26af6629d1729e7645cfd7b7fa1a4bba34a9ddc904e28a31f5a9eec94e3d515c1ed18688746868bcbd327bb4bed1374df08e1bee70475770f6dfff38e6a43c6115bdbb886f12b1dc58b8c77dcba6efaa2bd841cb414534416c07f9f40207d774956cab72265f25f99ff4e557be8bdd3d61e4f674b980e143897762f2e3ae868f5d6f974b24fed344d6cf77b21e700249ea85b2e5a0ff6af34acfaf5647fb853aa03adde7a6dbf90ce0edded356f02bce452e9048196f789a8188f466068ee4568a28e562425043b7f4a29f8aac5c1efdc62d6a9660d23501e32f5c52248ea097da045d9c85fb205b77625179c06ca66adde63753f0b8dc0985980f60055593e8725e76870227b8742d0ce0dd724bae182c19c0f9426f43228b75e14d11c1b30c09b1228c921af051e0d092f09dfc74f2d6f32c6dcc17b0d74d5b6e8f02b32698d71227c185a3888326ac5d7871292e9d14211e669f775c72bd429ffa58ae18f6dac547994da628adba3cb5b3d05886f3f43b4ee3b19fc85441b4f8ae2118c143838094aaf29944de1a049b69399741f05fc880a45b5cb4957119f74371739d5477a6ac38364469745908ad5ab092fbc2aac564a0b08749135453eeeee6871c13decc975e434efc07e4815cff4cb00a9834d357e8263a3f1a30667b1c8917b5b5a2bb2b63fb82dbfe2f3e713616b401b2e631ceb4847859228760288806c67773d2a1148979b24e9557f2e54de947ffcac48fef1a6b0383dd6283557bec81b4f08523d963c0abdc42bc1f807cc45377baaad3dc64981eeb78a9cf98ec911dba455fb867dc3fd5df52eae4860af5e02231fa5e49e3db5f1d4fb743f7a9849143554c7a4aefd93dfda24284fa8a0494685da0a88e5c7bc7e82e5798f603f121b4a5c57ac3c35c1a5c8586bd79a77f6866c1d19f7f14e25a1a3bae193d820d760857ae1b40efb70d291d5e4887b2ea511db92cc961fd8d6a95d58c530cbf629807812f46378affe670e91839bb9d6ac3c48e08d54150df2482857f5774409dd33f57f7cc2e7ce7098f15e9a818898c8b61904b65a0dc63567626bdce94b921abfea1fdc41975808d754a0056437f882284cc9272e93de8e24cc02e5c68fbdcdd9e79e3a9f2317abebb887ff20e01d7fb7f8b2dffba4a35f5bdcf620871a50b74eb51cf0860626fc86a62db0b3969594788883b870c68951bdf64eaea548b6099d8948070e55c1b93d33a4ca82179e532a97f6f0d739d4f2c60892823d20c4bb7a0721ed33520677c29c8feea9983f076249ba8e1e89fdb1cf199d0f53c8c6aa5f13de4096104b86add30e80b91beab3c131c78cc71d067037fd65fee32e0610357e88e7452afa3b61840024206dd17e98c0bbc6e39f92ac83ab2ae00d7eca63c07480e9d7033fa23f2ac9a1ab0bdd7efc39f10786079d9ab9f002fd0eb99fd29efe946e79dd720dcdadf2f6b29454c1d6e99775264da0cd990d9adef352a069436539939c12c8ce4fa21417b4bb5bbd765d35d4b92287ba9d8fbeeeb1e97198db1224"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000044100)={0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}], 0x7, "850011b3dc2f05"}) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000080)='\x00', &(0x7f00000000c0)='./file0\x00', r3) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) 15:27:41 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, 0x0, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:27:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000040)={@multicast1, @broadcast}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r3, 0x6612) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x2115, 0x0, 0x0, 0x9, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, r2, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) io_setup(0x2, &(0x7f0000000000)=0x0) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000400)) r5 = signalfd(r1, &(0x7f0000000200)={[0x3]}, 0x8) io_submit(r4, 0x1, &(0x7f00000001c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0xfff, 0xffffffffffffffff, &(0x7f0000000440)="d273552e4a7f365672373c149c15b3349ce5dc259f4d27627972ca7f86c380ca101ba632ae79bf1d5c7580b8474dd540afa4113d7e328eaedd36fabd0761cdc84abc34cd18c6a1d14d9fd11a7a4a3613082191317e22d326ced8cafb884657b455a0ab769afa8182d4d48c6aff39f77914d3f395f66e57a2fd8746624c5b94d9beed3507836461daec926e46c657c4181d2aa674cd07e88f382849c66866efff306e8aee4c78bd71be828a9caa76eb4c69549c2a805a049420a45077946ca50324e54bfc34dfe5be9cda7ff717ae547ca642f7bbfa1db1d14f20511a5b706eca433b1fc0bcff10ddfe05", 0xea, 0x1, 0x0, 0x2, r5}]) 15:27:41 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') readlinkat(0xffffffffffffffff, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000740)={0x68, 0x29, 0x2, {0x8, [{{0x10, 0x2, 0x5}, 0x4, 0x1, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x80000000, 0x6b, 0x7, './file0'}, {{0x4, 0x2, 0x5}, 0x2f, 0xcf, 0x7, './file2'}]}}, 0x68) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r2, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) write$binfmt_aout(r1, &(0x7f00000007c0)=ANY=[@ANYRES64=r0, @ANYRES64=r3], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r4, &(0x7f0000000700)) 15:27:41 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x1, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000740)={{0x1, 0x1, 0x18, r0, @in_args={0x1}}, './file2\x00'}) write$binfmt_aout(r5, &(0x7f0000000800)=ANY=[], 0x220) r6 = openat$cgroup_type(r3, &(0x7f0000000780), 0x2, 0x0) sendfile(0xffffffffffffffff, r6, &(0x7f00000007c0)=0x8001, 0x9) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r7, &(0x7f0000000700)) 15:27:41 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3456.922755] FAT-fs (loop1): bogus number of reserved sectors [ 3456.923219] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3456.937252] loop7: detected capacity change from 0 to 40 [ 3456.942888] FAT-fs (loop0): bogus number of reserved sectors [ 3456.943402] FAT-fs (loop0): Can't find a valid FAT filesystem [ 3456.991845] loop4: detected capacity change from 0 to 40 15:27:41 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000740)={{0x1, 0x1, 0x18, r0, {0x3}}, './file3\x00'}) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r2, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat$cgroup_pressure(r3, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r5, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r4, r2, 0x0, 0xfffffdef) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r6, 0x0, 0x0) perf_event_open(&(0x7f0000000780)={0x0, 0x80, 0x1f, 0x0, 0x6, 0x2, 0x0, 0x5, 0x40080, 0x5, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffff801, 0x8}, 0x4200, 0x9, 0x41, 0x3, 0x8, 0x80, 0x8, 0x0, 0x3ff, 0x0, 0x4}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r6, &(0x7f0000000700)) [ 3457.083259] syz-executor.7: attempt to access beyond end of device [ 3457.083259] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3457.084163] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:27:41 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000e40)="601c6d78646f7366d8a02b00080101000440002000c0e7b4f801c13850176f111f2b8def865c3b456f97a7c2e817957c2b9fda85743301010000000000003401318d87fc4112ea346036b9084e5023be24b3e2879110d9666e8f828cf4c80109f33ffc5eb0c04369920421ff62ba4934b7164b6083dadbb4b588328d35a708659dbc2304993461ba8a559ed30fb7ffd32efb710ce77817ce430f5e0675dc088ab35234fda61063fcb324d555980e9aeac2cc5e4cabd1e607fcd9d0245ecef70b6bfd0dd757d9694187ae37a5fa5aff446f4211bc97af006477b3c7f67c8bc9e9aba47428994578e6b73910b5ab657ea3564021f9ee3d8070cc4d8f050a766629b356bdbb86703faf734299995e744b8d5885900d2c2dba5f8e19166ed5b9f2dbf2d5fa318f32d741e0208744d9dd3e7833e62663581cd26db43c2ab16bba1d6c31e89e6f3088173afbd309e07f64183b81dd135fab71ee141055a92a9e6cb6c1247e1d00f62ef10aa1d9ab2a815896cfea0635abf3fe725514d5572877f67fc858435a7c634eec18997e23e585f7d3864dd83eaa99d8183c26c17bf0e1577e06368cccf9e66ecae2f5f0e28e127621e3554a176c02d266b95697554d2cd61fddbc2a25386959006ba640ecfbf6f95db471fa451dd4c3bf52a20696ef3ae7f2", 0x1df, 0x2}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x3080, 0x0, 0x0, 0x0, 0x3, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f00000001c0)='\x00', &(0x7f0000000240)='./file2\x00', 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r2, &(0x7f0000001100)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae6c201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a6480000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000315224998513805a432584ec41df5fa476dc931c29e895d35957f525b31c64fe76d53cbad9b63b28000"/747], 0x2b8) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r2, 0x40047211, &(0x7f0000000300)=0x20) sendfile(r1, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2}) perf_event_open(&(0x7f0000001080)={0x0, 0x80, 0x0, 0xff, 0x4, 0x5d, 0x0, 0x2a0, 0x40820, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000001040), 0x4}, 0x100, 0x3, 0x400, 0x5, 0x0, 0x1, 0x100, 0x0, 0x657, 0x0, 0x6}, 0x0, 0x8, r3, 0xb) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) syz_open_dev$vcsa(&(0x7f0000000740), 0x7, 0x400000) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000400)={{0x108, 0x7f, 0x5, 0x26b, 0x230, 0x10001, 0x1ed, 0x69}, "226554dee38e56af4b55f31085b10fd0138884ee06dc464a94df111ab92424e6863ee0d6b907e930718c9ab1e15eb13099bead90fff871291c28723bf2512c7cde3cce44aeb7dca13c8cec656d5f4ad41c14d6b8dd7d8b5d9f6ec53e37023ebb7a114a53c9d9fa92f539"}, 0x8a) [ 3457.240218] loop3: detected capacity change from 0 to 40 15:27:42 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, 0x0, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:27:42 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) sendfile(r2, r2, 0x0, 0x368ef744) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) dup2(r0, r3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000940)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r5}}, {@measure}]}}) getresuid(&(0x7f0000000440), &(0x7f00000014c0), &(0x7f0000001500)) sendfile(r4, r1, 0x0, 0xfffffdef) 15:27:42 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) [ 3457.440823] loop4: detected capacity change from 0 to 40 [ 3457.444736] loop7: detected capacity change from 0 to 40 [ 3457.466508] FAT-fs (loop4): invalid media value (0x20) [ 3457.466929] FAT-fs (loop4): Can't find a valid FAT filesystem 15:27:42 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, 0x0, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) [ 3457.627295] syz-executor.7: attempt to access beyond end of device [ 3457.627295] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3457.629617] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3457.664168] syz-executor.7: attempt to access beyond end of device [ 3457.664168] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3457.665202] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3457.837552] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3458.249242] loop4: detected capacity change from 0 to 40 [ 3458.253586] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value 15:27:56 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17, 0x80000000}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e304a5696aaed7ac000000000000000000000000000000000000000000000000000000f56300"/696], 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000080)={@dev={0xac, 0x14, 0x14, 0x2b}, @dev={0xac, 0x14, 0x14, 0xd}}, 0xc) setsockopt$inet_mreqn(r5, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private=0xac141400}, 0xc) flock(r5, 0x8) 15:27:56 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 15:27:56 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) sendfile(r2, r2, 0x0, 0x368ef744) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) dup2(r0, r3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000940)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r5}}, {@measure}]}}) getresuid(&(0x7f0000000440), &(0x7f00000014c0), &(0x7f0000001500)) sendfile(r4, r1, 0x0, 0xfffffdef) 15:27:56 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000005c0)={0x0, ""/256, 0x0}) ioctl$BTRFS_IOC_INO_LOOKUP(0xffffffffffffffff, 0xd0009412, &(0x7f00000007c0)={r0, 0x101}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000780)={0x0, r0, "bd707ba5b3e9be3732962d83cba8d40e36e8d6892b247845b511567ef4a97321b36cea3c202c173b11b629034a9c506c82976ac455cbe11e5ad985fb752aa4ccd835d174e7d349a31988f8fa2cb3da0830251b370222e11e01e7d7de6d59ecfc8d0ff5a910a4224dfcaf176ea85a8efc2267408e4be6134dfd0feb68d834acbd0a5752279be527007aedd158c0cd216c41c93b757e34b57eea9cf56be57f2feb8a2d823962e412dba9f21dd12f56e76ef31d16b15dadc0ce4e1279315c7e7619989fc60f221aa8680d4dcd6cfa819dc7ee98678a66c63ae54989ec94e144ea196d1739c03069af1c1f9e1b683b22d1e0c9229d0699467f177321510fa2225982", "f86d8edead8c6b3bf24c7b96a41950ee66edfd9e6c9d0486490a9d58745169b8af58e70488406823f1b0ecefa0dc4fa72064d1b67209eb6fb65573ba71f201de3040ddab2cd89328780db15d596f611597aef5965075363d56c11d731b7dac0131726697051f6a43039e969e82ef18f24e234e69a1e3c424e0eb9b9be9e6df47116c226f2fcfcfbbfe93fe8073670f4edeb79b930a6f9ae61a805877861c74f7bbed92ed81e52c80fac9d224d791f75ff6234ea7fa17a9b668c01a77f33a7e812c0c48726ce4019dfbc11799b619728ced80926b81fb795c9da433d386e66902e6d08596ebb2d7e9a7a9def25f1b1cdd0daee0ccd7020364d30a3bf909e0c6ef1d2940d6ce050e570777323baed6217f627942fbf33cbfb1caafca981bddf31c65752f50e98029fc781ca330b36628ee616dcbe3f1d16d0de34d8b0d18dd6b32db37156cd523fd2271318b6ee1d056c35775e743268fb074a09ab9de1bcaea07c8806d2cc9e6a2b908ff962ba90353362d55ebac4c1675e837ad11b751eeda54127a3b897b570cc86f7d3b081e8150a39ddc4e41c90955cb312837cb59a9398436b1013ead92689413ce5b61a7ab38acf9deceb0ef69bc0bed54b5ceb2e687a16f9a469ba4a92f185fc24f16995b7a0dcd1320966f7ccf6a75306ed5a40e6b9928d3a892e66fccd21d6ac6a0154f22df801a86038187a743cf26d9c97c8c9e563ff1c1bb75c920d5942af1a9ec26f7784dcaea0e24e07f3fb486ee4cd44d9d30a17c21ab0841092bac4b4c9187b4457d822caf159a736cbddebd07bc9ecb9fe91eca1de7028fecd548061e6bd73b7a71cb22b62ce0f7740cc4938a0e819dea4e30e65495d091caa3c11c305ef76bb951f4c61ed9cace6debc4a5570a7d13bc038e145a73ecb53a6798239cb294a196fbb9e431ad9366c7c31ee337adfa205f80e47a887a195d32ced8e386903abbbfd0332b4851b3e4cfbf56304176de54ad6a1f6075d3cf59adbfa983f338becad8d6c4be04e77f69ce1003fa5e38fc79a38b7af08250663f38cefd74b1e23cb35c4a51c367b3028055e75275e24dbc8a46decc120808e8ae08a20ca14ab05b74ec947a8d99bcd21f808895aea1e5e36ba82384963d57f3257e7a01cc1fa46546da8ab133e8a3a6829ea7d0e01fd278f0b62b4d07c39bc7715c1367bcaf66d8bba8ac98ff96f4ea05f4c0df84ff284c9e2b979b0cf88532ee4e7c84f7cf38e4a21d4cc873e148d18f4395528cb44b3ceb871ec62417075af3cbe50768d60b71a5011d715af74b445ac21db42431b58f00d37132ce5007d0908838f5a951197e50e3b7f6ccbeae0acad2d36892c1a15b25c28750a0581138559ed8beec5bea7a318bdac00a0dc2ea4542e46cbb3b4526991feb51ff487f3f8b313e8d3f027cb94c1d4068c8324c59bb0a6af6343f0a8c763892fc520115466a1569b5aed68af8f53740bd9ac3f771a5baf6f6c26ffd97e3155b2fc0293d660237df4be5c53b415e797637a42cacd4c38ff4ab70a1c4b2d1e0025e59c6cf137355bb11978034229bd03746d40b44226fb52c3941862cf37611e89e59bb0cbe0adb88ead12eec4e43167862861b1c65b12e02027243a48681d3bfc9ea1fea8adbbbefe19f1e3b0081680a4b7639b17bc6b0a9a20f2474d7118f20e88e41fadb312f0b24d39009f009719f94e9fb30fe459d4dcc7fb8d3b7689f149d4b628e40d56d93ef98f0b90d1476b64e6f7a22e0a540637d16f7d9fd363419ef1a7ef97724acdb08096dcfe6bd95d8cf82addce6064f4f21c5edfd9c18cd01bbf0434ba98c89e34d7cc57ac54b466bbe44a3b5fa15296b99f724b4dfa55f56a0326e92511e65647aeafa2ec870b9d91a34a8a8a634123bdaa91dc1b5e4e9f366baf592eb0d918c685c52de770f1b31c5c60dc84f695aa731f4e43dbf69799c4a4fdcf3f32b12c2cd84f1e1a0df0b8b7638168d2c3e9371378cb71258f7679b0e9fdd0e42e42c2fcf2217a9ea610c84f3b28ec66c28828ccf0172962cb6adb6120e110123d8d918655275fc307fbd271f7f822b00cff10f9023fbdca71ba10dab8c6e2e1f4dc121449bb89d76d4b468877f93341e836bbf20a3e42ca494333ddb6577d415ab8a48cb5321687fff54a573e766c2533a4261ff3abefccfba2fc7a7208a7d6d6f3e44f973de6b4e7fcfc4ce7a9f4d157c5ff2750e1e209f87d3970c1656db0a99ede758f5e29fe66a801f61adf559d89303d21fb52f21c7e75b0ad962b3e734d8739f7bdd26d70ed22551bb98074e4ef67788c1a866de54b0a21783c7db533364d21056077edd32f6a936370d474e99ad2109843d8189c4b53b3a4ba0767c90641edf56fcc8f970d16d9f403b4cb1d2d2d8d79f71e6ca7acb636bdeba81a139c1e3942450369431fcedf48a1d533470d8041359eb7e697341685c81da8b4036db58dbe1be104a20be940393c7a9d4df4d50c494873f3f1f49947e53a7691e0fd9734d5f3edee4ae0d9f7eb31416f29ac6542d58f0c8f8790e1f3d34b5e141f3834666348f43af06415ac3b1a35089c20abc0bc4b14695d3ee946d0f3008e023820f4e8a66c82b35163e2106863936804bfc6bfd4fcedfd61b846f39dfa76d7e846e0cdb8c8516de5cc02a8d863f9aee8328946569dac2efdcd4e142ffe4b1dbd8d9c40586222c2a9b1c605c267cd5685cd06b077bbc5d83914d4969a6a0986dfe119bf37f6c49f97e8e556ef4491db0a29ff98873bd7ddd59c4d45a35cd38be635e4034f24f5ed995fc2931eb82d00a94691488088df5fdab9838436711465f839ad2974acd1e487ecddf949768b77fca4d8f6798d068418859a3a371d5ebb80b7d1fe7ab312aa12bcd8830e16dd6469166434ed1d40b9a5bc3b18cc51539ca74deba7fceecf87837363ebcb6e1e211e492d68a306bebcba74f064f20d170d6842c00a67c4ebd6a88561ceca36426648e422ff26e936dc0685319867d5b4ee10b94c8bf1fb74ddf2ac0f856a0a2fba8c0e56e469a8955d00d24684a1804ac092dc7210843d42942bfa0a25be24cfa2d3aca4ed323a7c2b4fd322877b302876f56442861e91aa3c803b1aef75eff782c70d1315122a03430548868b822db7df523421bd6af4bcc4f03aa806d61841c2e35eb20e99bd0a40f7cad80f10c3eb535dda5c01c06e5c0eba6e1d0458ab5aaf4808c1f1018d392d384b8187f0a13f81b9eaaa38b2f91403aaf279adeef23a7be90e31c90ce76abf50497ab42b283a79829268a9384650607884f4dcedff98612cf8737a6fd375f3ae194b81948f718bd69c073949a7a8ca95faae2cdf8f5b1bd2648c188e6bc6d06ff06a9c355c17400d7dba16ed052417a5fe7062e9d70f6153639ecb88718315bfe67f4ad38e2957eee271afd8a4990962ad0d60b9ba1c6b7c5388bd24fd9a817d62db0d364c26f7d3d8954b59b4fddd8f21e38afb0e983d36bc242772fc9f0be4c72eb8e9ecc7dfd9b7dacbed6387f90f17f16eef7bcca011db8a785b1713aa923e4ed7f51135ff407faf0a70bc7fb3f2bdd09a76de2a7120648ad3bd964685239f04b76e52322a9061c7f9e7c62cd1062da270dc828c49bbb97331749ac6f99ff8381cfac27e10b1cd1180fe02d5040f22ec896c5828e3c023eae93217962b1a0c093b5e0265909aca11f82731b80dd07c0284f810077e20af8280c6503bc1403024d54a2e4aebd3a45306db9105d99d487378b312c0706671a297343dced9d3d1173cb43d73b6bf4f0b8baa5809169923d24ab8f1af37a11c5b14a69761437e63020f7dd0b774be4c6df08210c44316ef31953388a26fec06d7bc248080f462b0ca5b60affcb8e673481612f7ca91b7f44c98b309a743ee309c446472b098db559ca2ef2a4c6f7c93ec1eb59dab3fa49c640cfcc4c409abe56cd144ece7bf8725354bca9f551fe572ea997557c2c6c03e7e7a9755e4f937a376da23fb0932299ca924ae8451de8ddd76ee26216fc73447ff0e354c85517f73cbab3e0843cccee7220d5d57bb86be1c25ab579e165099370061d6a8a1ada95cbb1375606ef0496203f33637a1b168cae84589ea53d6b3c9de13d774aa23ea157d5fee3650662307fc9e90ed8c4312cf1adaed849e376ed8be053c5cae90af22b97b6f205ba72fd4a566ca3a7d85d3b845a4cc5f51f74e2c9fd19ec8ec99d93a54fc5c58e12443818b66f15ad8bfdda61db4c1589826f2d323a4227011502c854ed097a61d8a78374f2026ec5186365fe074e90d8c2345e8c6465cfb95b8c30551110c502f18a27f999a4913cc97e23120b69632ca66e16ab0205a62cc8bdc099a6d961463b79dfee758676f35cea1027f543dbbf4184a1afb98a07b3473ba1845c1f539dbf1f5731ff42f6b3bc5d11e8e4c67adbc467a9f7198eb77c8dbeb48efd341ae2349ef9dee6ec408c3420f6156a2d9a241651debe2d085b2815d7adbfc5cd050e3f3cefbe6d8d645956bf10b966b52b33a6f891f8168f6c9d14c66fda85ce283bfb83378040c0791ed396ab11ae0ad272e3c133269ad86c1b8ae3566391bf4f810a2377301da0fe9b4c04e2c41309d62228e6cb6fa3e79b1db3f31804d51e280326c080a0fe7e19626c09f2800f92890bca6ae5a720811c61402a28164870c4a50fa9647e83427146043f530f5d321d0933607d414dd22fb83b89eb9ed553717272d27abc620d0572bb30f241fbd5560a61babea87aa520ea3140f4d46d3d6fe44cf6dd6bdeab2ecdaa107a626fb6f9079808e59801cc8f374d7ab4dffc3294f6d337bafeb4c383097ae4ed5e2653b0464e3886e1885c4b901fae5763b7a9dd2d46af1c7108164e7911f2af1ba228e3018183bce0a1c155ba704dfccb6c473a6700946ab1cdeb0a2508f589ca90feb08d448ff43e9eaa4a93f869625c490510c1777ae1735afe5388311791dabc30648ced46c1586d94eba1d9ed5cb8c2f66edc8558669559b2c0604fe0e5c5b2ad680b79144b60f3c348036c5f358a360298437ec7b53c14c329f5bf7bae82630e66e419f172629870d13be498e5a2d423c12f4e6c7834b0637fbbb615ebc7eaebddf4e29f04b5fe890e1a748384df4b75362eb2e42eb0aae86b394d963efb23fe153218ab8342d1ad65895adb668b7235b9eb92bf027f3c930858b5708dc0485f5e3b64eae2bd035af04bc73a7e93378799ebc02d27fc67ff4fa77a30d64da792681eb1e85fd5fb10c995b5b2770b3bf5c5a221d9b5bb23987511188235e092e622ffcea98c843f856897e4bc8487feaae0e52c3d6edb2adf377fb4ef7fcc89e429271356380f7bb5266960dfd757a8c13ea3c8dc042fe5d2ed4160eaa6c36eee2a15d416517d24c64fd427bfbb6a94dae8648fb1948b206de21c991771e39408757b05b1ed4f15"}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r1, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) 15:27:56 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 15:27:56 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') open(&(0x7f00000000c0)='./file1\x00', 0x100000, 0xa0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = signalfd4(r0, &(0x7f0000000080)={[0x7ff]}, 0x8, 0x800) read(r3, &(0x7f0000000300)=""/187, 0xbb) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) 15:27:56 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:27:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x1ff, 0x180401) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0xc8, 0xfffffffffffffffd}, r4, 0xa, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2, 0x0, 0x0, r4}) ioctl$BLKTRACETEARDOWN(r5, 0x1276, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x0, 0x7, 0x1, 0xfffffffffffffffb}) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) sendmsg$FOU_CMD_GET(r6, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x6c, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x3f}}, @FOU_ATTR_PEER_V4={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x40}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r7, r0, 0x0, 0xfffffdef) [ 3471.869119] loop0: detected capacity change from 0 to 40 [ 3471.875827] loop3: detected capacity change from 0 to 40 [ 3471.878888] loop4: detected capacity change from 0 to 264192 [ 3471.886155] FAT-fs (loop4): bogus number of reserved sectors [ 3471.886625] FAT-fs (loop4): Can't find a valid FAT filesystem [ 3471.888184] FAT-fs (loop1): bogus number of reserved sectors [ 3471.888716] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3471.927059] loop7: detected capacity change from 0 to 40 [ 3471.963963] syz-executor.3: attempt to access beyond end of device [ 3471.963963] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3471.965047] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3472.032785] syz-executor.3: attempt to access beyond end of device [ 3472.032785] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.034710] Buffer I/O error on dev loop3, logical block 10, lost async page write [ 3472.110270] syz-executor.0: attempt to access beyond end of device [ 3472.110270] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.111437] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3472.142436] syz-executor.7: attempt to access beyond end of device [ 3472.142436] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.143638] Buffer I/O error on dev loop7, logical block 10, lost async page write 15:27:57 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = creat(&(0x7f0000000340)='./file2\x00', 0x40) io_uring_enter(r3, 0x19c0, 0xed3, 0x2, &(0x7f0000000380)={[0x10000]}, 0x8) r4 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000740)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000005cf8acaa45e91619dc1b1c4c8133aece0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebffffffffffffff00000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006a5bc28642d437dd0000000000000000000000000000ee04b5623f023318ec7b2367049472d4810099978b4e32c74aac6376ad876ce7a324db7d2a068443f46ac9adeac3be8f3fed4b0f0150526b4b43e2a00f6313bad2d10ddfa644ca09ccac7cb97c79698d91faa67ed6a1a288e980e86f04438a1777b5158e533d812ade74a62f14e7c135fc5dab07"], 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r5, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r5, &(0x7f0000000700)) 15:27:57 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) sendfile(r2, r2, 0x0, 0x368ef744) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) dup2(r0, r3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000940)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r5}}, {@measure}]}}) getresuid(&(0x7f0000000440), &(0x7f00000014c0), &(0x7f0000001500)) sendfile(r4, r1, 0x0, 0xfffffdef) 15:27:57 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 15:27:57 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:27:57 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000300)={0x5, 0x80, 0x5, 0xd1, 0x7, 0x1, 0x0, 0x7, 0x20205, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={&(0x7f0000000180), 0x6}, 0xc000, 0x8, 0x200, 0x0, 0xfff, 0x9, 0xfffc, 0x0, 0x40, 0x0, 0x3288}, 0x0, 0xffffffffffffffff, r1, 0x8) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3472.516055] loop3: detected capacity change from 0 to 40 [ 3472.571669] loop0: detected capacity change from 0 to 40 [ 3472.701781] loop7: detected capacity change from 0 to 40 [ 3472.726034] loop4: detected capacity change from 0 to 264192 [ 3472.747148] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3472.752891] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value [ 3472.773705] syz-executor.7: attempt to access beyond end of device [ 3472.773705] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.774690] Buffer I/O error on dev loop7, logical block 10, lost async page write [ 3472.778959] syz-executor.3: attempt to access beyond end of device 15:27:57 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r1 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r1, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f93d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/437], 0x154}}, 0x0) read$snapshot(r2, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) [ 3472.778959] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.781108] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:27:57 executing program 2: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x73, 0x45, 0x8, 0x54, 0x0, 0x1, 0x0, 0x5, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x2}, 0x1080, 0x8, 0x2, 0x7, 0x2, 0x200, 0x8000, 0x0, 0x1d7, 0x0, 0x100}, 0x0, 0xb, 0xffffffffffffffff, 0x8) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) r2 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_enter(r2, 0x2bd, 0x0, 0x0, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r5 = syz_open_dev$vcsn(&(0x7f0000000180), 0x4a80, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x6, 0xff, 0x9, 0xff, 0x0, 0x800, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000340), 0x5}, 0x1520, 0x9, 0x6, 0x0, 0x71ba, 0x2, 0x7, 0x0, 0xc595, 0x0, 0x5}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x2) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff01000000000000040000000000000100000000320000009f937586f66a1b9cc3d2bbf63fd7e71629d7020000000000000000000000000000000000020000000000000000002000000000000000000000000000000000da0000f5ff000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480002007863962b15ef7eaa956c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00170000000000000000000000000000000000000000000000000000000000000000e3debc3f38dd1ca2aaef108e651d000000005eeac0e8ec5d447fecde06001de1e587eb0e76d193ad3800000000000000000000000000000000b07b62c237c058ab7bc93b970a0fee5aefbc57f89f1bcc41562773ba827585c6867fceaba7b1ef4dbe0dbe424a2fb2c45e96dd000bfd22fea5e75257531b1172b2adff9f85b5b58cd0e81fda1faaa9e0585b43e6eb6f6dc73d0a0a9ec90a41ba15c0eb2989ca9205091a988c881c0a9710774500"/452], 0x154}}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r6}}, 0x80000000) read$snapshot(r5, &(0x7f00000001c0)=""/252, 0xfc) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) 15:27:57 executing program 7: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0x5, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000300)={0x4, 0x80, 0x5, 0x9, 0x3, 0x1, 0x0, 0x7, 0x40, 0x14, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x10001, 0x4, @perf_bp={&(0x7f0000000180), 0x4}, 0x20, 0xf800000000000000, 0x0, 0x0, 0x4, 0x5e4, 0x3, 0x0, 0x4, 0x0, 0xa426}, 0x0, 0xf, 0xffffffffffffffff, 0x8) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{0x2, 0x0, r4}, {0x2, 0x1, r5}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, r2, {0x5}}, '\x00'}) accept4$unix(r3, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) openat(r3, &(0x7f0000000240)='./file2\x00', 0x20142, 0xd1) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0xfd, 0x0, 0xff, 0x0, 0x10000002, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x511e}, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xfffffffeffffffff, 0xffffffffffffffff, 0x8) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3472.873227] syz-executor.3: attempt to access beyond end of device [ 3472.873227] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3472.874093] Buffer I/O error on dev loop3, logical block 10, lost async page write 15:27:57 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat$cgroup_pressure(r1, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="cc000505dd0000004c020000ca070000dc0100000000000000000000000000004153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33359e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf00"/696], 0x2b8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r0, 0x0, 0xfffffdef) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000000700)) [ 3472.929859] loop4: detected capacity change from 0 to 40 15:27:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2, 0x5) pwrite64(r1, &(0x7f00000000c0)='9', 0x1, 0x8040000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)=ANY=[@ANYBLOB="010000fe0100001800000000", @ANYRES32=r1, @ANYBLOB="01040000000000002e2f66696c653100"]) linkat(r1, &(0x7f0000000000)='./file1\x00', r3, &(0x7f0000000080)='./file1\x00', 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000240)={@remote, @broadcast}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x100000000) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r5, 0x8010661b, &(0x7f0000000140)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{}, {0x2, 0x1}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000005d80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, '\x00'}) accept4$unix(0xffffffffffffffff, &(0x7f0000005dc0)=@abs, &(0x7f0000005e40)=0x6e, 0x0) perf_event_open$cgroup(&(0x7f0000000180)={0x2, 0x80, 0x1f, 0x7, 0x4, 0x6, 0x0, 0x3, 0x80000, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x543, 0x1, @perf_config_ext={0x4, 0x9}, 0x3400, 0x1, 0x6, 0x8, 0xffff, 0x7e2f, 0x1f, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0x6) sendfile(r4, r0, 0x0, 0xfffffdef) [ 3472.968907] syz-executor.0: attempt to access beyond end of device [ 3472.968907] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 15:27:57 executing program 3: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r0, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) r1 = perf_event_open(&(0x7f0000000080)={0x4, 0x80, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x6, @perf_bp={&(0x7f00000007c0), 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) ioctl$BTRFS_IOC_SYNC(0xffffffffffffffff, 0x9408, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000740)={{0x1, 0x1, 0x18, r1, {0x6, 0x7a92}}, './file0\x00'}) openat$cgroup_freezer_state(r5, &(0x7f0000000780), 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r6, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000000700)) [ 3472.970608] Buffer I/O error on dev loop0, logical block 10, lost async page write 15:27:57 executing program 1: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x2, 0xffffffffffffffff, 0xb) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3473.018003] syz-executor.4: attempt to access beyond end of device [ 3473.018003] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3473.018964] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3473.028845] loop7: detected capacity change from 0 to 40 [ 3473.045319] syz-executor.4: attempt to access beyond end of device [ 3473.045319] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3473.046456] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3473.054995] loop3: detected capacity change from 0 to 40 15:27:57 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) sendfile(r2, r2, 0x0, 0x368ef744) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) dup2(r0, r3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000940)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r5}}, {@measure}]}}) getresuid(&(0x7f0000000440), &(0x7f00000014c0), &(0x7f0000001500)) sendfile(r4, r1, 0x0, 0xfffffdef) 15:27:57 executing program 4: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) readlinkat(r1, &(0x7f0000000600)='./file2\x00', &(0x7f0000000640)=""/190, 0xbe) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x60a402, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat$cgroup_pressure(r2, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)={{0xcc, 0x5, 0x5, 0xdd, 0x24c, 0x7ca, 0x1dc}, "4153ea8be896e502f55e270ce86a0dc9bd8e0fce0dad337feb82e33b59e65a9313390bf613013544e2a79f587bef4b2c6529f274b28816b826948d55912e6e5d0b93d9e8f68804b3ad151bbfdc6ff29988d70111c487529215ae55201124c09b2c47f2022d1184c443bf3e438916fb8a26c4a8c4599e379a2a91181d3ccbf91279978975e40645ad7e748c02edee87a648308880f9b506cf", ['\x00', '\x00']}, 0x2b8) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000740)={0x0, r4, 0x5, 0x4b, 0xffffffff00000001, 0x200}) sendfile(r3, r1, 0x0, 0xfffffdef) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000700)) [ 3473.145560] FAT-fs (loop1): bogus number of reserved sectors [ 3473.146027] FAT-fs (loop1): Can't find a valid FAT filesystem [ 3473.277931] loop4: detected capacity change from 0 to 40 [ 3473.345495] loop0: detected capacity change from 0 to 40 [ 3473.993711] FAT-fs (loop1): Unrecognized mount option "./file0" or missing value [ 3474.530481] ================================================================== [ 3474.531463] BUG: KASAN: use-after-free in __lock_acquire+0x42c9/0x5e80 [ 3474.532310] Read of size 8 at addr ffff88800e7d4278 by task syz-executor/17062 [ 3474.533227] [ 3474.533462] CPU: 0 PID: 17062 Comm: syz-executor Not tainted 6.1.0-rc2-next-20221028 #1 [ 3474.534470] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 3474.535505] Call Trace: [ 3474.535838] [ 3474.536133] dump_stack_lvl+0x8b/0xc3 [ 3474.536656] print_report+0x175/0x478 [ 3474.537164] ? __lock_acquire+0x42c9/0x5e80 [ 3474.537735] kasan_report+0xbb/0x1d0 [ 3474.538242] ? __lock_acquire+0x42c9/0x5e80 [ 3474.538818] __lock_acquire+0x42c9/0x5e80 [ 3474.539384] ? mark_lock.part.0+0x0/0x2f80 [ 3474.539939] ? mark_held_locks+0x9e/0xf0 [ 3474.540504] ? __lock_acquire+0x0/0x5e80 [ 3474.541047] ? finish_task_switch.isra.0+0x22d/0x8b0 [ 3474.542069] lock_acquire+0x1a2/0x540 [ 3474.544264] ? kmemleak_scan+0x1a0/0x1610 [ 3474.546156] ? lock_acquire+0x0/0x540 [ 3474.547629] ? __call_rcu_common.constprop.0+0x589/0xa50 [ 3474.548341] ? __call_rcu_common.constprop.0+0x589/0xa50 [ 3474.549068] ? lockdep_hardirqs_on+0x79/0x110 [ 3474.549683] ? _raw_spin_lock_irq+0x41/0x60 [ 3474.550259] _raw_spin_lock_irq+0x32/0x60 [ 3474.550819] ? kmemleak_scan+0x1a0/0x1610 [ 3474.551374] kmemleak_scan+0x1a0/0x1610 [ 3474.551913] ? kmemleak_scan+0x0/0x1610 [ 3474.552450] ? strncpy_from_user+0x204/0x3f0 [ 3474.553026] kmemleak_write+0x570/0x690 [ 3474.553548] ? kmemleak_write+0x0/0x690 [ 3474.554075] ? debugfs_file_get+0x1ce/0x460 [ 3474.554651] ? debugfs_file_get+0x0/0x460 [ 3474.555194] full_proxy_write+0x11d/0x1a0 [ 3474.555736] vfs_write+0x2cb/0xda0 [ 3474.556233] ? full_proxy_write+0x0/0x1a0 [ 3474.556783] ? vfs_write+0x0/0xda0 [ 3474.557269] ? lock_release+0x3b2/0x760 [ 3474.557803] ? __up_read+0x192/0x740 [ 3474.558301] ? handle_mm_fault+0x696/0x970 [ 3474.558890] ? __up_read+0x0/0x740 [ 3474.559376] ? __fget_light+0x212/0x290 [ 3474.559909] ksys_write+0x127/0x260 [ 3474.560432] ? ksys_write+0x0/0x260 [ 3474.560941] ? syscall_enter_from_user_mode+0x1d/0x60 [ 3474.561637] ? syscall_enter_from_user_mode+0x1d/0x60 [ 3474.562334] do_syscall_64+0x3b/0xa0 [ 3474.562837] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 3474.563506] RIP: 0033:0x7f36f03b05c3 [ 3474.563991] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 3474.566257] RSP: 002b:00007ffe780e2e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3474.567221] RAX: ffffffffffffffda RBX: 00007ffe780e3498 RCX: 00007f36f03b05c3 [ 3474.568120] RDX: 0000000000000004 RSI: 00007f36f0466ed9 RDI: 0000000000000003 [ 3474.569039] RBP: 0000000000000002 R08: 0000000000000d91 R09: 00007ffe781d5080 [ 3474.569939] R10: 00007ffe781d5090 R11: 0000000000000246 R12: 00000000fffffff6 [ 3474.570834] R13: 00007ffe780e4ef1 R14: 0000000000000000 R15: 000000000035024d [ 3474.571749] [ 3474.572060] [ 3474.572289] Allocated by task 127: [ 3474.572753] kasan_save_stack+0x1e/0x50 [ 3474.573289] kasan_set_track+0x21/0x40 [ 3474.573810] __kasan_slab_alloc+0x58/0x80 [ 3474.574361] kmem_cache_alloc+0x1a9/0x3f0 [ 3474.574907] __create_object+0x3d/0xc10 [ 3474.575425] kmem_cache_alloc+0x235/0x3f0 [ 3474.575968] __alloc_file+0x21/0x250 [ 3474.576453] alloc_empty_file+0x6d/0x180 [ 3474.576985] path_openat+0xd4/0x2a10 [ 3474.577476] do_filp_open+0x1b6/0x420 [ 3474.577974] do_sys_openat2+0x171/0x4d0 [ 3474.578502] __x64_sys_openat+0x13f/0x200 [ 3474.579047] do_syscall_64+0x3b/0xa0 [ 3474.579558] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 3474.580240] [ 3474.580482] Freed by task 13: [ 3474.580891] kasan_save_stack+0x1e/0x50 [ 3474.581427] kasan_set_track+0x21/0x40 [ 3474.581948] kasan_save_free_info+0x2a/0x60 [ 3474.582528] __kasan_slab_free+0x106/0x1a0 [ 3474.583090] kmem_cache_free+0xf7/0x620 [ 3474.583622] rcu_core+0x7e2/0x2090 [ 3474.584107] __do_softirq+0x1c3/0x8f5 [ 3474.584636] [ 3474.584861] Last potentially related work creation: [ 3474.585486] kasan_save_stack+0x1e/0x50 [ 3474.586006] __kasan_record_aux_stack+0x95/0xc0 [ 3474.586637] __call_rcu_common.constprop.0+0x6a/0xa50 [ 3474.587302] kmem_cache_free+0xbd/0x620 [ 3474.587832] rcu_core+0x7e2/0x2090 [ 3474.588315] __do_softirq+0x1c3/0x8f5 [ 3474.588842] [ 3474.589063] Second to last potentially related work creation: [ 3474.589790] kasan_save_stack+0x1e/0x50 [ 3474.590324] __kasan_record_aux_stack+0x95/0xc0 [ 3474.590938] __call_rcu_common.constprop.0+0x6a/0xa50 [ 3474.591600] __kmem_cache_free+0x91/0x410 [ 3474.592141] skb_release_data+0x6d8/0x820 [ 3474.592713] consume_skb+0xc2/0x170 [ 3474.593202] mac80211_hwsim_tx_frame+0x1f6/0x2b0 [ 3474.593816] mac80211_hwsim_beacon_tx+0x562/0xac0 [ 3474.594443] __iterate_interfaces+0x2d3/0x570 [ 3474.595043] ieee80211_iterate_active_interfaces_atomic+0x70/0x190 [ 3474.595866] mac80211_hwsim_beacon+0x101/0x210 [ 3474.596481] __hrtimer_run_queues+0x541/0xb60 [ 3474.597073] hrtimer_run_softirq+0x172/0x350 [ 3474.597643] __do_softirq+0x1c3/0x8f5 [ 3474.598145] [ 3474.598366] The buggy address belongs to the object at ffff88800e7d4260 [ 3474.598366] which belongs to the cache kmemleak_object of size 240 [ 3474.599931] The buggy address is located 24 bytes inside of [ 3474.599931] 240-byte region [ffff88800e7d4260, ffff88800e7d4350) [ 3474.601373] [ 3474.601601] The buggy address belongs to the physical page: [ 3474.602292] page:00000000042e4e1e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe7d4 [ 3474.603442] flags: 0x100000000000200(slab|node=0|zone=1) [ 3474.604143] raw: 0100000000000200 ffff888007c4f780 ffffea0000644080 dead000000000004 [ 3474.605121] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000 [ 3474.606075] page dumped because: kasan: bad access detected [ 3474.606773] [ 3474.606994] Memory state around the buggy address: [ 3474.607613] ffff88800e7d4100: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00 [ 3474.608544] ffff88800e7d4180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3474.609462] >ffff88800e7d4200: 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb fb [ 3474.610381] ^ [ 3474.611263] ffff88800e7d4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3474.612162] ffff88800e7d4300: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 3474.613074] ================================================================== [ 3474.613967] Disabling lock debugging due to kernel taint VM DIAGNOSIS: 15:27:59 Registers: info registers vcpu 0 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff8245057c RDI=ffffffff879a19e0 RBP=ffffffff879a19a0 RSP=ffff88803a447250 R8 =0000000000000001 R9 =ffff88803a4471db R10=ffffed1007488e3b R11=0000000000000001 R12=000000000000002d R13=ffffffff879a19a0 R14=ffffffff879a19f0 R15=ffffffff879a1c50 RIP=ffffffff824505d1 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555555f91400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffe60a2aa40 CR3=000000003092c000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffff0000001000005607fb22cbd0 XMM02=ffffff0f0e0d0c0b0a09080706050403 XMM03=696e656420737365636341002f737973 XMM04=5347415400313d524f4e494d00373d52 XMM05=5a494c414954494e495f434553550030 XMM06=534b534944006b7369643d4550595456 XMM07=414e564544006b636f6c623d4d455453 XMM08=49006d756e203c2069000a313a56000a XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000005 RBX=0000000000000005 RCX=0000000000000001 RDX=0000000000000000 RSI=ffffffff85207960 RDI=ffff888042bbda40 RBP=ffffffff85207960 RSP=ffff88801f1f79e0 R8 =0000000000000000 R9 =ffffffff8590b457 R10=fffffbfff0b2168a R11=0000000000000001 R12=ffff888042bbd040 R13=ffff888042bbd9a0 R14=00000000ffffffff R15=ffff888042bbda40 RIP=ffffffff8436d853 RFL=00000097 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f2d6d1ba8c0 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f2d6d5d2ae0 CR3=000000003d0f4000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=25252525252525252525252525252525 XMM01=00ff00000000000000ff00000000ff00 XMM02=00ff00000000000000ff00000000ff00 XMM03=00ff00000000ff00000000ff000000ff XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=ffffffffffff00000000000000000000 XMM06=00000000000065616124242f6867632f XMM07=00000000000000000000000000000000 XMM08=49006d756e203c2069000a313a56000a XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000