81739a1a9c905f8a078a72b2add72c9e6ca245bcd0fe7468dc17d03dfb0bb72a53182ca3b87b82aac671c1204b6adf17cc0dd89b5719b09d87fdecc1d6030bd27acc3e26515c5993e0f466e71cbde0ab92d01dca25159484c7a482f25e1bf05d4a833c7df78089f20349104dfb09f1386bbd7c192b5db8f36965731af87a5130c8610d06e8291f995b958c1e6d74e977014becee1b19936bcc720127fc59abdb303f44b189f91d481e2cba89d41aed2f1b37386b7350d83b61b102a4e186163b6048c6912181f3082566c48ee63e9e00232f5bcb20653122d7904fbcbbbc3d40667c35c76a1950954eebea56406711b21dc45e90a3e8842a4dc6d022101b7c389dc3ce41384f2d3b4ec3cb3a3c1971e15da88e622c9dba8b33c6ddbf470a61f3e7d24952f78f7d625f1c8f9d374d9180a36b50216dd56842ecb53f57d8a493c7e300437472fa2681097f5788e176b5cea355569699c5820e9d09b2a1ab606358aadd9bfe4a744a5e3a988c97712e96c5ab961fa7b8fcf7ca6233cb3fc9f1962269afa5476aec4e2a2a97b35182771e8cf42415b3e323c291042a0c609b1fd46a9ce0c2ce70cd373df3da1683c513e13bb458880b92a65ab99418f6fc142aa5d77d0ef3b735b3ae4b146739ba90b49bbd75391aa586f6bea474e99228658621267cf69248091eb244a6fa6885afb467a135d360aade0d86f838fc03460e748f610722506c77bf77bd2a6e10e7d1050c37005f930ded93cb8690362be7dedf52c2613bbec7097338194620a5acc2586582783a39567af29032c5db5980b685a94a3e97b21a484a09969a84c3c98ff25959d035d56d519e1b24fd21126abb783136413e70f326f94f899910bb5f79d7fecffbf0996cfdbedd27760ad687a22859eaded73ad7233aa7be3b235416a9a8086230424afd601a89d62716598a548e499858334a670f3db6a3856b12291d7bca673bbaaae7e30451fee276cc759eb6702cbef1d67f8c1b995e03a565f10606621094fa271e14eea617b188823134e2e5631e823f02cea58f193a0107ff9d4efe227269e5ae629d8a7eb7a72164de5a8f97e17984eaa3fc55a424f385d861fca4ab983f8dc4bc4ffad96f2d13f26ee7416d7fc6f0b48ee19cf0ec55c512257ddf75f2bd06df2d3b9510aa95dd6168ff99ccffad02a46fca88de1db03199e8c837c70f9d285602cc75565c6ba7d4e50c2bf61c9e770dbd7fd969e7c85b4f842c5a8eded0a09d90e084825076cf0269dacae6a2454291fb7a213c4305a80dd533a8fd552ff9a7ad8c7c94737a7a2cbb3d6fec6373b6bdf7879b93557e9e3b01095cedeeafc9e42c914c54ac380cbe8a80d47444d7b8f55c2e628c976e0e3da4357b1cc3de998e7b84e6fb91cfe52fe39c28cbbf3a41920a6218d0af64d904a9536eda8834362226913693444761a21e72b99b033537557b99da7e58ce2be777c09644f069851790fdb6eabc1af09a0206d321ba8bf7c3776a9b0f40a8e7a3a70aa4b7a69a6c76ab4d8611d97e7d2a9947a45c6b840510fedf7f3c0a121a8d15cfa1ce9f5f58e1b1f5c3c1db21f7400d77293ee95f0a9f157a8a9fc56d5378d9f1442b55afac65a188056aa013af3a2ed6efbcca9d98aa10c9f9caa3f522925bcf5d4321dc9bbc848cade6179d865f937f7ee795084941f2b622171837440a1e15963f2238e0085b12ab99b467e959b432409e2b5fa2f0dd7c1be564689885958850d064de43b6b43955d8966df6b066fd1f5af4fdb6bcc92342211fe5e58ed7ecff580e0a38a2ac93383fe609ef2d92f3ecc70dd29b4560dc34bcff57707f1ee9d9f455ad1d1b59cd97bdf42544c99de8ec5536c6e812322a5bb990220cf6a06416681ce2a90bb21e824c97c2d91c858c6ec33ae59d3b1c3a66c013e17e1b79976916c5503267ae895e37e42c76f9e7a56782482449fbdd079ae7b461f9583cb223c17e7723c7ee1053f9cdd85fc2601b5ec4f246643b463e79f2bf6525d5b80d4ce179d17dc5e5a6d9a46080568b92f59c5cf123800b870d6bca9649376e27cb468d85bd5e4b0d670d7f83bf0c29164a0bb2de99469d87357c936110b66d860ec11e6ecbfc33d162ff6b5b346b0260606ff215a7703f30d57699dd3f7acce40ffb7589eda5634945b7b69b9911a1cc47d962cbc4c82f2948268ebd8545f036eee0da77d7b7c8d7ac31e1f40b15fa00f35d1ecb0ea27949bc592e2c0263e8ff1904af33cf5564961926ed887551f093c830d6a25d74b36dcaee32b170c7836ff466f6f77008c3cc52ceab0875849d8d32336c4bfda6ae008907b6050f13eeb97ee957ecce3bdaf993f15701a4fbfb5e10d4dd4c753b9b32891f94a1b47c06cc05d2045e5ebc0f88cd4f53713d90bf1c5c6ab8657fe17ca565e2e3b67b0d6b5b33c43cbc490431004ace46eb8d8a45e6500a30ed8f5c74c69807d3ecd738e51b5b7660618bfee7268da01ca6114ae54375ca8bbc06750cfdcb2da3617ec7c6d2bea390ceb163f4cbddbb8d36639e0e4b63f7907ed22e981a6c5dcfeee0a330b66287fb9baccd2442d5e2daf6a6dff922768c0b3a19c79445f39196498c91aa8350c3c2fc0fc457b39e95f09c23b3c9e61e73f8ace98c1e87d93a45d36e0329dc92213ee1daff2147a60ad53ca09d59765bbc74c893b568a0010fcd0278f4a3866727881a6818007b9846fcdc49d9b0d6a5d31f1ed4e06e05554c81790e9b9c607478f0bff681edb9b5d5b6577bd002933ac80ce9fc99d84aef8d6335ef58095686732f0898e79005039cc70f2d74f510c2b60c610544e1389a3182a7e5e5c6f7091288a711574b851a91d5ab4c999801791f68a7c5c64526a07f5f82cce703f29056445c3acc5bb2d66f8d23b80959bc6e1a94b44fbceb0136a852d76dd2c5d992f17c4ddd1e3c0027ebe18efa09ba7bc2156594e14a5559be6843eaad146508e495fbd7364d98f7445fedcab58ef20af243d9696c4ef52c2937732f16ef98d9e294fde5524dd5643e90d6dfe50fcf70b5f5ed03a90a286a6d34c85a8291d4485636334c805b8d15d1e303d91773f496e385f396bde262bcd5c772ff3f32d9cada5506ef743877872b42d4f6cbfe2e65904b1a4d34aaeeb7a8e887271efe40f6fa30bf7cf1c0662b199a95d8b98ce63c89f3bf2daf47e7190cbaa2d7231b2e73fa1aa2db9de03d752af13327a3e043d7cbe75ffee2ac89d4a4ae338a2853669ed37e7ec763d54e1276f4f19c128b04605c48bcc33eb672c095ba25093124648c80aad6ddb881bd35d07d94e061b3b816e3c2de0caa51e5d408fad8b8c7e02415f12377f093c971e2f9db0f55359258dad36f52024c434a6324e8c06b917c60b0ae83128bcd6119d3e8b76ed6ce253bfcd07212d014eb6742c10d7fb68215c632f7b19099d1cd4cfe4c482a6f397cb44bd562704d1315a180a7672d906bc2f6455aa682025a14950052c56395b20919f83dd301f07b92c051c2711643faf5dac186cf2df54d56f195c27d2427c578759bb36ff952325a60683ae69c0ecc5c134e63120d2846afc2805f0896ecb0d4f1d4471a3977bc0be593c1ac6b42c23f41b84fbba7557fcf653eaa5b06ae5b2ae6a166df677a613c1f3ea0d929e0f51ce28bd38c5155aacebb765d5dca527e273427438d0bdc229aba5767522479c528aac2286c6aef63f5d6ff66dda6245260e19e355aca3db7d8ef1162595ddc3d3984e83117cc8ccea7f621d3b20b7875ea38cfcb42376148b863507b3a8edca993fecded4dc0efee51eb8e2da29c7ac03d9189475d4572e426270b679033d7839f8498e1d139a79bac0ce5df9432e21f5dcce9893410ef505041bf38c5f57a854be2fb8c3bb9543d51f7fee19850fb53ca6590b774d3d6ff76c05fca8ad8a6b899c1ccd2e6bb7aaec06f324b3ec0b381c1f3f6d456a8cb0aa86c9848d207d61f899ecc294d09adb0339310d696a33740f1a4d1046a09dcff6e870d26318224ad9b21e1d2265c593bc86838d836b1e26ddc586c7e92ba009c92e7c830ff34ed6dac9b2f41e668a8bc5f0fe4499b7ac75a09ff76a9876a4d9cedca7bae9967ce77b8feb51cb3222e1206ea650553f670674199e130eedb0a4341688bdbf8bc3d9cda77b879a120efe205ee33cd0f1bf08f61aae190cb5a6a41d425f489065b645be55282acbe4ed93b550821e676e6696adb7a580833d386eae51031cda000c45e800e7b6c9bbfdd516a232976a79cc39fc047b36d9f0bcd3fa493b80c614fd31119fd5d41480ea4a44c740ca8f4f912226de5972e4334cf8f4f40169a78cf2c7578074d9d565903e0a0a8be5dac68badf3881dca02b3d853f70855681ecd99d2c1bb32ba1315f5632f1034a8b4b59479d2337d450cc798eb39c30a31f74447e3f802bbb7e8cbb00af5f1347d1c7ece4c25f81e24a7b5d25b4a2f3d190b4dd3d069bc24f3250ddea1d022c74d7b448c3f85e5a6595842e836a31448b3f2e33eb8c49cc6c6e824386d9ffb7c5e9a64b3a65d101ba46857e428a9c5d5686f189e1183a23d34dfabbbe6018d38bd1302aadc43d8487dd76fc05b12b676b7a435223a2efc4ac6fd4c0a22ee106e3e4d91876ae974fd9bea4fd0796b4bb9e64048445579e8e34012e8efa1e2b33c15ba9db1010a2a245bb87baf2cacb57db9ddccc7db1a705c66868eacf7c9b3520abcd5bee8942619081ad46aa53215fe1835327ee06c2340e1759807bd6376f67efd1e72d6891ac6a9f74075fcdf250cdd463f212e15fef09bb0c46284f23ce7be1e028c6403277ff122758c5a81cf75b1ad99e0b6e602caa3053280d5948b2c96833eb1e2fab6dc6b93b2cdd59a40f53a659d9f65e1a402c8bf1dd694bd36a1cc1f111a1c8e4b64bff2882e018c1c8e8c51d94b8e7000143a1af2d3ba29981a6f100b9e3ea18b0cd5bb84757ab2a93812539fea266c2f2a03bffa40e0c9c916cbe70b4ba653bd0f59a4bdf04e3976de2dca017b550264fc97bde94df0d85e888ae7ff513a7017f1e005b98cfce441fbcc7b70d36f663244f030960f648d3ec3e51834536582bff0dfa3befd5b58ccd03c1ac91ba6f98bece2c418b9714774bd6882017c6ae"}, @calipso={0x7, 0x18, {0x2, 0x4, 0x9, 0x9, [0xfffffffffffffc00, 0x8]}}, @enc_lim={0x4, 0x1, 0x1f}, @enc_lim]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x1}}, @tclass={{0x14, 0x29, 0x43, 0x4}}, @rthdr={{0x28, 0x29, 0x39, {0x3c, 0x2, 0x1, 0x3, 0x0, [@dev={0xfe, 0x80, '\x00', 0x26}]}}}], 0x12e0}}, {{&(0x7f0000002dc0)={0xa, 0x4e22, 0x2, @remote, 0xcf43}, 0x1c, &(0x7f0000003240)=[{&(0x7f0000002e00)="f9058091057b768a9106705121f3a034d7ba29323f2b0899afb202561868e34bbefed4e2dd956a125bcf3ec07ead67e21e38a36459d79e6a366efdf700c027872569820f405027d09bf25c400432a83f77ded1b8039a5d568827da7c8752e1964ef9211e7c6adb6e7a37610d4ecad5cd19bb19f8e7a2d0f1ecf264d1747aeb01c5000f1221af3e6682a4a7e8251dd76fe2", 0x91}, {&(0x7f0000002ec0)="b7bb70b1ddda224051bf717c722949224bcf15b0db0d656e653d8276d03c", 0x1e}, {&(0x7f0000002f00)="532b4b25a44fb59aeaaaaa756da0e378031d9dd58f4b27bc858e5e8738bf5771adb0e53650a096e1a0d802c29c167e59c6335ea82f709a4078fe542556e9af9fed458d069c6f39a9e54d7682ff785f511e2ac3fe901283d608a0aa9d3f2dcfb4d4f7586abaccb08499f2b35b2f80d24e368722724dbe71b64413139fe70c2d2a8f5ed24547ed6d6beb73211e4b15fc09692b45c40f645b1141edb37902d3cee2ab6ce9c1ad932425ba7da768fabee979cb8223731ce0c17d889582457c34c3b7fd10cd6f341a4c25fe9830856113c5237b24f62beb94ca93661a26016a0e1baeb31bfcd7365e0c24f61272", 0xeb}, {&(0x7f0000003000)="c1b6249e4c51f48f7366a188ec5b060856a73358c42fd0210c70e45b83d2690ceb8a0b10f20332db4518bf39aeb3d564e8b764416f201bc6a452bb93889a770e74e43fb17191c70a0f2ea06f05434d332bf5a59cbc7ebff61fe8b51aac774c1608198f690dccab95b69f99d300249bab24a15118ed9174a5924acc27ed9a7915a55fee3dec0976580bf805ad481f8668e723298b8fa507cb0261f311e981774f8b0bc9c41314175f274f42fa6b3ab0aae358f804c94565867df100d2e6b8fa94", 0xc0}, {&(0x7f00000030c0)="35fdef32ffb518c5ee5562912cfd15826532d57573f82a60d454801a5e1159220f6c9dadf499f98de1b66828c66d9dc1e65a6428e3958bbbee409083794e6bd684b7ef3376623fcd368a508b79c35c137a27742b7117c547", 0x58}, {&(0x7f0000003140)="7c2585c083a2d3fb91dd6fd745b2753eec62f48e5bfdfde567044fbf03c1feaec3e78697f5cbc413c704ecc12a2b75447895c53054f08e4bb4075bcea01ce22e8d707efa0b5577c9e42e5b5c6b2cebe89493015c44db8eb21b6030a04943486ec57f2327beeeed7ddc9b6217d82aae2559d0875210d3743ca90c3aacd10770e43504c2ad578834bf16a10b7b6047373f6a27ef785057cab08351090d9db97d6bb310fc0283bb035a57e85c8691aa6f25e5ca48ad41b19fb8bce2834e0a794985e3637b339da5d88093e6293d3d73733b8d4789a1b7f555b38b1a5f856caeff017d25cfd6c807", 0xe6}], 0x6, &(0x7f00000032c0)=[@hopopts={{0x30, 0x29, 0x36, {0x3b, 0x2, '\x00', [@ra={0x5, 0x2, 0xfbff}, @padn={0x1, 0x1, [0x0]}, @ra={0x5, 0x2, 0x9}, @jumbo={0xc2, 0x4, 0x697}, @jumbo={0xc2, 0x4, 0xe25}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x200}}], 0x48}}], 0x3, 0xc011) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x1475, 0x7, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) perf_event_open(&(0x7f0000000300)={0x5, 0x80, 0xef, 0x5, 0x1, 0x7d, 0x0, 0x1ff, 0x4a000, 0xc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x1, @perf_config_ext={0x1f, 0x2}, 0x400, 0x8, 0x5, 0x7, 0x9, 0x9, 0x9, 0x0, 0x1ff, 0x0, 0xfff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) 06:50:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f0000000380)=""/109, 0x6d, 0x3) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) perf_event_open(&(0x7f0000000280)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, @perf_config_ext={0x7, 0x7}, 0x800, 0x2}, 0x0, 0xfffffffffffffffe, r2, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:50:46 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 43) 06:50:46 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31) 06:50:46 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 59) 06:50:46 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0/file0\x00', 0x202b82, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = accept4(r1, &(0x7f0000000340)=@l2, &(0x7f00000003c0)=0x80, 0x80000) ioctl$sock_bt_hci(r2, 0x800448f0, &(0x7f0000000400)="f8f47fdc1bbf5f4cdd3c1fad55ea47f023dea872d71e9e9745f2e260e6b0e7999616ff979a40664565714c51d8f4b6070310e2ffe03794fcb615f36a9917c0b934dce8edee36112ecb90e9d5f6b1e88e377ac88845cea4f462a900e0e546de357e3bfcf8cbf176f41382f40b8f73d8957ad4cc0acaa2cda593011c33607c6aa2797a9ad650c3ac") r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r4, 0x0) lsetxattr$security_capability(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040), &(0x7f00000001c0)=@v3={0x3000000, [{0x2b94, 0x8001}, {0x3ff, 0xfffffff9}], r4}, 0x18, 0x0) perf_event_open(&(0x7f00000005c0)={0x5, 0x80, 0x2, 0x8, 0x0, 0xff, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000580)}, 0x3c40, 0x5, 0x7, 0x6, 0x2, 0x4, 0x2, 0x0, 0x80, 0x0, 0x28}, 0x0, 0xffffffffffffffff, r3, 0xb) [ 2696.855309] loop2: detected capacity change from 0 to 40 06:50:46 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0xfb, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x78}, 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) [ 2696.860546] loop6: detected capacity change from 0 to 16383 [ 2696.871692] loop7: detected capacity change from 0 to 16383 [ 2696.872470] FAULT_INJECTION: forcing a failure. [ 2696.872470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2696.873717] CPU: 0 PID: 11263 Comm: syz-executor.7 Not tainted 6.1.0-rc3-next-20221107 #1 [ 2696.874510] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2696.875291] Call Trace: [ 2696.875548] [ 2696.875774] dump_stack_lvl+0x8f/0xb7 [ 2696.876179] should_fail.cold+0x5/0xa [ 2696.876578] strncpy_from_user+0x38/0x3e0 [ 2696.877002] getname_flags.part.0+0x95/0x4f0 [ 2696.877482] __x64_sys_mkdir+0xde/0x150 [ 2696.877876] do_syscall_64+0x3f/0x90 [ 2696.878264] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2696.878785] RIP: 0033:0x7f318bafac27 [ 2696.879153] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2696.880861] RSP: 002b:00007f3189070fa8 EFLAGS: 00000213 ORIG_RAX: 0000000000000053 [ 2696.881603] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f318bafac27 [ 2696.882293] RDX: 0000000000000004 RSI: 00000000000001ff RDI: 0000000020000100 [ 2696.882992] RBP: 00007f3189071040 R08: 0000000000000000 R09: ffffffffffffffff [ 2696.883687] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 2696.884375] R13: 0000000020000100 R14: 00007f3189071000 R15: 0000000020014900 [ 2696.885104] [ 2696.899897] loop5: detected capacity change from 0 to 40 [ 2696.900582] loop4: detected capacity change from 0 to 40 [ 2696.901753] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2696.904453] EXT4-fs (loop6): get root inode failed [ 2696.904977] EXT4-fs (loop6): mount failed [ 2696.981175] syz-executor.2: attempt to access beyond end of device [ 2696.981175] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2696.982509] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:50:46 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 60) [ 2697.009134] syz-executor.4: attempt to access beyond end of device [ 2697.009134] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.010368] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2697.059039] syz-executor.4: attempt to access beyond end of device [ 2697.059039] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.060810] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:50:46 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 44) 06:50:46 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32) [ 2697.155381] loop6: detected capacity change from 0 to 16383 [ 2697.209311] syz-executor.5: attempt to access beyond end of device [ 2697.209311] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.211212] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:50:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) openat(r3, &(0x7f0000000240)='./file0\x00', 0x0, 0x8) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:50:47 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939610ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') write$binfmt_aout(r2, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYRESOCT=r1, @ANYRES32=r4, @ANYRESDEC=0x0, @ANYRES32], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xc) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2697.255476] loop7: detected capacity change from 0 to 16383 06:50:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47) [ 2697.274171] loop2: detected capacity change from 0 to 40 [ 2697.345075] syz-executor.2: attempt to access beyond end of device [ 2697.345075] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.346959] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:50:47 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 61) [ 2697.379921] loop4: detected capacity change from 0 to 40 [ 2697.411881] loop5: detected capacity change from 0 to 40 06:50:47 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 45) [ 2697.494619] loop6: detected capacity change from 0 to 16383 [ 2697.545980] loop7: detected capacity change from 0 to 16383 [ 2697.556307] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2697.559876] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2697.561017] EXT4-fs (loop7): group descriptors corrupted! [ 2697.575152] EXT4-fs (loop6): get root inode failed [ 2697.575849] EXT4-fs (loop6): mount failed [ 2697.621671] syz-executor.4: attempt to access beyond end of device [ 2697.621671] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.623154] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2697.640122] syz-executor.5: attempt to access beyond end of device [ 2697.640122] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.641665] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2697.676319] syz-executor.4: attempt to access beyond end of device [ 2697.676319] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2697.677668] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:51:02 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33) 06:51:02 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 46) 06:51:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48) 06:51:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) futimesat(0xffffffffffffffff, &(0x7f00000001c0)='./file2\x00', &(0x7f0000000300)={{r2, r3/1000+10000}, {0x77359400}}) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:51:02 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 62) 06:51:02 executing program 0: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000100)='./file0\x00', 0x1, 0x2, &(0x7f0000000200)=[{&(0x7f0000000400)="601c6d6b646f7366d8a02b00010100b901c8e74699c406ee28c63bb7790440002000f80100", 0x25}, {0x0, 0x0, 0x2800}], 0x850020, &(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYRESOCT, @ANYRES16=0x0, @ANYBLOB="1a444b66f6d2ed9fe37ba0e83bb2b90147cbaeda0c0c5cc3886bc5a3a3", @ANYRESDEC=0x0, @ANYRESHEX=0x0]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) fcntl$dupfd(0xffffffffffffffff, 0x406, r2) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd6949392d2ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1036abac0000000013a09d78dc83556b2e91770b5cec85615ec2bbf1f6a0008f5cc2d20bac8966d23d4234d0b246bf896a60f9870680c831e69add4caf"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) creat(&(0x7f0000000040)='./file2\x00', 0x9) [ 2712.610668] loop4: detected capacity change from 0 to 40 06:51:02 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f00000008c0)=ANY=[@ANYRES64=r0, @ANYRES16, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = syz_mount_image$tmpfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0/file0\x00', 0x1f, 0x7, &(0x7f00000007c0)=[{&(0x7f00000003c0)="5e2662d63c9cb52fd6af78643870610b12d72fb10c8b76f5110b63b74d174f73b04a96b12c99ff913deebffbb0d6914f26de619cbf4f47550cb552cc0ebe53a41aba46e20c4a6dbd6be2d671d413f6195eed71b0c8965f63f6156df5f2edb5332e72f40ebca39b5427cb162559c9e4f22d2debb7e80e790a691c46c5dc207cb1d8a6ba0558452c542d41d70c2f4219491fa53dbbf8fe09b692ce1843a287dbf7fe05d82e965b06bc", 0xa8, 0x4}, {&(0x7f0000000480)="ee81f5531758cf855a71103fd676da3ae5280ca3983aff703c08ee291361010b535ca49eb9c3dd3a095f6a64224b74ad906c38ced4af77df2df4ec60815711a96586665e127a91a4aa307c8dbe1cbf075cfd439cc0a8640183dfeca3f84ccd08a018840c2c1fe9dd66ce8e6c5ae8877ada5598ba932c40291bcd929f4ae18a55c2e7ecd8de3ace50f4e7f079d95b35433f4e275c866b96174eff767ed6c1e436c20b5d1d983e06232d03d0652e0cf1d06bb7e2fce7a4587595523a6a5be392497fb0818d34eb3e74ec662ee2f329c7395a2a037f9c3c58c0cb345196785d92faa6734164999b92f91ff728b3ac351216b62f56aa77", 0xf5, 0x80000001}, {&(0x7f0000000580)="9ede686fe73cbb4649afd5420ac7ddc2504ae3edd6e9d435653bbd38329da14f66b433dc46de51cec3699e4b1032aa027fab6c1882d86d6e89e1bc6e9cb01c5e269084db2b502fcf17c2f234e8a2960b19a7b5240abdd253f97302cea6c2c7afbea0a53a155a7372f57e72d157ec8d2c747a87e501c0975555d50b20e49f34367183ce732585851bd1ff5665acde3593ffd97cb7d277f0318d341cfe54032b44feb51b28fed3bd043471a99a0f66c44db6", 0xb1, 0x3f}, {&(0x7f0000000640)="f9dd7b359d9e6efce343e79308731a4d87a1b5f2b7733306fac94732baceebd0b2da252a92c9bb165f388b9f3feb83adcd80861da4", 0x35, 0x2}, {&(0x7f0000000680)="70e4084f6401cd9988bf2b2b74a4a106720d6646c3c1660a9c2e67d20cdb64f6f95fe19e", 0x24, 0x76}, {&(0x7f00000006c0)="10d88dd1e3ae70a4da7ef77ac1cb178cd9974c3796fb1897df231d61ed1bc8cb12553dd06b7840738a87df52a4391d8e89b359e78bd5d484cf1f0bb229010728aa782115a1d853e5130e7c38a2e9a4c8b1deae9573e3328661fb6b4d8f37c8d72c84bb83748f5f35758407eba8e301f00642fa35fdfafff3", 0x78, 0x7}, {&(0x7f0000000740)="60e316e4f282d53764988c1220eb4c5ab25fc5bf7b2205b850953e08b2915657a61af59a5343125a038749d61d241949527bfe7bc0489d351a194000d442c8f5ede6a1266d881fdfb7a254ff85c80dfb658794110bd503d2ad43ff5ddf896d7342727f52", 0x64, 0x1ff}], 0x204000, &(0x7f0000000940)=ANY=[@ANYBLOB="687567253d6e657665722c7375626a5f726f03653d2d8d7d292d2c7569643e", @ANYRESDEC=0x0, @ANYBLOB="2c709b29f9d6743967dd1b57717f93a56dcd3aa4e05904f12a0d554ccd5f64697265637469672c00"]) openat(r2, &(0x7f0000000900)='./file0/file0\x00', 0x60702, 0x124) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a58c77358341059faf9ca735702669d87b236c8204ed6dd40e144998630000ed1d691bf1a2dd6991a1a190ddbaa96c077ec48787fc834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b502c0000000000000004d7806e261aec6d53578508d05cfe1032abac2a000000000000cea14183db276dfc578c78e937e317b253cf8548eaf19f40b8eeff54f4801d0d6c37de"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xbd, 0x8}, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r1, 0x0, 0xfffffdef) 06:51:02 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = mq_open(&(0x7f0000000000)='@\x00', 0xc1, 0xb2, &(0x7f0000000040)={0xa554, 0x7, 0x8001, 0x8}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r4, 0x81f8943c, &(0x7f0000000300)={0x0, ""/256, 0x0, 0x0, 0x0}) mount(&(0x7f00000001c0)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000001580)='cifs\x00', 0x8002, &(0x7f00000015c0)='/dev/rfkill\x00') ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f0000000500)={{}, r5, 0x12, @unused=[0x1, 0x1, 0x7ff, 0x6], @subvolid=0x80000000}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000000580)={{r0}, r5, 0x4, @inherit={0x48, &(0x7f0000000300)={0x1, 0x0, 0x20, 0x3, {0x9, 0xffffffffffff0000, 0x1000, 0x10000, 0x1f}}}, @devid}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2712.615298] loop5: detected capacity change from 0 to 40 [ 2712.618601] loop7: detected capacity change from 0 to 16383 [ 2712.655445] loop6: detected capacity change from 0 to 16383 [ 2712.669369] loop2: detected capacity change from 0 to 40 [ 2712.684582] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2712.687729] EXT4-fs (loop6): get root inode failed [ 2712.688418] EXT4-fs (loop6): mount failed [ 2712.725378] syz-executor.4: attempt to access beyond end of device [ 2712.725378] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2712.727005] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:51:02 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 47) [ 2712.801681] syz-executor.5: attempt to access beyond end of device [ 2712.801681] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2712.803087] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:51:02 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 63) [ 2712.883424] loop7: detected capacity change from 0 to 16383 [ 2712.903355] syz-executor.2: attempt to access beyond end of device [ 2712.903355] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2712.904951] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:51:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000007, 0xe0070, r0, 0x1ab95000) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2712.920412] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2712.921351] EXT4-fs (loop7): group descriptors corrupted! 06:51:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49) [ 2712.956685] loop6: detected capacity change from 0 to 16383 [ 2712.985729] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2712.993479] EXT4-fs (loop6): get root inode failed [ 2712.994156] EXT4-fs (loop6): mount failed 06:51:02 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 64) 06:51:02 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 48) [ 2713.068416] loop4: detected capacity change from 0 to 40 06:51:02 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34) [ 2713.086053] loop5: detected capacity change from 0 to 40 [ 2713.100616] loop6: detected capacity change from 0 to 16383 [ 2713.151493] loop7: detected capacity change from 0 to 16383 [ 2713.172043] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2713.175451] EXT4-fs (loop6): get root inode failed [ 2713.175859] EXT4-fs (loop6): mount failed 06:51:02 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 49) [ 2713.202940] loop2: detected capacity change from 0 to 40 [ 2713.219615] syz-executor.4: attempt to access beyond end of device [ 2713.219615] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.221171] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2713.238064] syz-executor.5: attempt to access beyond end of device [ 2713.238064] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.239594] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:51:03 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 65) [ 2713.289282] syz-executor.4: attempt to access beyond end of device [ 2713.289282] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.291155] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2713.352759] loop6: detected capacity change from 0 to 16383 [ 2713.354555] syz-executor.2: attempt to access beyond end of device [ 2713.354555] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.355931] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:51:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50) [ 2713.428062] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2713.439665] EXT4-fs (loop6): get root inode failed [ 2713.440361] EXT4-fs (loop6): mount failed 06:51:03 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35) 06:51:03 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2713.553594] loop5: detected capacity change from 0 to 40 [ 2713.600048] loop2: detected capacity change from 0 to 40 [ 2713.678671] loop7: detected capacity change from 0 to 16383 [ 2713.709272] syz-executor.5: attempt to access beyond end of device [ 2713.709272] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.710313] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2713.711142] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2713.711645] EXT4-fs (loop7): group descriptors corrupted! [ 2713.787220] syz-executor.2: attempt to access beyond end of device [ 2713.787220] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2713.788950] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:51:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36) 06:51:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000bc0)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a00)={{{@in6=@loopback, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in6=@private1}}, &(0x7f0000000b00)=0xe8) mount$9p_xen(&(0x7f0000000940), &(0x7f0000000980)='./file1/file0\x00', &(0x7f00000009c0), 0x20800, &(0x7f0000000d00)=ANY=[@ANYBLOB='trans=xen,cache=none,version=9p2000.u,posixacl,dont_measure,euid=', @ANYRESDEC=r4, @ANYBLOB="2c1c189f220f2794df89908c25afe7596091b5c14551b0bbe32b6b5622b87836f2d0faa1252c74ffda9960e566825fb01b0fa96be908398d02b45e0e4c73f9feeac6acd25663033da5b7ae5deb3fcc10444b2349cf7ab651f7b743964de4a9abc916348a2f6b2a0bdd3d63ce5054e6565c5e9dd2067d5977bd33bf6f07ffeb6b995d2b538a669d8813503779b875e31c596727c50408e8f3b5bf66c10bda8a321acee0a9df698e9d8e92b482d167f68a3664c4eec7aa42496f2da0e18affedcf0da7fbe98446c1d26b8391d2466eb72d848945ce82d8d3418a16e0eb7b74d54ca0394dd35f7dcf6530f3d853052c522b26b1ea6ad7a23c6f503b97546d56c807b93eb66eea6e4306341407b6c7671203806faed272e6f40b2abb57a972ca0208c1cadb016ab764c72a78e9878ff6"]) sync_file_range(r3, 0x4, 0x7c0, 0x0) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000c40)={0x3, 0x80, 0x7, 0x7f, 0x9, 0x9, 0x0, 0x7, 0x44000, 0x4, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3ff, 0x2, @perf_bp={&(0x7f0000000c00)}, 0x4000, 0x4, 0x8, 0x2, 0x9, 0xffffffff, 0x8, 0x0, 0x5, 0x0, 0x1}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x10000000}, 0x0, 0xffffffffffffffff, r1, 0x9) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) syz_mount_image$tmpfs(&(0x7f00000001c0), &(0x7f0000000240)='./file2\x00', 0x80000000, 0x7, &(0x7f0000000800)=[{&(0x7f0000000300)="24f1edf575928ae76ee7f50cf524e4f559e09ee0da4b6a1d78d25e84e52fbe4a056aaddf7a944509c0c75e8ec174ad61045e506b133ffc4322bfaa1e149eaf3f05a1f949748c45e8e0a27f325369492627e8caecf3fb5fae976402f45e00", 0x5e, 0x1}, {&(0x7f0000000380)="e3d3f54682448efbcf80e1163040533122a80ec222d26f60062a1431af354ebb258e655514dc8e13b85e61c75b81ee3958e0484a29e5a3624973c571012cab94cc874a071e9f23526412c5625039c3c96d84c16c3de64a10eca72bc464535c2eff2fd4f714a1ffb0f527aaaf726966923cbd339ffde1c47910276a917d933b80d0ef34c69015aacee50a86a8d64c37dd592bdd63cd26a3fe6cbb68ccec2754d9f445cda465c6e0b366914b9d4a2b1e019475cf8017c0f546e50f5d805f7ee5e8b8e49d8b39a04f17a5e9", 0xca, 0x1}, {&(0x7f0000000480)="69a5de13608c174070653da13b81e7c0a0187f087c9b9723c08ced3943186f14e8bd6df7b7dadadafea1262f04f456705fa81a406e0ebc9148f336b63a9f8fb7a2976b4ad130ed075e16d175d41a160c96ce879f9bb497685967886eb8e80aeebed322f00bb42ddb65140444c65a10ae3353af0013dd5ad487089ef29f13b2675df04c073a303541d122150b324db7f51ef1954657e738837043aaa8fa46f88f7b704974", 0xa4, 0x925d}, {&(0x7f0000000540)="e5e9d050d8db3fe25adbd6ad2944dcf1354d8ba69197124a1c39c135c8b9206f3570a00208fe21c365e8e103e3a298d42d48dd43e6686a3b9c053371d69782840722664f6a056f76bdeddd47c84973a778932760de84d3b8d9b3565ab150fabb15810b1559372856da633b4eb9dcd0fb466603cfc967a18d8418361f7821b2ff6420dde252ec11ba78bad9ed904c7dc6b5f444d7d88b74796a71c2887cbffa66ee46640c19abd58f3d727155ceb9f6d9c12a", 0xb2, 0xfffffffffffffffb}, {&(0x7f0000000600)="cef3ce56988a8920123d6b17329cf7c7581063f35ebe13a392546675111bd9e3ac6a69d57309f8e9a17f47d6bb124c721176472dda5b7918f060f64c81fc6932a59165ce88ac4da358ff5c2cf8e31c8c16a792e2e36efc0ecf74b2214f05535b088142f6cc26f954ecaff8f5aad7ac6d7285ff363de1dc7256eb12f5a54c88ca3c3d31e2d26ccc42e9dcf4db8f15ea0f6e99041355b52305032bc97a2dd9073b8119c89938a86e08a8d12fc48e5a61afff", 0xb1, 0x7}, {&(0x7f00000006c0)="a7ae14c6f39123c68b9028ad219e9fab2de48330f9ed2ace4354210c96817f7ce0d32937fb6f3bd839bfd548301b52ef9594ee7d75afc5c1f8ed3a89d89fcf9324776ca6c21600a3af13904fa1b77adaaab3e9d375c4161d9e0837e6c6ad73478e09f445f20d9b98ed8815584ace1dbbbed3c27531a364cd1a63a508652bab9055ec5078c3c2706243874a6144e6f148a08ffcaae3e955d1bb134a4dd8766b20c5480a1059d44931905b6decf291a150bed087907b248d5cfafa2155a83383e9a0f3ea292beca9cf827eb84ced3300cd089d42fa2d29bdcb74e53878db61e83d8c5e76", 0xe3, 0xff}, {&(0x7f00000007c0)="c63b9ff456dc07095c87b5dee9aa5ea48a6ef5faae3969410eaa9323e5c847597ab148bfe5afad358a58", 0x2a, 0x4}], 0x40, &(0x7f00000008c0)={[{@huge_always}], [{@obj_type={'obj_type', 0x3d, ':)()$!#6%^)(&@'}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}]}) [ 2726.969194] loop4: detected capacity change from 0 to 40 [ 2726.969379] loop5: detected capacity change from 0 to 40 [ 2726.992307] loop7: detected capacity change from 0 to 16383 06:51:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51) 06:51:16 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file1\x00'}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c0783c487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:51:16 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:51:16 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 66) 06:51:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) setxattr$security_capability(&(0x7f0000000500)='./file1/file0\x00', &(0x7f0000000540), &(0x7f0000000580)=@v2={0x2000000, [{0x522, 0x3ff}, {0x0, 0x4}]}, 0x14, 0x2) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) epoll_create1(0x0) openat(r0, &(0x7f00000005c0)='./file2\x00', 0x101040, 0x4) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) openat2$dir(0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', &(0x7f0000000640)={0x90001, 0x16e, 0xe}, 0x18) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) statfs(&(0x7f0000000440)='./file1/file0\x00', &(0x7f0000000480)=""/107) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210611b9d3ec265d00000005020000fdffff0000c2b43d24c94cc58c27a803000000000000008c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a108000000a96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c664cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a95193c5c432c0a88c4968402cb90b5760445f6d18891bfca82a4181487d2a5af719f07a4cb954b7e32f14143925b1d0c0c2c6b096a73b144aa41240f54a41f2370a1c1a0c9f9262c5c356b8900dba1fcd8bfc5"], 0x13) chdir(&(0x7f00000001c0)='./file1\x00') perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) utime(&(0x7f0000000240)='./file1\x00', &(0x7f0000000400)={0x8001, 0x80000001}) 06:51:16 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2727.021471] loop6: detected capacity change from 0 to 16383 [ 2727.031058] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2727.031908] EXT4-fs (loop7): group descriptors corrupted! [ 2727.041135] loop2: detected capacity change from 0 to 40 [ 2727.045564] ENOMEM in journal_alloc_journal_head, retrying. [ 2727.060889] loop7: detected capacity change from 0 to 16383 [ 2727.074616] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2727.079058] EXT4-fs (loop6): get root inode failed [ 2727.079405] EXT4-fs (loop6): mount failed [ 2727.084250] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2727.084942] EXT4-fs (loop7): group descriptors corrupted! [ 2727.127037] syz-executor.2: attempt to access beyond end of device [ 2727.127037] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2727.128887] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2727.135638] syz-executor.4: attempt to access beyond end of device [ 2727.135638] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2727.136699] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:51:16 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 67) 06:51:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37) 06:51:16 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2727.196812] syz-executor.4: attempt to access beyond end of device [ 2727.196812] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2727.197693] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:51:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52) [ 2727.267013] loop2: detected capacity change from 0 to 40 [ 2727.305574] loop7: detected capacity change from 0 to 16383 [ 2727.307147] loop5: detected capacity change from 0 to 40 [ 2727.310840] loop6: detected capacity change from 0 to 16383 [ 2727.330531] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2727.331162] EXT4-fs (loop7): group descriptors corrupted! [ 2727.336634] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2727.348251] EXT4-fs (loop6): get root inode failed [ 2727.348712] EXT4-fs (loop6): mount failed [ 2727.453982] syz-executor.2: attempt to access beyond end of device [ 2727.453982] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2727.455925] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2727.476051] syz-executor.5: attempt to access beyond end of device [ 2727.476051] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2727.478043] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:51:31 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x45a343, 0x0) sendfile(r2, r0, 0x0, 0x401) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) getsockopt$inet6_opts(r3, 0x29, 0x39, &(0x7f0000000580)=""/4096, &(0x7f0000000380)=0x1000) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5170d410f3a4b949, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000240)={{0x1, 0x1, 0x18, r3}, './file0/file0\x00'}) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x1800, &(0x7f0000000300)={0x80, 0x80, 0x60000, {r4}}, 0x20) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r1, 0x0, 0xfffffdef) 06:51:31 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, &(0x7f00000008c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) syz_io_uring_setup(0xeaf, &(0x7f0000000140)={0x0, 0x0, 0x1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r5, 0x0, &(0x7f00000008c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x6, 0x0, &(0x7f0000000580)="0dc8ba798d248eb76fb94aa8f09b3badaa8bb28fbee6be75b1b10b21d81a23825b63bac8e4f26061c241855e1dd22d2a7be9ac7c15e7978cd13f1c140ab73197cb80afe31a357073e7d10a98d850b78d3eefa317c2a40f8ae05610890825646cca4930755062cff7f0e13920a8b712f2bda2810e8986a89f34ad8a47e14a701162310320d3aa58dca6ed5fa703aff65b251807bc47c79c847c3dda7236ded442bb3eb1bc261c0c87aa529d86e95f9ba0705d8fab59235146ec8caaa44c911fa881044dc774666fba9953c79dc8d7730d7d961e1d473674464ae051621ae9f797fbdf4f9cf047ecefbd213a380ac564689dd01802540be55ac97b20a75a4bbc172a4ef7996d233bf270bf0e77f37dee294bacf00f234574f4af7f516b5d5aa982fca42732ada78113ae302d22272416bc4c77b8040dad0e8e6ae4f24b6c83e9e253b9e404edc7fea8a0bc82d06e348b08beffc6cf183a33a76673cecf3ec6326042623c8bbd06b6f5c305d20937fd45fa75851634b39382bf16d1649dda99b04b84f4ca4a74f2fd66993b421cc4be68a29ec624787a4a4d5eff170d860e1d5cbe1e3fe40b53fbb8493fc5853c519d5c7a92860e06bc5f468113ad8a897e35b9656a163d6f47f28d37f34fbe146f2f11d78b7bb0ce8928bb7ea19675e9a41e5c44a0dfad29a9cab5588c883c97ad6b8c738757081278d39318a5db5f44838e89b88ac6820894fbce5f1d29e9e65c6d4da02fc57145661356a5c09d3599aa3b5de97be6db5eb7441cbe5c72821e54ce2382ff33a6948075d3b2a37b3fc255d01ba6434888e365bef474f48f8bef767645d706ba463d081b163d7fd9df3f3adb8699d0797954f4a6f1a261b11bbe6b7973dcecf4f2fb717b7c68a7ce27ab235b80a15d2f4dfb2613f544019b2f816f07c42b353070df310c7fcfa5b64f4cd3f65533234daa3faeeabd343009b0e6d6c5aa9aadc156a7af638699a04f4f8d62b50927c3c2fb5f688c5736634ccd324090287607ec25c6f6ef91c1e57d979f5ee04073088f9b8478e104626b003d78999b79815da79cf5f1464e319667fa737681ad48b138142f2f845b3d6b436249a31f2efa161971db2be542baecc8cd35787c15cea47d8de6abd6cef0f9873bfe701e49da809a0422942c8a669fadd49c084c661f614fcf96db6d6590d4deb34987b938b9775c4addef4b19bdef1537e63a338d7025fd53b361440e87fc8d51d3bd2804d145c1889c99689ba122b21c791914fc70811326a0a2f28f2a98d5f14ecf3a17cd1816345ba834a25f29f3e79b0459e917e51a345ea62fb51f8b2886be815ffe1333e91dc379e19223a7fed9eeac0826ecfdea4d14ad6659499f7358868ba8af7facdaf6aef3ea4b6d07c7eaa8ccf1dcac6bd23699b8f4552bfd289a5b5dc683df3a2c0715cec540047a79874c95f65997c141b3f0f0aa908df71ba44c11d3fb40cec03ed18f75066eebf6cce07e5c8598115388b8ceb81d350aaadc3d648953a14a554b160e675470866e71df1dcd63e9ba2ec3aeec498417efdc45820895bfed776a61476a6e850a6c332237d71172c27ff964ded8beab36e7d8fb945388d3bd369642bac7b8eace253226fb0f1a1280b8201f40e1b627f713a5d070473d97fca327a7a71576a533a5d797461eebe15a15a1f99a199da897efb5e25e114a30f0d22b573d79bd6c34f96b67c09908f8cf8dac3d12696b84f3d4c2bc446820e512e1efe5bf9029ce0017c61e7ce10b490daefad51dc2e82f4d09374959af911d11dcdbb268a538c3fbe14c756d52b3faa62de46cb6008bf9700e2a5f5d123f91075918e86253764330dd46a906021bfabf03c920a75de6ac69bbb9290d71a7d38c85361a7fa8607a02b3a14a3a1ea5fc5c30e5dac3f813c9c071c3e70b7a964fc0915623b5f43b7b1b7fea4fbb03b6dd71268b9a91ccc5acf14ece7dc556050c89dcf1d590c31b7897ffb40e73106957783ac37dee9196a8e3566031971958f5931abd43b36c6b1dc6a5e841d9bcad5df94b73be82147b06791159201f0057a558b65f7fe9e5335a98ac279c1d919fba56ee26dfb981874569c24b3e25e99ed93e901649d77b050ca7a5f13cd65964906725089088b1205466d50815eeb7f9d86223e2567e5264485940f0d34eb299a8032b113959985b574e23670bf6cd51c72d904aa7e69892aea16ee7180c66382c8ff1a62c96c9acc0e3a436cd34aeb29aa79af9781392a954b430a561f5fe4d533e5fbccfd373fe8c772a4dfda801a284368938fba88938174439f8107c01d42e10014446145f84c973362436608ffff6ab32655d2906d23498e71aaefc22dc9e1ddd64aaa448e0508342dbf273fd640aa1ce86da8b56e5062e52c7404e647c42afc1dd6b30fdf0830ca2eb6a4a6e7c9bd463adbb29f19a8673ad3390f831731925521b3d57a7906a4270a8bbf0a5645cf1ec31e1a6716c566a9be8474d3ffc1e925fb0562a8ea2fd204c76618313f060348ecdafa5fe5753fa3e6d4f34da9854ed031d7c6f1bfbfc380e234ee598e3897b2e834eb216048f51ba8b27a5fec52154d9ce5d11521c8583642b2c802c4c4b0e7fd765bcc097acd7a9c3b3ae3ff8bf48a270173afcc2f65eeb79ff11861c5f2f1a1125750b36f96dc49fbb4f5bfb49b21bf5effc3383a9266e995522bc93db8728eaa69a8ba3b5a6b9e02a387c89bff975520cba0fb33bef5210271fa3f5682453f7e35205c3e303248c151118f9c03b86a84ad29e20a677f239d3bbe4b33dd306e493606b790c03f6f2a76e004bedc260fe3e87ee9e8bd4412af9e7fd3dfcf51628ab0173202769f77f1ccb59fcdd96b46920723c194faccbcc8061a6358f384fa263c296ab69a3088e4f1e3170e9aca74d4fc42105d164535e8c4f8b7ff10b4d820761a37693a85faa40e084533978a10e3cd03a5b6d519df8b01143d804b16a23a6d8175fc32b74a00285e5bdb370160f5f17dc15fe82e0bfb16aa8185ae32af8ee699f451b374fbfc8b2aa2f1f8a40536abdd063851dd4d09688a02329d9fcc3dc878ee224170e87a6bc5be822cd2d558170464b8659dd8714d9ea163159f3ed659f6364676c95b306266df634c8e023ca5751913b0d51213517b39d3049738251d30bb664e07003b5d58f12c43e174df8f2e534ed43272c52366df6f71f27bd274559223673eef0271bc39c5bd95ac1ccf4e1c3a36944e9f21930649eac1d8ef576584348a1740b1ae4dee8e45016bbd361b319b70b8e73d8bd9acd454d596376415ea7787e98e456bdc3a5a443268adaaef10db904511a9ae645e04426a982b4ae3c90c6093ae446f00d626b6361c04d347a157f10a1d624157546f2423dc6b55e6e300f3cef2ff38c03fc065e00a7680a649b7d295a9ea4609534aa4e0d8f0681c260b43fa8fc75954ec17703a85ad52ea3146689433a08d208a6f7a1a593124107f322301c903654d1a95fd3c90a2862615ac253e594c58d43cc264ed90599d58d4afe00ad0c709112fc4f4c3f627e8457b4dcd379c52572686b9aed29bee783969adba7235264cfbf2df06c71347837f895128884160fca112cc0afd13e14d2b8c4c7c7f65afa0b13f19f245467619396febb3bdb47c6ff981bbceb35aa1b3edbbf1daefe35e1d809888fa54b97ea65dfea7bb9a991cc54fbbf9abb6bd28c4dcf1976b0836de6f4e32277f990c9f5f1c88c3d92d5ba45ec259c9bba06c583e3e0e3b8889ef0f556865ff29a8f8d8bd6634095639b7b7f7f0cf40753e107080b81f744ddd49b7e28b4cfac4c5c4a5f40dd30b15138590db96d5273e2264f32ec8d673fdb2945bfed90bb170eb105aaee56067603efcefbde6c2c8d89cbb874c7a77c911212ad466fbd635767a243c369381368d3d0439411b43cd64c101be90d677cccea5a1f82805a8a39c742aa2e2dce1cf4b92e372b4ee5f187e35ad7d3db9b6001a73c8b3c7dc145f4a1d29b956564f3d218e92b71aea8443b13a7a63a6d49fade2b3e911c56115c59d3382e9c0073c80244da506b4fcf00a7b76372dd4487165d6aaad0ac90f05799f57c38c66e117382bb9a7587175881cf948885404d35102eb19df09f23d50aedb275da2737fd97ef46fb76ad9023ccac4bfd06cfe97ddcbe2d47f2394224b1372ddebcb6fa183afb95f86e82c309f9f556ce11f89cd1a339eb367e491b1cd8b6d5a37383ac010c77e0b24e5b353382fd54d46663191e66436532e35bfeda728a8d3133c3d86325a6ebb0b60edba467b165f6a8c485caed5211d045d8e2d32c3f7fa6e54a8d21ce050f2562f28a26522cdf5b54eb3621f14d1149648cfcf844c451ee823935355eb3e73b0118804ae894cea76b7123b063f37f245abd84aaf8907a76252a912226ce58f1640385c2ab4a83921fb1339b4f6f25963f1f2b7cbf6d19ebdbaad5d9999ee280b99bbebdb1066b33910b7e33d83b781695809a08f8a624fbea19d64cf04c09f964ef373e91f5235c911803f61a45ed7cdc4fb718b271f8e3e76baed4f99668bf14473502bf6ca3ff6a0a86148fea7f03df6365e680f28620c402c0280e350fa67b6b6fb7b793bd9b26576490ba9515d0a7a4e294251c8de25f3cc759b3c9dfe1b26267f2e2c66b953a3e44d0a7027a872edfc3ab50b40eaf56e9a1b57b3f8a6addff4635470e66ced9d2d7f461a92f54e55083463d60dde40643423c97f43ce04542f92885ce8f096249e0b1c770c6958171d6e3a14f37126ad5aa361836c4c3b96c71c18145a0966032920eee11287873e45e0ffb738c2dc04d804f90089e5dc18e051c03a3c7f1bfb64635da41db6dbd375d03b152d806c9f66f7205f124a4874329df430b4dca365763d12b1c8b9a16bb019498652d51f9928cccf95e203ee82b1fb7c06ad46ac12cf3c4326440386ca4388c9cb4e9dcc6d81bfa964b85f48bf6bbe7b5157b0b601238d156c0d3ff459e4179a56a0997c35d54fb8001908c7e38c7ae41711a93b149baa318e110d11bf486182a0fa4284c34577ecc3dfbe809f2e8bda1a7831fa7f2bb45ef677509b4f91b1feb1db1da5285d4e46b415c7db01a830544923543482062a880fd27203c431d6bb313ffc3cc3aad0557b3207da35d153d940645dfd6ef9f98892906099b9b3f9d0000ec86e0ed546013fe368b6afe0bb03cdbcfe119f76e729ca25202eabe8749e05492492af5eca4e9c17cdc853d81459880f94478eda6d26585157f610cee226fbe8273f4c87a899f830def9e9b7dadde1bf84d032c2edc3c1ff55f5e13a8df24da55b01596068c6314e5fad42a61e99307e87ae7450bf3350f611a7526ffb38dd9116524375e281e60b938ef7dddd26fc8c69ab0c6546e416e7d6ddb35517a20395501ff601db43980a1251951f64585ce0f0e32d349e7694b40da4b6ed869b027c74722681bc97bfe0ef17423b0d2b2a8b8d731b6168e798112032192afa922d17594800f7a16715fdfd982a435ff311fa93902110b5408d23a4f5c670966f2a3b59cc978a51bd71494e408e1d087ab67cec558b8e2b50a42531bdbed4549101abfd5255b340667d9839745e3e70c18705ef4930ba7b415af56fe4e5b202294cf9263192223bf092948cfebd3cd6f671055e2a687d6689bc8fb81d3fcab79216b48b99a837cbfe5da7db7ee6330ac82eccb15675bcce0cd3e81a231312e133c6b0eb27157b711e55ab4e95e9f0543bfdba348bd88088945a9fbcff3f01275389d19c02d3d924dcd62ac6599fbed11e4f5a4162ef2254f1879b90dc951de93fa6faa", 0x200}, 0x6) sendfile(r1, r0, 0x0, 0xfffffdef) 06:51:31 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="21064902887cd97c43415fde08848100000005020000fd3cc7de0e437cf07b540e409b49d2ffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d69dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe10"], 0x13) fcntl$getownex(r3, 0x10, 0x0) r4 = accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = getpid() write$binfmt_aout(r2, &(0x7f0000000680)=ANY=[@ANYBLOB="2183412b8b98bc325f8dcad39317a1961a57d8a4c477813305d18ce1cce73551cd8f78533cd8cc32a30c59eb2c4dfa38100cffb6054147c21c67975cbf35ab6d248900ae57768d17823e4d10b4dc7ad8e0ac3b4f6e081d2ee3c089ee81a230e6da3d35e255a7bed45fd641fbc98923037fa9155b9bac1f17872cc524e58af39f7ae153bd1ad6c55cb8f5c818025fede008891e0adb9c44d9ee4fced6b02125af67bdbd54b83c450484ca", @ANYRESHEX, @ANYRES16=r5, @ANYRESDEC, @ANYRESHEX, @ANYRESDEC, @ANYRES32=r4, @ANYRES16, @ANYBLOB="9e437d9df03eba7b66993b5f1ea9b4a0abbc62372055cfb919515edaff95a4c42bafb0628dcf305cf6bc8eb70dd9d6fe186448a4b61c623133778528a1ab5f441f2506e5d85b59806ff1aba13474df86e671c9e86a5dbeadd649c30e516d211c579b67f05c262e5264cff0f678f33343643800489a07e87ba834fb596d0074542061306638a8d2"], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, 0x0, 0xfffffdef) 06:51:31 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 68) 06:51:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53) 06:51:31 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38) 06:51:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mount$bind(&(0x7f00000001c0)='./file2\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000300), 0x80080, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000340), &(0x7f0000000380)=0x14) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2741.699446] loop4: detected capacity change from 0 to 40 [ 2741.702833] loop6: detected capacity change from 0 to 16383 [ 2741.712935] loop5: detected capacity change from 0 to 40 [ 2741.751742] loop7: detected capacity change from 0 to 16383 [ 2741.759697] loop2: detected capacity change from 0 to 40 [ 2741.782653] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2741.783803] EXT4-fs (loop7): group descriptors corrupted! 06:51:31 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 69) [ 2741.833541] loop7: detected capacity change from 0 to 16383 [ 2741.866508] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2741.867454] EXT4-fs (loop7): group descriptors corrupted! [ 2741.873036] syz-executor.4: attempt to access beyond end of device [ 2741.873036] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2741.874539] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2741.915054] syz-executor.5: attempt to access beyond end of device [ 2741.915054] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2741.916330] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2741.922490] syz-executor.2: attempt to access beyond end of device [ 2741.922490] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2741.924190] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2741.933576] loop6: detected capacity change from 0 to 16383 [ 2741.985541] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2741.987628] EXT4-fs (loop6): get root inode failed [ 2741.988404] EXT4-fs (loop6): mount failed 06:51:31 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x5, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2804}], 0x1000010, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) openat(r1, &(0x7f00000001c0)='./file2\x00', 0x88000, 0x20) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:51:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54) 06:51:31 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39) 06:51:31 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) (fail_nth: 70) 06:51:31 executing program 0: write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2742.180459] loop7: detected capacity change from 0 to 16383 [ 2742.198130] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2742.198832] loop4: detected capacity change from 0 to 40 [ 2742.199298] EXT4-fs (loop7): group descriptors corrupted! [ 2742.220256] loop7: detected capacity change from 0 to 16383 [ 2742.225692] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2742.227054] EXT4-fs (loop7): group descriptors corrupted! [ 2742.237118] loop5: detected capacity change from 0 to 40 [ 2742.243699] loop2: detected capacity change from 0 to 40 06:51:32 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:32 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2742.430281] syz-executor.5: attempt to access beyond end of device [ 2742.430281] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2742.431711] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2742.465197] loop7: detected capacity change from 0 to 16383 [ 2742.466398] loop6: detected capacity change from 0 to 16383 [ 2742.470759] syz-executor.4: attempt to access beyond end of device [ 2742.470759] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2742.472389] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2742.487419] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2742.488832] EXT4-fs (loop7): group descriptors corrupted! [ 2742.514888] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2742.518504] EXT4-fs (loop6): get root inode failed [ 2742.519293] EXT4-fs (loop6): mount failed [ 2742.545420] loop7: detected capacity change from 0 to 16383 [ 2742.571571] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2742.573080] EXT4-fs (loop7): group descriptors corrupted! 06:51:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735236c8204ed6dd40e0600000000000000691bf1a2dd6998a1a190ddbaa96c077ec487870b834ae33106a229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b17b985d8fa3987122f2866d3488b8af923bd58602a1f3e9e5bb7f4cbd0b8ac52b01130668a2f25f69095fc01dbde4bfb3aeac765b16963836a8924869a3fda6b9ae2b2dda1d16d0a92bfa"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, 0xffffffffffffffff, 0x2) r4 = inotify_init() io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff, r4, r0], 0x7) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:51:44 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f0000000300)=""/110, 0x6e, 0x1007fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f00000001c0)='vfat\x00', &(0x7f0000000240)='./file1\x00', r3) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r3, 0x0, 0x400, 0x5, 0x800}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:51:44 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 40) 06:51:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55) 06:51:44 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:44 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(r2, &(0x7f00000001c0)='./file2\x00', 0x444100, 0x83) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:51:44 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000002, 0x11, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2755.214902] loop2: detected capacity change from 0 to 40 [ 2755.235370] loop7: detected capacity change from 0 to 16383 [ 2755.264885] loop5: detected capacity change from 0 to 40 [ 2755.270139] loop6: detected capacity change from 0 to 16383 [ 2755.272397] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2755.273246] EXT4-fs (loop7): group descriptors corrupted! [ 2755.278116] loop4: detected capacity change from 0 to 40 [ 2755.289754] loop7: detected capacity change from 0 to 16383 [ 2755.296074] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.298506] EXT4-fs (loop6): get root inode failed [ 2755.299278] EXT4-fs (loop6): mount failed [ 2755.320737] loop6: detected capacity change from 0 to 16383 [ 2755.322029] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2755.322645] EXT4-fs (loop7): group descriptors corrupted! [ 2755.327532] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.329695] EXT4-fs (loop6): get root inode failed [ 2755.330715] EXT4-fs (loop6): mount failed [ 2755.346218] syz-executor.2: attempt to access beyond end of device [ 2755.346218] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.347499] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:51:45 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:45 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 41) [ 2755.438579] syz-executor.5: attempt to access beyond end of device [ 2755.438579] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.439675] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:51:45 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2755.479086] syz-executor.4: attempt to access beyond end of device [ 2755.479086] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.480040] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2755.497233] loop2: detected capacity change from 0 to 40 [ 2755.508159] loop7: detected capacity change from 0 to 16383 [ 2755.516175] syz-executor.4: attempt to access beyond end of device [ 2755.516175] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.518093] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2755.525062] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2755.526584] EXT4-fs (loop7): group descriptors corrupted! [ 2755.588595] loop6: detected capacity change from 0 to 16383 06:51:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56) 06:51:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$F2FS_IOC_ABORT_VOLATILE_WRITE(0xffffffffffffffff, 0xf505, 0x0) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0xd2c6, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f00000001c0)=']\x16!]\\}#[:]\x00', 0x0, r2) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2755.650542] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.656605] EXT4-fs (loop6): get root inode failed [ 2755.657297] EXT4-fs (loop6): mount failed [ 2755.675672] loop6: detected capacity change from 0 to 16383 [ 2755.697131] syz-executor.2: attempt to access beyond end of device [ 2755.697131] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.698991] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:51:45 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x9, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2755.711067] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.712328] EXT4-fs (loop6): get root inode failed [ 2755.712682] EXT4-fs (loop6): mount failed 06:51:45 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2755.768566] loop5: detected capacity change from 0 to 40 [ 2755.789438] loop6: detected capacity change from 0 to 16383 [ 2755.807315] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.809073] loop4: detected capacity change from 0 to 40 [ 2755.810302] EXT4-fs (loop6): get root inode failed [ 2755.810880] EXT4-fs (loop6): mount failed [ 2755.818889] loop7: detected capacity change from 0 to 16383 [ 2755.826107] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2755.826848] EXT4-fs (loop7): group descriptors corrupted! [ 2755.848207] loop6: detected capacity change from 0 to 16383 [ 2755.865980] loop7: detected capacity change from 0 to 16383 [ 2755.878222] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2755.879296] EXT4-fs (loop6): get root inode failed [ 2755.879747] EXT4-fs (loop6): mount failed [ 2755.893916] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2755.894608] EXT4-fs (loop7): group descriptors corrupted! [ 2755.922019] syz-executor.5: attempt to access beyond end of device [ 2755.922019] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.922983] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2755.933166] syz-executor.4: attempt to access beyond end of device [ 2755.933166] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2755.934157] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:51:59 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 42) 06:51:59 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) accept$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000240)=0x1c) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:51:59 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x40, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:51:59 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57) 06:51:59 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x5, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:51:59 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf94a735702669d883236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a0e5842deb609d78"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2770.070821] loop2: detected capacity change from 0 to 40 06:51:59 executing program 4: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) waitid$P_PIDFD(0x3, r0, &(0x7f0000000380), 0x2, &(0x7f0000000400)) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) bind(r1, &(0x7f0000000300)=@phonet={0x23, 0x0, 0xa2, 0x1}, 0x80) [ 2770.078163] loop6: detected capacity change from 0 to 16383 [ 2770.093495] loop4: detected capacity change from 0 to 40 [ 2770.099584] loop7: detected capacity change from 0 to 16383 [ 2770.114297] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2770.115237] EXT4-fs (loop7): group descriptors corrupted! [ 2770.121004] loop5: detected capacity change from 0 to 40 [ 2770.123223] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2770.128709] EXT4-fs (loop6): get root inode failed [ 2770.129731] EXT4-fs (loop6): mount failed [ 2770.153831] loop7: detected capacity change from 0 to 16383 [ 2770.170209] loop6: detected capacity change from 0 to 16383 [ 2770.185988] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2770.188613] EXT4-fs (loop7): group descriptors corrupted! [ 2770.195314] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2770.197603] EXT4-fs (loop6): get root inode failed [ 2770.198365] EXT4-fs (loop6): mount failed [ 2770.305136] syz-executor.2: attempt to access beyond end of device [ 2770.305136] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.307291] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2770.320213] syz-executor.5: attempt to access beyond end of device [ 2770.320213] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.321961] syz-executor.4: attempt to access beyond end of device [ 2770.321961] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.322011] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2770.325365] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2770.381653] syz-executor.4: attempt to access beyond end of device [ 2770.381653] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.383012] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:52:00 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 43) 06:52:00 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:00 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xb, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000100000018000020", @ANYRES32=r0, @ANYBLOB="002e2f6669bc9dbac33b9eac58fcb52e"]) accept$unix(r2, &(0x7f0000000300), &(0x7f0000000240)=0x6e) 06:52:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58) [ 2770.504799] loop2: detected capacity change from 0 to 40 [ 2770.538601] loop7: detected capacity change from 0 to 16383 [ 2770.589004] loop6: detected capacity change from 0 to 16383 [ 2770.602394] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2770.604045] EXT4-fs (loop7): group descriptors corrupted! [ 2770.618923] syz-executor.2: attempt to access beyond end of device [ 2770.618923] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.620523] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2770.632212] loop4: detected capacity change from 0 to 40 [ 2770.635588] loop7: detected capacity change from 0 to 16383 [ 2770.638685] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2770.639540] loop5: detected capacity change from 0 to 40 [ 2770.640136] EXT4-fs (loop7): group descriptors corrupted! [ 2770.642910] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2770.646827] EXT4-fs (loop6): get root inode failed [ 2770.647587] EXT4-fs (loop6): mount failed [ 2770.690735] loop6: detected capacity change from 0 to 16383 06:52:00 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2770.739638] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2770.755202] EXT4-fs (loop6): get root inode failed [ 2770.755994] EXT4-fs (loop6): mount failed 06:52:00 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 44) [ 2770.883999] loop2: detected capacity change from 0 to 40 [ 2770.908748] loop7: detected capacity change from 0 to 16383 [ 2770.926552] syz-executor.4: attempt to access beyond end of device [ 2770.926552] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.928241] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2770.941467] syz-executor.5: attempt to access beyond end of device [ 2770.941467] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.943186] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2770.962077] syz-executor.4: attempt to access beyond end of device [ 2770.962077] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2770.963231] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2770.971296] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2770.972706] EXT4-fs (loop7): group descriptors corrupted! 06:52:00 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2771.019180] loop7: detected capacity change from 0 to 16383 [ 2771.020190] syz-executor.2: attempt to access beyond end of device [ 2771.020190] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2771.021455] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2771.055107] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2771.056687] EXT4-fs (loop7): group descriptors corrupted! 06:52:00 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 45) [ 2771.126046] loop6: detected capacity change from 0 to 16383 [ 2771.183612] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2771.185535] EXT4-fs (loop6): get root inode failed [ 2771.186317] EXT4-fs (loop6): mount failed [ 2771.218976] loop6: detected capacity change from 0 to 16383 [ 2771.223627] loop2: detected capacity change from 0 to 40 [ 2771.239483] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2771.247468] EXT4-fs (loop6): get root inode failed [ 2771.248408] EXT4-fs (loop6): mount failed 06:52:16 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000000)={0x5, 0x80, 0x9, 0x1, 0x4, 0xc6, 0x0, 0x1, 0x54200, 0x5, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x4, @perf_config_ext={0x4, 0x1}, 0x100, 0x2, 0x1, 0x9, 0xffff, 0x5, 0x2, 0x0, 0x8, 0x0, 0x60000}, 0x0, 0x4, r0, 0xb) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:52:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file1/file0\x00', 0x121800, 0x41) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) bind$bt_hci(0xffffffffffffffff, &(0x7f0000001940)={0x1f, 0xffffffffffffffff}, 0x6) chdir(&(0x7f0000000140)='./file0\x00') statx(r0, &(0x7f0000001800)='./file0\x00', 0x4000, 0x2, &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001980)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@private}}, &(0x7f0000001a80)=0xe8) syz_mount_image$tmpfs(&(0x7f00000001c0), 0xffffffffffffffff, 0x80000000, 0x9, &(0x7f0000001700)=[{&(0x7f0000000300)="1733faf8739e3e398fc5fd9823dee133975e6059f7335fe4e77758e5b74b965348fcc0ed95f32dc880a79d696f651569c8ee2e0dd0266456e33d0e81768c0b0ecab6dcf4badf1ab09b2e2ef47d948b048577d94d5b3858140a58f2597f844ec9a61494e49c4e7eecce975c72cc1863bf866d3ef1ca9c30d317df2001bafa5df120b1a478e1b816947cebb6c2d7d04fc06eb7166ef7a9059fcecf23f60d311a66c268224a148b", 0xa6, 0x4}, {&(0x7f00000003c0)="542629746e8203a0e9205e21ec50a17597496552ec33028a084d5b0285b764610ea356def378e6c3d2fac28154eae46094d8223e61182dd64225089c7ef55a9fd799354cdb9f831e2c2d368a6f59c7ec3a27b28477b8fa0c0bd9f2cd2b0550995325ff572803ae", 0x67, 0x401}, {&(0x7f0000000440)="6921199e04788afecc1e3f87e649533c875711b62c21c4fe93a65f5485a37181649871efc7d3c29010de49b854d960cebac98e9a29efd6b950d9f14d1bc0e6dc724cca6819e14fadd664c9c233c7238b6023eecf42d462dd3f53bbf7ffb915575aaea05e2f8df306f62b9af8917dcb42c57aa4", 0x73, 0x7}, {&(0x7f0000000240)="8dd889cdfd85c2dba760f33f8faf6ce40c5d33b6052b82e00f3d62c732c45b7ff9378b244b9f7406b365ffb05b1bf77b12dd2780bbed0287", 0x38, 0x7ff}, {&(0x7f00000004c0)="ab3c3a8ba6cd407845028f335a854899cbc5e286d5808134081888a0a08c432d6872891bacc3f99db0f7d5a129dd7f7147e7f5db951dabf37293cd858628a4714959868f65a76fd939087bed8d5a0d044aefd543654592fde5c4c11644c208bdebdfe2fe8125e7a80008", 0x6a, 0xffffffffffff8000}, {&(0x7f0000000540)="c5c3b1f243e1e84fb43696c4cf42465632ec61e1c194226375f88969b64ab4e3c4bda6e328c873d8830cbb4b401a187e6f22b46cea8f2f6a560b07d3639568287b6cc4778f8d3c5d196b4c0ed70712f3574dd3455bcb41ae766587d4bc077e4a9110c7611f39419bc70881ef654f8d36897a4b8623d246638142484d9093fef06303348d21a3f07bf74ccb92f2fd283bb54bf3a7f25c2639538ae74e5562ff125bf58eaf305c7187dc60251669eebcf0b7f0e6439c2a629c2bc3984b9b69b3f070d3ec6e0b32fa758b493ca05d97896b73de82fddfa595578dd384a7f700bde89d08fd4dccb2ef3fc0", 0xe9, 0x3}, {&(0x7f0000000640)="d83d67d15efef198586acba43be13a81d61b5a33849f8c9c314ebba64b2ffc2b24ed763569fcdbf55a8d2864efd492e0a958ebb809c4", 0x36, 0xd3}, {&(0x7f0000000680)="274ce5d644e8a15371a5a14c4232896d5506c6346b980b532efefc6b5c580606ea8d14deb33e634fcd6df8b50562b168e1ae20db6d6f4ba1faff5056d5ef7ded5abddeda2f7b0189ee722cd143232c721996ad691ac8f83523a2d4fe3f4c4aa9554b12a493bcae97f67122e6c3246fc96a0030f0e2f3e6f271108c18c0d7225f84d4379deea26feb20f4c16c824a1ff3e872980024a5635d26f8aabccfd7bfb452657787516dbb8e166d065c1ac8de53766dfa203aab384109ab5f3d30e4328c64b5de8143505ce64ac50821e8553bbba9b659716fe9e69f92249c973316c4fde644d0b90b2a5941b57ab0bf028d410a9148cfe1e9c83781611effff71bd7563f887183125c184b2d06e97c8cf8fa8c7136cdfe2bc08aab79833ad5e38211487ef7aed6f3473161074b31ad8419197f0ccae3e06219427b2030304bc8447a9079acd0f019d0292ae17f388b90d20a460b11863c103f8eeda0cfb2d78115d3caae13b4b1953aaf8638b2faaa862d4b47225c210893320f90bb062bd31becb376320b8d4764bad349568d69860d5c7556df1949c98bc28e40bb32975b1d1d2d7557d63be1f24f7ecc6df6940f84d62d6b018569904a8f55d36856338994e18f01909c161a21396d272959393ad9293e344e75a438db19fc1e3c3aaea1f8ad6112b729a9d9c0d9a4b83ca55bce7329dc9b56dba313ec43e25cfccffb6511d9a17ac7e70cbcdc08e5d8f0f35a2a6f7717b5e00018566fed7b0c473588a27220463de9f50d4b141bafa420f02fe529a195b965d0bd520f3d4ffb341c26ec023708dc214ba2473701e701c0d912b69ac58da8ab1f2b8c80a6145a639db77288c90ceccad97efa8aaa44c5f7fae486faa9bcb92b1a870b6b15efe2661889a060068db9fff39a0c4c8966fc679a917c3936f331811419441e5964f2f95b92d6e5052b4af2bcf6fcc13beb1d27ddffab8d5fe44f1ec2accd9e81c2d1069b4678044970c2cfc2afa2cc0568c54a8a84afcbdbde15b1a39b24496fa88438221ac5485b5f268191ff73230218ae1d884176d69aacafa9e0b9ac24171f8727b75118cbff2511c1be44182ab80cc3c3cd25bd119fcee8d1a79910578f9d0663a6f73d38a29fddf13df82c8b65bbefa897c7a737c5ebf0d95f8c2449a27598c66ab9a32685f1742db2dc4e04b4d15b52df281714e647b1f0be39b0d3ba79fd23a0d909d2622bcd212ca24dd898f141514d1a447b73558e2398c7aabb1545be4922d0d8091bf22ba0c9e17a429c86f72da7c60db989859a84d3e40c259ef4973ca7e659b0a3d77cee520423144784566221d723a8ef5b266c88e9172c40198beceab570c1611a9262c37431f84e07fb93f145cc955f90a31ee0db32e4cba623db666d908c7f5200114eeb0fdf1cb8ff1191b82811bda22e4fdb6b8b45a142d3e0b4d36e93f4100475d5d2abeb92e38d7dbbc6d5fef95a36a73b4e8e97708b7529f746ca9e90a15f74f7c1ba59b4a6b65face1c05666e6ee53a576d3467783e81a5749b05498e8a32a73294d0dfe6aa24e12393cccf321584fd0c6c891e711ce2b4e4449f0c6611f990d6b15c9c9936af07ddb3880fa180bdd4973122b53a54876e9ff8c64b1a14f7320d3dbb66ab976be7917fa89aed5580c6e2bf0b78297bb034483d844b255a6d6272b2b0e0c90c5704f6e712f4e5c728c19de84d93891e7e429a46ffca5cc160feb7373c171060176c161b02a7e1a35acf9dedf57e8207e142d91a5d3231980a6a8fd17cc5bc81dbe6cd296d77fb0d3242a82f969441fa24aa4689d3d3d08a4db46d82cb730be7ab1d05060be78332ed722a3712dbe73ea18b423db2f7fbc1a0946de1a940045d5ffae9712967ca662f3102c0b29f248eee87a622a1bb59d7880532899d56f2591606bce104af1388283d42f4d641d758269af3b052bf214f30693f8f170aebad58b50fb55d9bfaf32c7222dc2a556c00711e7ab03eb20d81939c5660e87d7335dd03e81274250b28a9f0f551d8e2c038fe1681c4e707b13030ae8ac30b588edea8a3b5b98be8c6456651fe80ed57809b466495930e34b0b8daf2e57b72dda89f334fe6e2fd34233efaec7863e99172f5f3447a96adc1ca9cb0f9e64117bdedf4e15da2b4b2f58bd9e548ab522a6b0e2f4b5a4c6933abeec9f35285d9740ed9a71d421d8018c8863753dc45df47cd0bc9b55675121c1d90aa5f24b64abbf35ba07db6e70c92ab022cb0ad489b2e63a24113c6d4f2391e88cc7a1de1ffb27d2f16a80909273e7cde3dd43ebde7e3b2833065643ca52046b05be6866801ae047aae34e308539fe8638bc2e452290620c23d4dcd21b99e68b0f143a98ec77874c0d2fa3f3b8016ad21f3bceb098bc760bcf5da519fed5c03af3ecfdc85c630be8de51922aa4e931a1c362e3d1a14e27c7470928ce754c6f1fabfd63c025a1c878e30a324181da2b0b56e8c71240831ad312f0dd248ad2d18491b71082a34c99528dddc85c422319a164b6293b8f2ba40389e282a9a26ffd850f93c58fa5b33f377663442415e5d1972178b913bd36dfd2c58eab8891c4b758ae6350a1482f7582e2236cc7177bafec1ea79fc12abc83dfb3ce356d0443fc4430c97407ec461eae57d27e0ef4269342cbb0f224d7794f37854c1ee93ddfb0e072cf142c1895aee992e4e6a6a488da4789dce11bd7adc95421c3a7720ba4b9aaa032030c5fb690b7d2238373e4a2069cee022456940669d03ae59a161dd3c7084a9f8ee74a7e1babad3fb9732a49d708cd77b12d05c080817b37f0dd2fc0db5694ca06ecc311ece2acd25a24144efc0e52632f8192caf8987ff4e1ed456cfaf32490ae2d10c86a5e20f33f6e5bcd23940f20b675a02178acd26f45e49ac29e3cb47f9ed57c44a491fe141dee4260fc61eb64a3ad8e8b3b38fbecbc9d550930ed14c0a700caeb0159c60a8d19a87516fb484d3ae6dfd13694d2267b0631e38849a72e4603e2969b631dd9a850b833acb9d29554292a8306f1a31d8744923ed58fe1f0e94fcc1866e9b9597de6faba681465a093722085665b84f84c37d87661d4ed8c1845b786e3836c0d22283b3654dc75bb069ccf35f0b4c90e80c297869a93548fe04451cbd95b3abb863c89f5a1aad59e8b6d5575964eb1f38373d53ea4dcb735ee4137e6082b74b97876071e570412c31f297d352e10b789b475be0ada0b229d0c0bf91a1705b823e899feb03f0a3ee34146e996c429abd61d3e441bf827710ce912d8bc1a46fe7489eacddc64619f98414023a41bfb9b16d2832aa180985f4f34c94f56f41e333e2e3e77800487c5dbe2e793e5be244aa32f07fc89f9a8a258dfde237923b472aa72cd294b94fcffd069c52f86aa254590735ac0b5c8ac4da814f9ec59ca8d64e731ad3a73c606f89b0496869bfb3c6854d20fbbb2130677b641db919608488ee1bf63b37852708c8d5d42f23b669751917a366c377a9595e9b2f2e2dde45897471d74e92ac9664446a4c7cd91035e9759a4c40c3ae61469f9baa3f2f46f393398aa280caf763eb99841b5ff014a39ef1c2b742ab0c9073615cf7ee01decf0343afda927c497b81d46f3900252ea41eb523a067db5b889a9bdca8bb4f5426169555947782b14c5af3229fed3593d858eff41a9bb9933093b967514621086b8ddf53af6d226bfe30b7ec0c79447ef7403251b73ab72832928640903affe43ef178a118ad5201e08d968de700f9c160613b88f1d8fc778597c9eb5e619d4189839637eb5bbcd17b400e145a3851792c66a118486a66b50ead7afabdf8197e5c136e57e8a74d2bd5b53a29d21bcc82aea7f09f7e1574bb209aec2813fe98dae7460f9f2227a18e15d2afa02ed75e9df97661e8bbfb3cebaab572d9660e0247accb80530af8e745f4bc4fd7bdb29594fe4218fd0729e6e8463bad1edf94cd284b647014466ba7f9d3eb24cb28eb4d0c2a60eb50d852fb257ec37fd8b556bebbe250d718eb40c1f509e18351b1ff15b43f454ecd92e762cf7dbfb8d7351e4db74a24ef77558c802ad45cc4abff24980213e42926ae901ac31d280078ac9e1ab4da797fbcf1a23da8cb20c69bae2aa6427efc534c86596dd479f15c27bb72c19e3148aad934ce9e43917f1bdded98a25dfb3bf1bf6a9674c5576f335ba94fa8935d5f4985ffc16aaf316b6ba873fc54fbc307465fd6b047e8b5fb42380b09ae08cad94e1c7212cfc38b1da1897b0b683a2e414e444c2d832b52ef54ff3ef474067348e97bbb62379c5b3466bc41cfcdb50e3219a14fc61917ad70216d90d6131a1ced5e0e383eaf0ef10e10814d034a379d647b137b09e25052318753f955c992969fd1c39f6bff928ac32ecc548e67f3a557ea2359afee233ca87c2d91e145084778cff14d5cdfc5bb1743d4372632f1563ce6a7b90198119e36b8bb9900026805579303b82ad99544f1973a78d2ccbfd38f9c1f23ccfec64267fd6e56fe7ecd581451e7c3080bb92e6c13fc14f0059af6213cc475ee62ced64ae66c230ea10deadb8ea02c8d0173f60f5c40d5edcda0d38fb100bfb6e99d41b8acfce272e093ed3ba95e0c28b127754c88293905cb0f6a056140f46f8a545a5408ffea184df2bec57939a008fefe6c6103ae37906da06d156032e52217454ad52e24b55a4e2ac97d8901489cf1eecde899f3895d59c2c10d8ddc24acfacfa9de37237fe6dd327dad049d3a1c97f72302d2b52b58f2c309f8878dbedb57aa48fc9c94da57d613bf26abf41b40f5e3df8c7f3ae02675444b5f75d71b3445260168352268054e7e55c7502d1261fa6bfcc201e0a6e70d2dc8f1a76c56b4505859c4ca4c91368daf0faaa8885fe5c207a7c6b8ae6e6bb3be13a7e1e3cf25d88978e644491a62a850bee6989251f518362a9bf6e691bb10b5f113023d3047511e9bf78708deefa2a819534ca2a3fd5eb5bd08535a2689b45e8f40882fb879fc2b18d273439bfba3fd5714df960f92b21bd37631f5988c75492daf84e3d015ce566ea0bcadfde023cb00b69a60f350d249b1b67ea120095611310fdc5fb18f84a7e90f20a5fd3766239b1029ffeff37085ec4a67b22fe8210c73ccf250cabe47e9e7770111a99f5e650bf27343eff678b2deaeb9de64a80de445d8c7fbba3458a25400fa1011f4419232a96eae15ca42363411e98326b33cece2d0dacb36f5b14d9d8315fa35707aa4cc9ab546d75547da1b87911fdbf82a3306f9ce01384e08ffb024f34a8fb474fa36e3982f40aeeb93a0bbba7b6f4d53fe8ca58e5293e907b66ce35690e69423160c8517bb680add9510333200daabaf7537b6736f6ea1c3a11cbb77aa59a5560d73e0284b37c3322a972cce8734a195991e94d9548471618966bae35504399a6025bb50b071d188c465cae0919acb80f75ab1b65a16dded14015db26014009d434dda6de88763b7faf3713959aac946d029fd511d6f7a47cbdaf54952cb7ddadfd1ec059258c9bdb34bea2538a11740cb7b6b245966073cc2880dd26e38b2d2d662ced91097ab22258aeef4836e6ab6039fbf86925b1099eb146c35686a03e5ba99e76e15e7ceedd44f703941522833839c542774222eff8fd7b81c6b77b20be95ab2eeea422d32e78b305ed37105f9bf5aacbab36385d4ecfbd6de2381becba9c5dcd3a0b38e5503796dc3fd78f4c1ec07b4f16d70b963365adb80c337685abe20e03ed35431a96b67d569e5150c636ab554c3f771104caa11dc76e8eadcf15480b6262a4a9da78c245ca0741014ee8c7327f980f8c2f023bcecd3be", 0x1000, 0xffffffff}, {&(0x7f0000001680)="7592ab1c55b8d9eac85e2c84d5092562848ed0cc66b5d5544ec69de5099460b022951b410bebe1df40c7078f55d0d6a7261f2c5308982319c4e2408215cb17aa3951ed7806aef3788fc303e63e2e8ba01c520c34aa93f2", 0x57}], 0x84004, &(0x7f0000001ac0)={[{@huge_never}, {@huge_always}, {@uid={'uid', 0x3d, r1}}, {@nr_inodes={'nr_inodes', 0x3d, [0x6b, 0x0, 0x33, 0x35, 0x6d, 0x67, 0x30]}}], [{@uid_gt={'uid>', r2}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) 06:52:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59) 06:52:16 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 46) 06:52:16 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0xc5, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x1, @perf_config_ext={0x4, 0xdf02}, 0x0, 0x7, 0x9, 0x0, 0x0, 0xfffffffc, 0x1000, 0x0, 0x0, 0x0, 0xd}, 0x0, 0x10, r0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:52:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) fcntl$getown(0xffffffffffffffff, 0x9) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2786.439408] loop7: detected capacity change from 0 to 16383 [ 2786.452687] loop2: detected capacity change from 0 to 40 [ 2786.455432] loop5: detected capacity change from 0 to 40 [ 2786.466958] loop6: detected capacity change from 0 to 16383 [ 2786.476220] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2786.477361] EXT4-fs (loop7): group descriptors corrupted! [ 2786.477928] loop4: detected capacity change from 0 to 40 [ 2786.494742] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2786.503354] EXT4-fs (loop6): get root inode failed [ 2786.504257] EXT4-fs (loop6): mount failed [ 2786.506691] loop7: detected capacity change from 0 to 16383 [ 2786.548091] loop6: detected capacity change from 0 to 16383 [ 2786.551419] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2786.552526] EXT4-fs (loop7): group descriptors corrupted! [ 2786.584752] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2786.589084] EXT4-fs (loop6): get root inode failed [ 2786.589645] EXT4-fs (loop6): mount failed [ 2786.620253] syz-executor.5: attempt to access beyond end of device [ 2786.620253] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2786.621710] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2786.658161] syz-executor.4: attempt to access beyond end of device [ 2786.658161] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2786.660189] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:52:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60) 06:52:16 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47) [ 2786.788505] loop2: detected capacity change from 0 to 40 06:52:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r0, &(0x7f00000001c0)='./file2\x00', 0x20000, 0x106) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:52:16 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x9, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2786.885579] loop6: detected capacity change from 0 to 16383 [ 2786.897215] loop7: detected capacity change from 0 to 16383 [ 2786.901434] loop5: detected capacity change from 0 to 40 [ 2786.925228] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2786.926822] EXT4-fs (loop7): group descriptors corrupted! [ 2786.941551] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2786.955133] EXT4-fs (loop6): get root inode failed [ 2786.956122] EXT4-fs (loop6): mount failed [ 2786.984279] loop6: detected capacity change from 0 to 16383 [ 2786.996856] loop4: detected capacity change from 0 to 40 [ 2787.034342] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2787.052410] EXT4-fs (loop6): get root inode failed [ 2787.053257] EXT4-fs (loop6): mount failed [ 2787.076596] syz-executor.2: attempt to access beyond end of device [ 2787.076596] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2787.079147] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2787.226315] syz-executor.5: attempt to access beyond end of device [ 2787.226315] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2787.228129] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2787.264196] syz-executor.4: attempt to access beyond end of device [ 2787.264196] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2787.266169] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:52:32 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:32 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x10, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 06:52:32 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) fchdir(r2) 06:52:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 61) 06:52:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x80000, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x8}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, r0, 0x0) truncate(&(0x7f0000000240)='./file2\x00', 0x85) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmat(0xffffffffffffffff, &(0x7f0000ff2000/0xe000)=nil, 0x5000) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000240), 0x2}, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x1, &(0x7f0000000080)=0x80000001, 0x0, 0x2) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 06:52:32 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000300)=""/192, &(0x7f0000000000)=0xc0) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff32062cde3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e140998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd6d4939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:52:32 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48) [ 2802.813282] loop4: detected capacity change from 0 to 40 [ 2802.816110] loop6: detected capacity change from 0 to 16383 [ 2802.817103] loop5: detected capacity change from 0 to 40 [ 2802.826085] loop2: detected capacity change from 0 to 40 [ 2802.842179] loop7: detected capacity change from 0 to 16383 [ 2802.862161] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2802.863374] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2802.864899] EXT4-fs (loop7): group descriptors corrupted! [ 2802.868872] EXT4-fs (loop6): get root inode failed [ 2802.869578] EXT4-fs (loop6): mount failed [ 2802.887864] loop7: detected capacity change from 0 to 16383 [ 2802.918860] loop6: detected capacity change from 0 to 16383 [ 2802.921568] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2802.922803] EXT4-fs (loop7): group descriptors corrupted! [ 2802.948581] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2802.959890] syz-executor.4: attempt to access beyond end of device [ 2802.959890] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2802.961460] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2802.970884] EXT4-fs (loop6): get root inode failed [ 2802.971536] EXT4-fs (loop6): mount failed [ 2802.998465] syz-executor.5: attempt to access beyond end of device [ 2802.998465] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.000480] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2803.016405] syz-executor.4: attempt to access beyond end of device [ 2803.016405] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.018168] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2803.085355] syz-executor.2: attempt to access beyond end of device [ 2803.085355] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.087193] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:52:32 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000240)) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) openat(0xffffffffffffffff, &(0x7f0000000300)='./file3\x00', 0x602080, 0x40) write(r2, &(0x7f0000000340)="ec04fac55fd9d50ed1f6dc93e6dee2031390a11680719e9aec55262fff9869b8bb906e609ceb11e7d80e83cceb78797198b1b04345b391e35e7e016580145a453d732fd07c386741d78e0046b1f60f10ed474a48b98c3566925b0cdcf4aadc8dc3c102973f141fa5668fa130199f5608227da49462f568f8536a4e31d1cd462a3c00da50565fadeb80fde360c1697545c1a63282d88cfd0038a05321ef5f222a5da8077aa3c70abc0f2e5c4b7a74710a9cc3d6beb7e4feaaa7082a931fc6615715e4008d4fd71e34682b8374cf5672bf07c8c9bf44a4b0ad5196cb6577203eae61b33bd51b44fffaa63fc91e838edab8ca686aba455b0b791b9117611e508fbea13db9cdfc7e6b2a31ed75b41752659c924328052782c71b5f08a09cd5311bf09669f561f546a0db4b1ebc9c4a831cfa6462678f2f2808aeebf27b1a9976d42f3e075418224781091e49c86141d1b5d7124bac9bf86f5bf79aa3402b4977aa92790d41b40e6aec5e64eaec282e8f04ba26f0d6f64d8ca0eba703f435049921fb1ba70ed707d2a9f08189830176649b9153cf75c7da7723e236d98e8b0548ce9aa5ed316c3f5083c8c23998e5c4ab34d7dd29963a357849ab5a877877d44eb8309f0112b0677e248ba5eb4f5f26ca67e59a86d8e8239e94fc5608fa7cac8b0aded05afc775297d2e7e25b7ed8765c1990e8f296e166aa562c0a706e73d50d85bdd2cb5c7fd5ecfd0b5e50d4b1b2a0a380449d7e2b610c76b92ef74eb6b7f302a336f08d702e7036414d604c3c56a7dcbdaa21b688d9d804c4812113292074d73d11af58f3a435b8904f87944303d25f379e12b7bfbd433adcb2d08a6e71a437a1db0d100c74ce7d2cee7736270a2b7bbd221a24c125ad05d9b38a1aebc09747bf4b945072e25f7379fa2ad0e0ae7e0abaaccbeb548b98b5076e83ee0415d0a9d90482a0f2ff42b9fa70371f3f811458bce2ef36eaf874b61524ce158d8fa039f799dfc0d54f551eaf3bfcb791172a57daad439674a5d07777f6f41c202d6df5a3e575d62e48d08a15f93a68bce622d0cc8503ddd5034f970a88357c6d3898877638f06c39a97067655a66bce9e847182181a98a1463d497a41388e4f47813f8b865452acd028040dfe5b16b1e0c29b20a6b00b0d114de1e88d718c6c45c94563d70e6f6d2ccd8d2aa034b4097b7fa2da1a57b6a9e4eb0aed32267e8b3939290017557e0b43e296d6bca2884a1c1d641c9e50312388e3ce9dd358e140c58261c1227187c1a07c68951f77027646fdd92ab21b323809aeb0d5e6b7545695783ae49c101e40d9b0da2d45137e430d5cba8bc24b11e98615a39549eb16369b72ba6d1ca23a34555e5d31b0010f7441c935a5fe86fd50e61f041c5b32f32bc2b39267382bc1b9d474ec0f80079f59384c8fe48725b3cb0a66bb3c0ee88c66d04b4bc76bab66f1c2586185943201b40196d70649fce2aa2b2f21bc2ecd3de9038a177b7239359f19388603c9062e80bbfe0f9933e3e2d4d6c977c97e7e02d18a91708836468770268e7c501e356f13c2075253e2f07c75c7d2304dc1b72be16a53cb7006d02fa408a4cbb0d24f7199b533613d59ff38241c0b4e29b6219de3b95c47a78ba727340a9c57e363e82ca6ab335e4c733dda055f20b8a0b720b9947d9461ba35b7aa6c8b6527b5de600b9483bb7ba4c5b79c0a250d6ea54a4dba556d40d6d83ca35bd9367df8728ccd5d96e9532e9c8eceee4c8f25abf86a61afcb8db6353a6f338e2b76dd5693bef830fe13b35f3d33f6d11a736fc562f7bef7d0b642ea203cb124d3bf25f6624f80ec847815d719e65f0a16791dc9c3c2859adaae15364094360a37af8d0a256bfa464f5bb8f7c25fbba08ffc10aff5631ad821578b483de08146d751ef6ac75d1509c143a7ae38d86413d7b51fff14d3760c42ad5a7eb5d2e9c4070cce4885f43d85ba75dbd5e38a9f7175e1422f1cf9509eb92ae4cef791ac9c185c10194c74dce37ea6448cee6786a44881fc84d554f044627ff0a7354ad29b06c2ec5b68e56b3a3514207e8c01ec618f57864269ec5cfb34cdbccb830a33b2dfecbbd42b47c297d672c16d75287dd6d4ccf51bcbcb6e0e13294b24410e06909ec8f7cacb6f7ce7f6b956e0f745917b97da37a34d4b134ed6664e97fb5d4237aadb4d9d1a866601f53d60cebc7b4eaabae952cb305d65b777f73282e3bc20935f64d65f79d4d1f9dc93d3bb24c79196e056a39955686f160902fe103fee116574f4e820200cf274007de77fdf63944c513e1d1b79afd97bea1c8f7f09d44f55e63016959356e52a1de97450b8b2c593ff263e8a6753221699348d47482cc03e8aae6745e81317d15aa72a8df2db848172e1c3e987ca77be6e1026ccb334ef06cac6fe5c930ac4140669c2548a35b75852d9033a2d20115c9488ef90755c31906a34133714b95de6a0783efa15724267deeb3ae59a5ce5a64122ba78e91c5fb1e17114d88fa3e814b9567787977ee80bffcf819871ec2901658b2b0116bef00df6fcf1ed81ad56a7d281e1f36da2e94c6cb839e2d76830cb6f460438fb5fc727d138e1c547fdbafc90cb15df01b2aa7d228510ceb9eb749d7792d90e2a6855bd1dcdad37585da96d39cc522b4426bf3bd8e4ca4b17ef04d32a536807ac809877fb87248f5afa9c6df40fe3996568ee55df03f9ea6818f1bfc8231fc4f4febd0d337c3063f651a97172423c4f9703cd402aab5e6ca902fb4938d5ff687e74225be3524c9b36acc448f215be5fa51748c6bbeac61330090706b160e8882773f9ce652111992e5aa5dbd2605ed32b14cdb781bc533030755817119537268bc21e5ab3ff04876a6730545c95bfa8d06fc0a833ddf5ea3d7ff85a84b9fdacd27a09eededc1aea8ded166e2585f9a712f3107f657d4f6bd9dea89b658f5d74fda165c939289c552aa9f0173e30a379617936abe4d644ad80b60bde15ebef56dd184339361a4fdc3e36c37b56de73d053cbe3fd874570ea826bac7fd378544d88966e6a172671d4c18df10a109b122472fb3b53615e5264ecb0a204553682c75585fc4dcaa55373bf3a12ce43abee449c8695ad53d70585cc6577b27460626c2db879323512db7e79ab770bc71055cecc12b08389f07db64b1028be558184c833f47d3ef6c280596a152314e025b1a14afd07f8e493bb88ec50614f105fb7a6ffeb435865f8f24b435856a2ce3c233a021043913c87d88c41d215ae74736262ddcf669b6f323a88f50183fec4470e87d299c26cb7d206380a9f49aae705267ef344938aa388b4642527c55903a47962f7300944b4740e26b210504149f8a98c95c12b181cf9aec45178cab5248d6386c5c51432f8b7a2c1c8673828f671df8a8f43c9dafa8932f297e9138f01b57bc1f061e2cb125109594d0249605024d41d744a130c8c4313aa6297bd42df6b059479fff31ec2eb741d5f33c79a612caa08bce233a37b011e6de375c2a17ed69bb682ecf452270f6de36d8e8e915f3f18025f548abc0abe8fd8a0d78e2cbe391afa21225a4c32f0bce8725bd4eb380feaa6a007fa3b651507a1ea95d1e3815caf4eaabd2b7e03b465ab4e4e918f88bda491ae346c26e389131f39162b07b422d3178a2686227635457a81fc08456facdf35fbdc58379dd96b3482b07b1c1b45d84183c10c1536f6b8f4d97d4ed6fe4acb0535059acd33b90b689de274ace6f9a189fc66696ef612e3ec3449c34f6f223a45f0dfb3e31f13a230aeeec56daef018e28dafc32f5839f50cc14074890e5f2a7963663b1be3aea633f33d29879103ae3586aaf5f7d2c0f0a4506e75c32ecec1e2accd29292912c7b24412af1e68e4fd0dc490efcaf8fbfba0c99fe59629d324144cf1570b7898e42f716e98af3c61539afd8ab7ec0a5d236c8952ebd35340f060702d6014f196647c12952a28872644773d35b55e127aaad40752485643f3b8dd0723ff6090df32ef56b54a689fde7c60a46eb7f627614f5e3f51c4708948fb170bf7558cf4f69ebf8fb510f86b114e1a22f3c54cdb49525794f3ff8b6bc2fcc83cd719621e39320c4d20200d131174dd158896d7450c454d4aa380e920496c7f4962f1d89120abd8edc84887966daa1cefc34c7bc5254bbcdff899bc72d56f0c37213a66a81c9e1a349699882d77c211b97caaff9ff1d55844438e63804a903406a1c302f18185421d2b139a50924597a7b10021e0dbd480198c4ba590487f8c519e7bda442bee9389dd1ef75ba59524862fbc695c71e22131bacee8c4007ed7d50097342f2df786044695bb4e58d57a50634c330075a3b3afea3f9b45312ef16960e9206f30d89e49da03b72cefba4bba0b76167ffec2a06de5569997b7d0dbc52f2ab2a4a739e025bd8e82a9a4331c495633987da1df111b64a058f855c7fe121d3f2a61d2fb3ced66d780d80b11a78568552d2673e4804aeebfa8cab7a3230171af8a50581b8e5365bb451c0350e6a5df85781de69b3dd4f61da834659395e937fada453069de6d4b04a4f24b16f2dd3346616d51017797736d87c2f88cf7274439dea89b5a634ab8f0656d21d48c9a7000b925d57dc99be06a82cc8ad846776ba41f35831c837eeee9fa95a92b0d2c14cdd4044938bfd3fe562d46762f088ab14ba01802b5e55e6b426fec62460582caf869f51fc257f47a09c48a003b7237899c7545c827f7d64f08a870324ef392593bd21c5ad1923e3f703d8a50f4073d0106eebf542e340f0684930afb52ce567d1b251fd803c3430180d1c3aa14b349a97b353ee21df1b6458d377f4cdcf523c77b51a51ca7029f35bd2b8490e828cb74c8e5fc59533b4585475f7747284781b967d6ebafa64ae027d6449e072a6cde0b6c7a7eaca62ae2f5ee88c9828fc699be84d623a787fec26cd67077ef1353d9e6a5549aaf5d5e97b780809947c5927fce2b7eeafde8a516dba220bec9912dff9c58a1d9c1be5b91e47800f076a7c819b3d77944713fec7c089b6cc004b5622e568b65f0a2636d466d7683a51897d87535b0eb91ed6b0a38ecdec2aa8ca64cb745dde9fb7a61ef7318146a56cf97e33347ab8d411a58318411e498e0efce90920e238ffe0aee5b7f4d26cbe32f757a36f97a6360a1756ffecdef489389c337deeda14a53175e0809e8cccf3a9914752685dc7baae2a5cddbe5d0c278ae3e46660cf7da827daaf0dc92fcda0b3edc9224318b48d4bef9b120ac2eef175812ed76ac7c1c7e158fdbf86eaa8ff8d12363b311a3ea2c4dbdb18f835ee6de8170a1e3d8e8e6a92ed47555a9fdae8b998698bc2f03cbc87f2fa83d57604b384c6ac7142f588bd6f68c4c0ad210be241fb0470d8504669874ff8341af9cac76841c80f0149e2ca9ae4fad2770bd9db7e6f7829564c7f8c70219fae0b3f5497c221fbf2caf046976fc50a5b339523be48f0940ccb7ff03cf69440dcfed9ad0f53f160f4ed756e1006dadc7206e1c8a321beceab55fe237c926cab259d56a7d320228003b82a982661686d3cb312ddbbad98f4602d757a66a156f527213ad46df660b5c0ec2fb2243c2da8c0cd49e4104b791d09f91df0425641fe9204cd0773b0f4619a32b103a9d02f2f8c7a53f29da6a26796a81d18be481d8d2ed89406e2a0d846d0d2e56d2dc4a4f74070cbace23bb8694695f2a8e03502163bb02c5724f63b2420d851500251bba652d74a6e7825083fc808bf6342b7d416c63e116beb54e7c9e426a0f73133e9fe2893028562ef64aa64f84eab1c4319d1219fde1258ccb3ac1794", 0x1000) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_BALANCE(r1, 0x5000940c, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) setsockopt$sock_timeval(r1, 0x1, 0x0, &(0x7f00000001c0)={0x0, 0x2710}, 0x10) 06:52:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 62) 06:52:32 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:32 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2803.259415] loop7: detected capacity change from 0 to 16383 [ 2803.275160] loop4: detected capacity change from 0 to 40 06:52:33 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) utimensat(r0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)={{0x0, 0xea60}}, 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000300)={0x80000000}, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:52:33 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49) [ 2803.291398] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2803.292662] EXT4-fs (loop7): group descriptors corrupted! [ 2803.328174] loop7: detected capacity change from 0 to 16383 [ 2803.354992] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2803.356485] EXT4-fs (loop7): group descriptors corrupted! [ 2803.405595] loop6: detected capacity change from 0 to 16383 [ 2803.423680] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2803.428099] EXT4-fs (loop6): get root inode failed [ 2803.428867] EXT4-fs (loop6): mount failed [ 2803.429581] loop5: detected capacity change from 0 to 40 [ 2803.453757] loop2: detected capacity change from 0 to 40 [ 2803.462352] loop6: detected capacity change from 0 to 16383 06:52:33 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x12, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2803.519727] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2803.528322] EXT4-fs (loop6): get root inode failed [ 2803.529158] EXT4-fs (loop6): mount failed 06:52:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) openat(r2, &(0x7f0000000240)='./file1\x00', 0x10400, 0x4) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2803.618531] loop4: detected capacity change from 0 to 40 [ 2803.622523] syz-executor.2: attempt to access beyond end of device [ 2803.622523] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.624253] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2803.686383] loop0: detected capacity change from 0 to 40 [ 2803.696914] syz-executor.5: attempt to access beyond end of device [ 2803.696914] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.698962] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:52:33 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2803.709748] FAT-fs (loop0): Unrecognized mount option "./file0" or missing value [ 2803.746149] loop7: detected capacity change from 0 to 16383 [ 2803.786573] loop6: detected capacity change from 0 to 16383 [ 2803.789428] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2803.790555] EXT4-fs (loop7): group descriptors corrupted! 06:52:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 63) [ 2803.819320] loop7: detected capacity change from 0 to 16383 06:52:33 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50) [ 2803.835347] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2803.839500] EXT4-fs (loop6): get root inode failed [ 2803.840363] EXT4-fs (loop6): mount failed [ 2803.847599] syz-executor.4: attempt to access beyond end of device [ 2803.847599] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.849106] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2803.859673] loop6: detected capacity change from 0 to 16383 [ 2803.870242] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2803.871446] EXT4-fs (loop7): group descriptors corrupted! [ 2803.885649] loop5: detected capacity change from 0 to 40 [ 2803.893700] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2803.896013] EXT4-fs (loop6): get root inode failed [ 2803.896613] EXT4-fs (loop6): mount failed 06:52:33 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') rmdir(&(0x7f0000000000)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) sendmsg(r0, &(0x7f0000000240)={&(0x7f0000000300)=@isdn={0x22, 0x2, 0x19, 0x5}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000380)="00441a54c8cbc6cc84344ee0a74806621620b10a73551acb748d7607cfab362330aebac2c1267e0528c8f1b6230c44b97106ee1d60c1cb995fae883c5cbf2df3530b96724db339d24f3854a2c9006020c1543ef0", 0x54}, {&(0x7f0000000400)="8839dd0b7a7ef0bde51d0e284de34f3f01bc47a18a0429c0659d75e3e8c26ff2606228b1e44f78a1d6f25440d7a85839f22fd58d2afb2d47a1a39cd962cd24a6e79c400c5e12ad67d36ab4d93ff28df9d9a16d8c73b6ccfa0abfdc4e69a0e79bff52cfbb97f826f2a857dc857ae67f", 0x6f}, {&(0x7f0000000580)="00e610a1b47b2309ccdc33bd4bf97884d98851d6ac48545de73e13a38984c25f3bebbb3c99b2b8bc34a9d608bfbe81a9c18a5dd979c5fb4ca61bda05827d299d04b122b910b329a67a", 0x49}, {&(0x7f0000000040)="fd5ca06f43858644f3cf22e316547f5dead8d6bf53e37a2d853aee1b773975ad9f", 0x21}, {&(0x7f00000001c0)="56d6aaa746c260e884d21d2509f385b54be1640b0a4b2f08d67109bbce3c84a7d2b96a615fafac5cbc903ebf172bd1f5e43137f72c6e58602b6b", 0x3a}], 0x5, &(0x7f0000000680)=[{0x50, 0x118, 0xb55, "c8ff64de3f79b9f4fcd575377be932cecafa6367e2b42f6de658abdf76df933944424dd1bb99d07ee158c7e384e21bf9320ee101c6a4fef88dcc49"}, {0xd8, 0x10b, 0x7fffffff, "7a477ce764a98fbaab58efc88194c888654a2deb280da6fad3e819d3096b7f7a5b0cbb7085a63f2837ed916bf35c030889f50558a2819db6f19c8731856504ed53685f3c42b480d4efb60c2a19e47035a7957a7ecafede03467deb8e0caf0da66010a9ff9051161ec3d98029dc1a2f3f8acc9c94029adf7c9f500f15e1cd60cf7c54a2d943788d612818f4c7cc1576583b3f95f95e4c73232a39d5829bc1b9f6b261b368c2c5cc0dc60393d9e29f5e6ceb01e32e4f9f071aee2da2e41c28984d00c014fa92cb21"}, {0xd0, 0x119, 0x10001, "03688b877fa41b7e3436b71a09d236e7b8cba0cb1d84e976b2d50b99a54bfdd215ac00930a68dc814de3bd0d4588fcb78dafc49c30a786e64cb8c50c84abcabf1ebe56fecf9253b128bbb06955b36077748dcbaa805da10dc0bba6ab8cd96dba2243f05b19672a7a8a4594ca8f7b3fc2ff62625eec1f91842230d734c0844b8e52e59a91054ed636397d63e45645484af6a2d3cabb3703c8e407908896f836bdf254ee385432676304eb3c551bfbc7664e4dbece8952a70fcd978b"}], 0x1f8}, 0x8840) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2803.986554] syz-executor.4: attempt to access beyond end of device [ 2803.986554] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2803.988364] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:52:33 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:52:33 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x24, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2804.044220] loop2: detected capacity change from 0 to 40 [ 2804.095552] loop6: detected capacity change from 0 to 16383 [ 2804.123586] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2804.129055] EXT4-fs (loop6): get root inode failed [ 2804.129920] EXT4-fs (loop6): mount failed [ 2804.139544] syz-executor.5: attempt to access beyond end of device [ 2804.139544] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2804.140892] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2804.163475] loop7: detected capacity change from 0 to 16383 [ 2804.176316] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2804.177257] EXT4-fs (loop7): group descriptors corrupted! [ 2804.197853] loop7: detected capacity change from 0 to 16383 [ 2804.200978] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2804.202123] EXT4-fs (loop7): group descriptors corrupted! [ 2804.208687] loop6: detected capacity change from 0 to 16383 [ 2804.238332] loop0: detected capacity change from 0 to 40 06:52:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 64) [ 2804.268511] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2804.272410] EXT4-fs (loop6): get root inode failed [ 2804.273370] EXT4-fs (loop6): mount failed 06:52:34 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) mount$cgroup2(0x0, &(0x7f0000001380)='./file0\x00', &(0x7f00000013c0), 0x10000, &(0x7f0000001400)={[{@memory_recursiveprot}, {@memory_localevents}, {@memory_recursiveprot}, {@memory_localevents}, {@memory_recursiveprot}, {@subsystem='freezer'}, {}], [{@appraise}, {@func={'func', 0x3d, 'MODULE_CHECK'}}, {@mask={'mask', 0x3d, '^MAY_READ'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@measure}, {@uid_gt={'uid>', 0xee01}}]}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000240)='./file1\x00', 0x2008000000000, 0x1, &(0x7f0000001300)=[{&(0x7f0000000300)="ea3ba404c3c9c045e9df16d7f30c35823dec321dd1f13cf8f264718c3a6b0897d132d9e70dc0262e1c6a6fdc2a3ad91f5671bcc24934299e2bbaa487af74e82baf2e9a9f1b572081b59d7df237c5201eca15129acfbae510e06a7ecc0b11c05d68398cdf9cf2edcdb015c63be3f954e0aa90ca87459bb5949cb0e610f8fd8b23fbfe6542bc0d0f02f65d816f6e79f983e7f287b93d0a8a6f2bc07ac6cbf0363e6f08d1671e1b7cc8e0912bc7cdafc08d8cec5c3f4e5d3abac49a2138e20c5dcaa8de17bf24dc50116757ee4651f642df7345142fa49a1ed619a8d4972c3867a137019399cd5042774c52519c531a588f74c4a45e537c086d3f902d5e8676191d2fe8ae480cc64d9c4c0056763232c76a8160a9b50a9ea6324ccba7baf9b2dbe1d83b10aeb03d9d6196490c45ac5ceb0b50fbcbff49762d62e12f482a89c32f3a4ccceb2364a02951bf658f117e102aa817dfe0bedc49ffe14efe828d3eb1e32918e70655f010b87715ae72f17c00735a90193c35afcb217948030864e18660eb89c7a888cf6328e36c30b7c8b1d1445bf6e06b920760044f73c20a63ab27e34018da9a67ee4020c61f57189ebd07155716c058d4b9d9c2cfa02bffa3ecd6ee89954b509ef7237400f8d6050c8dc9d541f148d649f30eda78a469dd5036b6a0a6d7c2f13172be6c3f76f8bb2c64dfe47f36e397bc1b125b5d9e609c39b06f634f64f6a39ad44c93808394313eb7e046a7ef86863b9fe813acc0cbe80bf002a5c39ce66a5fd90e40432e097870a9709290f5e4993e51797fb05e9bda04a24a05bf6a16df82fd5b81296c816dceaf9b2698f858e11e3024ee50fa2644d178f3a414e3bbe3a4889d8ee9c065d6759a733420164b05d8472c09abdc863aac5c8498458d69014af5d5f93ee4b7df339ebba5b65c468af2bdf901539e11b8673c99fcf48a908087ea27e2b9edf0b54129cb46ad562b746922d45101309e2424b07d657d91a39ff4c6a7a772e56766e39d41b798195fd3963aacb710b1dfe7fe0a18edd040568b93560311d1d626d94cca303988985f7b2f3bfd2d9700f0bf861d9b1e5487074bb5d898db3cefc9276ae970fcf03cc035f2f80e06581aa5cd134a14aaef860645ab18f0fa7b04ae123a0132e11809b1150ffaf8e55aec03a1a5a81112ca91897d668e94f1cb03af382d1ffada7a830f7532ff05c9c1b99ae0f344c9b95681a7a0eee47dc13b50509d7703405d25748c71ee422fd0dbb4681fd02775550c5c26fab516e58ea0f5e8cbe7084890e84058694bc02338db6e2de169f6cdf6f2834869ee92e74ac0b92e233677674213d36a4f5dd0e90830b8707ef4f20cf55e955d81657adb4b66b0a290a12423d8f597ced84ec0e820ef76edcb4869fd2c4060c1e8a3f96290244169a798cf4f74e3b1abe992f35a538494e0898473ad71526232c66a6f5cc34def188e7c8e33f33514dfdb048e9a687b68ef6c1440d7f9923b8c5f2c156c0fff2e20b25add1f569c375c4f39b9f3699fe4e1ff48f0a2d9b9dafbe288cd66375b52a73006858d9048ad28469978eaf28f2c9fe9e89d824a3e7027aa497f93854d55ebd897d38b71a8dc07e240d7f8298107385c8d79a804fa0cdeec4afd8373fee42dd8c941ba064af0f5644b2f9595ec3bd0ed6d310e07fbfe1fdb67a7424ca45cdbfb91041d66ee4a64669913813744e7feff9c291c7b25cfb70fd8fa5ed3c9968fe51868262d0ba99b35c992848628edea4fed26bc68655f9918ce24b92605a7552069030fb48986ebb4a69cfbb62e36f9d0e432cb43fe733233d3b9d61440744a22b350b95bc77dd79ce83ec15df4eb143c3ff9f3b184d8b3d4a2ab360d4ee2ced20a55f87012f20f2399d9cc7dc0de151ebc73caf096f2c2efa63ccbc43fc5be2ec9782a2b7118562a1d85fbfe374c112e4ea2a3e11750f8de1e325326e1595309d259997286ffa619a25886eba0f223fe22ac7e7af7af22b2fa30d1732e3019735dc05bc10dac21ede642e3dd5f0186d281da538597d46e5cf2e02061989c74fe0c680b888b0b7452da6c7003063e3cce405bbe73e795eb524a16d4bd8795857503dc8742efb240a65207cb3a8831b55f0d8ebd328a32a3504bae20247c10b9d15735b7a4a9bdc9e4d9f15c95943288bf1737fa0137d1efda478de6bc6f5d5930484b75df1669c38f03bdc207cdb0f23e14bf4518f025ff3c17c389270e967cb66062d1e94852b102948acc26833bad163b078238d1d4dab21cfc69f1bf2986aeed0ce8ada242dc55e300904f59204f43a177e97c8da4dec09a794948ee50db8ebc8195d9f5f72bfd6cb99bcf8ed0c6674aaa522cae135fd22e0f67851ac0a47edb42021ab254ff5b6ced9a70580f306263ff99159c098eaabb4d7a3f2f07318c570e6b9b32c01a07d4dcd2b08d38855c9b8fb24af8b2b5bdd16ef2bd59f117d4a2cccc6650ef782c2a434055c4c0f112eface1824ece9f8ba3d57bc91fb50a7fa0c89408238097ef7fe1440d604cfd2703653db2a3c998308b1b3e00f1702d1ac4349de84c9c3788edc8c42ba36e5cf65a64c69bafce799b8a62918b9d5c960ba63bec51c28b5ac8cf9b4ab215f8e569dc1ccb3649e16b7f274eb0d1cdd95c171a4abc0bbebc89804e17b29827b9fa6ae1b94fe621d475b00fb914d1c4a34202935bd2b1f96540c7fe5bd73d34038c1a88b0331ab2a9cccda8a3c7e9b15da3d0bc421a651ebe36f9abfb8d28642fde61f1a533980d7543a59837b2da36163ef9db8d2b0b2df233ac2fb64cb28b4135802efbef83eb2b9e393a2803b409e04258b5350239499ecc5816575a92b07cf039812046c41672a1735dfbb76e86de334ed34b6def2e70bb86cd86b2dacba5888b59f44e2cdc92dc8ad0a042dda9d44a0a8f0eeec9be171c739dfb1f453f2e3e6d7582a8857e37ef829fc1854cc029e35fd3e2a6b64ef074cba3559c19bc52bca499636e778366dca676efc0c6c2ceca3d9f94c175f412c6447183e345035598734f144cf4dcae96d00e35d422f580e942b656986650e464786dd1c0e281b7e257c1d873c3d6f8a2588a8883e5d4b0b9ed7d59997c6d63ac615875c94a255f74dfd83f7bec3af97053f515ed4c52eadecc6ed953d5dbe9ca27a629860cfa8559df71c50ab9af0cb3ce2678ff3b0267d0f101c4d5e57b17280bf3d5f79285cf478c020861b14ca971fb677edd745355facb7c833bf91815ce0e61f76c0f7eb641974e6d600af8bc1a76d448c6e2e1fd32e099c58f80ecf79ab066a250cf152f31e5994158e77c73d5ede18fb978375603e13942e9f874f76319c6e0174a0cb13bd30bb464f584ed7b17a01e1fbbcec7d25d6d2e6c92f71b565c87bafd2113c0f5cda3dc47643e8d435160b084d5b5306f5da8edfd989114378499d2607890517743a77df14835c980efdafe5c5d3e18c28893ae2a364e31c171f4d43a98deb91a96094990e25ed8e2d3af0846962482778f2a944a39a8c37abf6ba8ad14054d55bf85bec074aa5099d9e1bbfa4baf3d87ed3b4377031ef0d3b129feb5333e8f8158a235de878f47e5d0aebabfa9f0289f04cf1d6d7f6f83a21df7f4a742a431b6ec71b01c486e5cbb674514d1a226bcb01c2579788dfd2b69492d20fa5124177d61dc89487bab8b30d4d96a5759af5787e61a9c7aa28648cbeb453b216af4279084028006ff6b166ac1157d4f9e2840000f1f79a392654073499e53f8ea6157522c51bb5b4824d3a526fcc997a6f65dcb84dc91a6057c5a00e04d7ff5c304f49ee5df51727cd08097d7451f1f20a174b14a254e333f38a9952344771819b0fbbd5cec0125ae9c2bd83761b49bfd67a8f7b92acbbe85f5241d5356934e49ecbdf6c6a4768927e73f9488f43fcba295ef8f0c161e2411590ec807aba29d7c02929549c6af064dfcc0485e3aace489e4f87cfeb23bb14ceb3ba83d457805e508640777434a09a879e0d79833e441f92c82fd24c5c485f73238846190cc20cc27809c22e22f32289ab0f98fc22c5cfdb9f4087e25b26ec493d49624aad1fddc29f6e48aee7b4dc74cf743336923af74bfeff30d083d791f153924ccb8818cce556ad84e7c7f839b4f80b647916435dae79338ebf1e13c473fbe840cc94d98add6274365c6347922785148e27007f82d1a07d5d827c94ae773349a5db75d692bd1dd48bcfe8a43b82db3c135416432e6e082592a8b58931dc9f38760f25ed6aebd5c769a967130fd1239757d03db69037a5c1a9eb4a10f1b3b1fc32d5b55b75bf40c32378907665adbd9fda30607ffdc94c41b28f7f0e5557fbe323d327445c243fe8e8648421e0f24ce0f58468c0e296780f3310c8e84b26cf3a04240e0f84646824283e286383047cb12651c8a18d00aaf6dd865593351186d62238e78609b8c3a4cabb40439fd0b78a545de697aed05c8fbb3a85cfbbd4bee153b28106554a676db64bd2586e87cd0a06ae08a24b38a0586fdc8f40d81c7b9c9e4688cb659f164f414753a5ce8d370935e7620a648045e0e5d0141d7ff6a443d8e1d9271ed55aa8cd7592ec8b5fdddf5afda07fb926cd1ec6736a21ca8f8a1fd60893a4e943e33aeaae6e6a1b8f06e1983298a05cc0c88e1522c3c76ac58121ac3fdf99e6df81941faf0261ddf9bd3f6094c7a7558d0a5565885bd479e0370fd421a1e21b0d85221072a1d9e828058f593f2ce71ac6b3bb8b95106c71333422265ec94d6fbe75d4797a896b66cf1007c94810b838d35d68e58a10797923e10d3bd07b9061a62a0f833876ca7301261cb9cd0720244930839fee665502539b4b6ebbee44f83520c403ffeb105759e2286481f690a92d6a49ba129431db8200031313700564b332728692cfa1da731c1498c10c589704dfae31ac6e4fef0bc6a943d2f74fdd03fe9e9fdd94f0923f7ae78a7b1cd0730dc48b89415d34eddef22aaad3167d550fc442069e7ba3d6c28afe98ec5be153627761fa08c222ee076757ae2d0c237dbf44feea887a65eeffda0f48acaf526b974cdf269c33a0e90143630ae66b6a64735196255e2c8757452c4a63fa74d050233317cac60be3b687508b8e8f2c87d2f09e1d64f2b8103da4da9bf26415598515701fcfb39b7b1f28bb42ed7ea3967779a680d17600761726b3cb3d9c507969bdf7dc8f0236cc227ee449efe1115344543228e8141047475f3480dfc77cc0db603463e4dcd826471683e65c72918b0511418277e276273658433654dbb4fd161faa0008dc2604c351593e4d704706015aa9aa5971e00e10a6861b072a7a96202983a9d915ad50d55120ce9a0b71621ada7b8ad75ba9bbbcaad908c8a38551a60568341e85ef53b0525f293511a7b18069b1b8b94dbe90a01510ad3f103770b3c3902adefe95fa5c9343a2e121c3be27c6401a54c978cef0c6e09e60ab562481219228099f7ff716d164f242f79f5e14336e2dc629301772cd78e8ce272f79489b8ea34038ca22d5ced676cbd1fe0c2916a98fcec2257964dc581bd7a525f92381df1c192d4a7a665e3697fcef8e7b86eed0085f30dc2ef437fe4d890cd82c2a081fcdce0880918a8b715aef9914dc8f5144adee6e384ee5572e4d3e7d2aca6e628a271c886bff4b27557f06c07c2693301f3d487fa6a905e97e030b54906b5f41ee4998cfd6f251bbf1f4c6e56f62cb50fd97a9b435f4aab779955090ac2a8f8514259d7b8d754dccadfc1c48b8fa04d887eec6ee37b9c6dc66e7fa317a3ec66017e355178d9d9c66be547026600474a2522ff873ff3839d77", 0x1000, 0x80}], 0x9, &(0x7f0000001340)={[{@nodots}], [{@smackfsroot={'smackfsroot', 0x3d, '/'}}, {@permit_directio}, {@subj_type={'subj_type', 0x3d, 'vfat\x00'}}]}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2804.287333] loop4: detected capacity change from 0 to 40 [ 2804.312278] syz-executor.2: attempt to access beyond end of device [ 2804.312278] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2804.314216] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2804.366369] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 06:52:34 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x43, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:34 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:34 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x800, 0x6) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2804.516647] loop5: detected capacity change from 0 to 40 [ 2804.540068] loop6: detected capacity change from 0 to 16383 [ 2804.564384] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2804.570092] EXT4-fs (loop6): get root inode failed [ 2804.570505] EXT4-fs (loop6): mount failed [ 2804.592143] loop7: detected capacity change from 0 to 16383 [ 2804.596340] loop6: detected capacity change from 0 to 16383 [ 2804.625602] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2804.639722] loop0: detected capacity change from 0 to 40 [ 2804.643964] EXT4-fs (loop6): get root inode failed [ 2804.644662] EXT4-fs (loop6): mount failed [ 2804.671572] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2804.673046] EXT4-fs (loop7): group descriptors corrupted! [ 2804.709051] loop7: detected capacity change from 0 to 16383 [ 2804.749602] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2804.750951] EXT4-fs (loop7): group descriptors corrupted! 06:52:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 65) 06:52:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, r2, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r0, 0xf50f, 0x0) sendfile(r3, r1, 0x0, 0xfffffdef) 06:52:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51) 06:52:51 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r4, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d535f8508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r4, 0x10, 0x0) accept$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) write$binfmt_aout(r3, &(0x7f0000000240)=ANY=[@ANYRES16=r4, @ANYRES16, @ANYRES64=0x0, @ANYRES64=r0, @ANYRESDEC=r1], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x80, 0x0, 0x4a, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000300), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b1a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:52:51 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x10, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:52:51 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x48, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2821.941942] loop6: detected capacity change from 0 to 16383 06:52:51 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) r4 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$bt_hci(r2, &(0x7f0000000000)={0x1, @le_set_ext_scan_params={{0x2041, 0x19}, {0x0, 0x4, 0xff, "408f9cccc603577e6ef8a807d65a7a4ff33085a57d50"}}}, 0x1d) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) io_submit(0x0, 0x7, &(0x7f0000000b80)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x200, r4, &(0x7f0000000300)="cadc4229406e0c2cfe86cef4821d3f07aa4d3fd410a7d305d8f8a6ebc48c317f0180813ff699a789cd998db7190b70e0d73c0b0b56eb6c5fe3c4a0efde7b55762a6e32359ea7250b544c760b7c51e992c21d4889e826af22226378e9e706039faf080033f3fc74553c5e3d9fb7ce46eb49a17334730349cd9ea450d7d24f870be3a2b3a6429893166f42c3d25761ef44df10001f09d0eb75c026d9d894329c78e2538c93101c54630f5f4858b456619ec0bef673194701080d795adb43e130b1654e25f6e5d4a1c49ffa0d4ecb86e0e17d0e83ad89b7fce7b6919fb1ae936427fbc29b814a4fe7dc780b244c7293c7", 0xef, 0x7, 0x0, 0x1, r3}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8, 0x8, r1, &(0x7f0000000580)="75271b2b29b311aab58d086a613a66dcc8e565738271e8037a3475533b85a78120272de817c1eed02679b20d23c4d7f6b68ae3cd3a53c5e914fac1274047e29e3a307431cec3ef3a5f2e1bbfd4d538acc3e0c9a849c5a1ad13874b79c71ef24afa44e7900f665b68379b9faa19e7c13fadc92b3fb1119379fb13e5515dd5ea32f3ad7e99bc4e17eb2b7ec01fd200816c2ed79451aafc096c675dfd2ee2de79abae5ab2e59581d6173ab8e40908ec15ec12bc3f11423ee2d469c6a99c0c174bd40cf6f6065e123a07dcfbdd4475d1fa488685395ea16c4939234f5452910355", 0xdf, 0x7, 0x0, 0x2, r2}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000400)="cd8534241ef453dc8de4f6b6b7b7f8efb769292386b0723794e12bbc15ea1900c29b8d4a9a77af42b818e319b18ed3d27bcd5bfaede7a4ba29ff5312e527cedcd790d9dfd7045081b6efcb39b7432550e12e41097b5b94e57d0cb2", 0x5b, 0x4, 0x0, 0x3}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x5, 0x3, 0xffffffffffffffff, &(0x7f0000000680)="da4a25827689d911618bae782a76765714f38735aa9c85b2673812045e6dfef158ddf283ef04eea764a2b2583ec6832b86997aeee0a7668191c7ad5618e2d846f1fb31a3f3a8dcda00af51f4913f32ec8fd3289235d4404e80c251b20ea892b43590ffa1d4f30d24d8ac561eb17748f515af2079e89fba7619c019edc7f6dac88436abfdb37a2d171021e4ba0dfdd9d82b0e34173a200e95d0f1c623392444b0a2b8ebf172f7eb4e22a6618a743a5cf13ea8530597d861d2020b56df527da3c626f5149caac75013b478527b5eb9a9eca6c07371910dfda7567fb0e77a64506266304370929eec1ad235c114ed6d98f2be11b7011f", 0xf5, 0x4}, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x1, 0xb73, r2, &(0x7f00000007c0)="8814ee0982b7630acf36b32a32477137dcd3649510c716004f7c7c2e4f40cae679bdd2d356", 0x25, 0x8, 0x0, 0x2}, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x1, r1, &(0x7f0000000a40)="ebdbff18f55bf3cae508610218fa220a1c2e25e2803871805ee3641f9ad7e46021b891d348400c194f4d486fc51a8a6404a944a384d9356cb934ce6d161a7f02dc923008456c087b423e26a50129", 0x4e, 0xc72, 0x0, 0x1, r2}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x1, 0x2, 0xffffffffffffffff, &(0x7f0000000b00)="b5a9d23a4f202bbe4ac8d754c9d7e3f98168b9fb6337bdad85acf42dab4649beb396200ec62424a7c1870019aa04c1c3266a4831ed14f752d0e141d6", 0x3c, 0xfffffffffffffffa}]) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:52:51 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') preadv2(r0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/133, 0x85}, {&(0x7f0000000000)=""/82, 0x52}, {&(0x7f00000003c0)=""/165, 0xa5}, {&(0x7f0000000580)=""/166, 0xa6}], 0x4, 0x7, 0x9, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = getpid() pidfd_open(r4, 0x0) syz_open_procfs(r4, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r4, 0xd, r3, 0x2) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r3, 0x80286722, &(0x7f0000000240)={&(0x7f0000000640)=""/72, 0x48, 0x8, 0x2}) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2821.969526] loop4: detected capacity change from 0 to 40 [ 2821.973472] loop5: detected capacity change from 0 to 40 [ 2821.979961] loop7: detected capacity change from 0 to 16383 [ 2821.980759] loop2: detected capacity change from 0 to 40 [ 2821.999083] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2822.000445] EXT4-fs (loop7): group descriptors corrupted! [ 2822.010688] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2822.014454] EXT4-fs (loop6): get root inode failed [ 2822.015180] EXT4-fs (loop6): mount failed [ 2822.025802] loop0: detected capacity change from 0 to 40 [ 2822.038922] loop7: detected capacity change from 0 to 16383 [ 2822.039335] loop6: detected capacity change from 0 to 16383 [ 2822.052230] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2822.053376] EXT4-fs (loop7): group descriptors corrupted! [ 2822.061091] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2822.064408] EXT4-fs (loop6): get root inode failed [ 2822.065316] EXT4-fs (loop6): mount failed [ 2822.132646] bio_check_eod: 5 callbacks suppressed [ 2822.132674] syz-executor.4: attempt to access beyond end of device [ 2822.132674] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2822.135227] buffer_io_error: 5 callbacks suppressed [ 2822.135258] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:52:51 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2822.197394] syz-executor.2: attempt to access beyond end of device [ 2822.197394] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2822.198692] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2822.202005] syz-executor.5: attempt to access beyond end of device [ 2822.202005] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2822.203044] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:52:52 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2822.259064] loop6: detected capacity change from 0 to 16383 [ 2822.287015] syz-executor.0: attempt to access beyond end of device [ 2822.287015] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2822.288207] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2822.300107] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated 06:52:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) r2 = getpid() pidfd_open(r2, 0x0) syz_open_procfs(r2, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r2, 0xd, 0xffffffffffffffff, 0x2) kcmp(0x0, r2, 0x3, r1, r0) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) [ 2822.315074] EXT4-fs (loop6): get root inode failed [ 2822.315447] EXT4-fs (loop6): mount failed [ 2822.345646] loop6: detected capacity change from 0 to 16383 06:52:52 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52) [ 2822.366986] loop7: detected capacity change from 0 to 16383 [ 2822.383367] loop4: detected capacity change from 0 to 40 [ 2822.384432] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2822.385343] EXT4-fs (loop7): group descriptors corrupted! [ 2822.403236] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2822.404732] EXT4-fs (loop6): get root inode failed [ 2822.405259] EXT4-fs (loop6): mount failed [ 2822.408643] loop7: detected capacity change from 0 to 16383 [ 2822.436997] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2822.437756] EXT4-fs (loop7): group descriptors corrupted! [ 2822.491167] loop2: detected capacity change from 0 to 40 [ 2822.541501] syz-executor.4: attempt to access beyond end of device [ 2822.541501] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2822.542563] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:53:04 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1, 0x2, &(0x7f0000000200)=[{&(0x7f0000000040)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17, 0xb}, {0x0, 0x0, 0x27fe}], 0x8, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000000)='./file0\x00') write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) setxattr$security_capability(&(0x7f00000001c0)='./file3\x00', &(0x7f0000000240), &(0x7f0000000300)=@v2={0x2000000, [{0xffffc8f7, 0x5e3}, {0x2e4, 0x1}]}, 0x14, 0x1) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 66) 06:53:04 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x1cf) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchown(0xffffffffffffffff, 0x0, 0xee01) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:53:04 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x60, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:04 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:04 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x12, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:04 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53) 06:53:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000098cc1ba085ac376fd1", @ANYRES32=r0, @ANYBLOB="01800000000000002e2f66696c653200"]) pread64(r2, &(0x7f0000000300)=""/153, 0x99, 0x6) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2835.020947] loop0: detected capacity change from 0 to 40 [ 2835.034535] loop2: detected capacity change from 0 to 40 [ 2835.044508] loop6: detected capacity change from 0 to 16383 [ 2835.095432] loop4: detected capacity change from 0 to 40 [ 2835.100052] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2835.103389] loop7: detected capacity change from 0 to 16383 [ 2835.105924] loop5: detected capacity change from 0 to 40 [ 2835.123047] EXT4-fs (loop6): get root inode failed [ 2835.124051] EXT4-fs (loop6): mount failed [ 2835.154640] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2835.156070] EXT4-fs (loop7): group descriptors corrupted! [ 2835.169385] syz-executor.5: attempt to access beyond end of device [ 2835.169385] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.170399] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2835.176818] loop6: detected capacity change from 0 to 16383 [ 2835.188745] syz-executor.0: attempt to access beyond end of device [ 2835.188745] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.190656] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2835.202464] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2835.204113] EXT4-fs (loop6): get root inode failed [ 2835.204482] EXT4-fs (loop6): mount failed [ 2835.205511] loop7: detected capacity change from 0 to 16383 06:53:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 67) [ 2835.235533] syz-executor.4: attempt to access beyond end of device [ 2835.235533] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.236486] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2835.241157] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2835.242492] EXT4-fs (loop7): group descriptors corrupted! 06:53:05 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x22, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2835.283909] loop6: detected capacity change from 0 to 16383 [ 2835.292955] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2835.297226] EXT4-fs (loop6): get root inode failed [ 2835.297609] EXT4-fs (loop6): mount failed [ 2835.310465] loop6: detected capacity change from 0 to 16383 [ 2835.322001] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2835.323396] EXT4-fs (loop6): get root inode failed [ 2835.323758] EXT4-fs (loop6): mount failed [ 2835.332610] syz-executor.4: attempt to access beyond end of device [ 2835.332610] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.333512] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2835.335501] syz-executor.2: attempt to access beyond end of device [ 2835.335501] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.336475] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2835.366482] loop5: detected capacity change from 0 to 40 [ 2835.435957] syz-executor.5: attempt to access beyond end of device [ 2835.435957] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2835.436915] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2850.528358] loop4: detected capacity change from 0 to 40 [ 2850.531874] loop2: detected capacity change from 0 to 40 06:53:20 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x23, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:20 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x68, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 68) 06:53:20 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$EXT4_IOC_GETSTATE(r2, 0x40046629, &(0x7f0000000000)) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10000}, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0xe6}, 0x0, 0xfff7ffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:20 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54) 06:53:20 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eee06d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = syz_io_uring_complete(0x0) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x2, 0x4}, 0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000580)={{0x108, 0xfe, 0xf7, 0xbb, 0x322, 0x3b3, 0x138}, "ac203a35abbc714fb8d5a673b43922556e3e84e8732c7ccea9d41992b4d63ad4d0dcb6a093f54ba6a4f12b7cf339d2e1f8e3d48f04328d110361639d83e82ab06c11a51fd2124c655dc51744a8bfb71abaf81b7076bed4cbe4ee33ca5d43d3af8dc03af86ab907eb56c7a52e896528b48be84b938988526a5e7277d4d661bacfb6cc8c3e2f0c96dfcf181d12b41ab2d36f5217eb03dbff5511078983aebf8f2ca42eebd09b1c788363e01ecbee21f6bfb100b61c9dbf47bd3c06ce8cfac8a886f22f338f0207eb9018ef735034", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x6ed) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat(r4, &(0x7f0000000000)='./file1\x00', 0x414041, 0x179) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c7735702669d87b236c8204ed6dd40e1449986220ffed1d691bf1a2dd6998a1a190dd49077ec487870b834aaa29c9141955adc3e0b7f001a30009bb7b98c644cd33933f1bc35e18646cb095759966cf3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70100a09d7801b10000000000000000"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, &(0x7f00000001c0)=0x200, 0x7fffffff) sendfile(r4, r1, 0x0, 0xfffffdef) 06:53:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000300)="601c6d6b0440002900f801ace3dca7f82c9f2028f6d0192a42718d3e7629e373c1187dd4435c35ba6439ea24b2307f7067dca4e8f88d76e0d56f1d8e1ae8ef3a220649304955e7317101b8653ae0945af7fed931bb1c25ffba4e805629a42d0529dfe181883ee58d69e29a5336813d97bc001075f34b2d458790587ef0634beb76aec1a80990e18ad6b1949898dd609b06681ed84f67d9a801d4f8a9e759d4c73c20ab5dc8dd42e3a772143bfa7735a3b6ef104c683132d8a7e2a8884878171eb41fb202de46cd29bdf647e3d27a05405b04dd9c0eeda706b95315189f48f726ab93b987adb7d025987a2b7980481f5adc8f39eb60d5baec4d91268fc74c065d38249b0127c5c13fe4101b038924e95ac53517fc24293b20dcea62f886423ce84ccf1e943549e7bd800fcbdb44478298cf254b36ff11d998916bbaafaabebd7d01f01b54e600370ebb8adea031c7812af55ad280f9e1b024262a4931a808e954b3df20edcc3f223865b9ee8c0db92ee04140b9a20b8101f981676d299594987dd5d2646148e72904", 0x188}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) mount$9p_tcp(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', &(0x7f0000000580), 0x20008, &(0x7f00000005c0)={'trans=tcp,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@access_uid={'access', 0x3d, 0xffffffffffffffff}}], [{@euid_gt}, {@fowner_eq={'fowner', 0x3d, r0}}, {@seclabel}]}}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000640)={0x1f, 0x1, 0x2}, 0x6) sendfile(r2, r1, 0x0, 0xfffffdef) r3 = syz_open_dev$vcsu(&(0x7f0000004180), 0x0, 0x80001) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000004280)={&(0x7f00000041c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000004240)={&(0x7f0000004200)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004008}, 0x8000) [ 2850.538642] loop0: detected capacity change from 0 to 40 [ 2850.550754] loop7: detected capacity change from 0 to 16383 [ 2850.557222] loop6: detected capacity change from 0 to 16383 [ 2850.563647] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2850.564333] EXT4-fs (loop7): group descriptors corrupted! [ 2850.573747] loop7: detected capacity change from 0 to 16383 [ 2850.584943] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2850.585604] EXT4-fs (loop7): group descriptors corrupted! [ 2850.617793] loop5: detected capacity change from 0 to 40 [ 2850.635827] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2850.640031] EXT4-fs (loop6): get root inode failed [ 2850.640903] EXT4-fs (loop6): mount failed [ 2850.669725] syz-executor.4: attempt to access beyond end of device [ 2850.669725] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.671934] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2850.686885] loop6: detected capacity change from 0 to 16383 [ 2850.691635] syz-executor.2: attempt to access beyond end of device [ 2850.691635] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.693351] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2850.717233] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated 06:53:20 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8d77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1d2757aade8a6e9b2e46a56dbb55eea52b2e875"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x12481, 0x0) accept(r1, &(0x7f00000003c0)=@alg, &(0x7f0000000040)=0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24089, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) 06:53:20 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2850.718851] EXT4-fs (loop6): get root inode failed [ 2850.719244] EXT4-fs (loop6): mount failed 06:53:20 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x24, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2850.758024] syz-executor.4: attempt to access beyond end of device [ 2850.758024] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.759733] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2850.772462] loop6: detected capacity change from 0 to 16383 [ 2850.774720] syz-executor.5: attempt to access beyond end of device [ 2850.774720] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.778165] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2850.785640] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2850.786827] EXT4-fs (loop6): get root inode failed [ 2850.787174] EXT4-fs (loop6): mount failed [ 2850.797618] loop6: detected capacity change from 0 to 16383 [ 2850.819478] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2850.821277] EXT4-fs (loop6): get root inode failed [ 2850.821640] EXT4-fs (loop6): mount failed [ 2850.824123] loop7: detected capacity change from 0 to 16383 [ 2850.833095] syz-executor.0: attempt to access beyond end of device [ 2850.833095] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.834032] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:53:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 69) [ 2850.864513] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2850.865927] EXT4-fs (loop7): group descriptors corrupted! [ 2850.914250] syz-executor.0: attempt to access beyond end of device [ 2850.914250] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2850.915241] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2850.989346] loop5: detected capacity change from 0 to 40 [ 2851.103736] syz-executor.5: attempt to access beyond end of device [ 2851.103736] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2851.104721] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:53:37 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x43, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:37 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x4982, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/196, 0xc4}, {&(0x7f0000000140)=""/49, 0x31}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/91, 0x5b}], 0x4) 06:53:37 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() pidfd_open(r2, 0x0) syz_open_procfs(r2, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r2, 0xd, r1, 0x2) fcntl$lock(r0, 0x5, &(0x7f0000000000)={0x2, 0x0, 0x6, 0xda, r2}) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="2106000000050200874cffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0xfd, 0x8, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r0, 0x0, 0xfffffdef) [ 2867.720845] loop4: detected capacity change from 0 to 40 [ 2867.731591] loop2: detected capacity change from 0 to 40 [ 2867.741112] loop6: detected capacity change from 0 to 16383 06:53:37 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0), 0x5130c1, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10010, r1, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec4c3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a000000000000000000000000c2952034777c57ce3a9ecd858e108e0b171acd8b4ba1a6c0b375f2940d22fe552458255f10c92a88537c9a0753569dbefd278e6a1cc75a56457db92873c0802fcb89a988c5f80c6e4e3d44af3f8843a519790274174dac5f8b44f8a6649ae17d10b5b64fc6372b3f7b6e462aad085579a24a73dd0e1a7ff3c622b5dda9b133128877412be5705455c37110934de443ca793d09c0455973f3ba9259877ea28dbeb80d7c086cfbd85bb20e1efec8a2a96397bf0319399137107f230e8dd1e0397bee16b8da2bfe19579932a15e168a9b94dd7948060fb7bcb554eaa73077"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000240)='./file1\x00', 0x102, 0x88) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) 06:53:37 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x74, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:37 executing program 0: ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000000)) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000040)=0x1) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3bc56358a4d1fbe257713f1a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6b98a1a190ddbaa96c077ec487870b834aa229cb141955adc3e0b7f001a30009bb7b98c644cd69d4fa9243a16805880038b4674939612ade470b50333f3a52b14bc26c08d7806e26ee69466c1b538f446e2ee6ce2a9f3f678b34c4de61bc79fdb0b137e62bf5158a80f8daab000d347c2ffd178e2ac4b03fe1e398ba650add2d198d0e8e3a34a2a2383b2dcef02c99af983469bf181242f2a365be0c5785f7493da63ec2e1cfe4af2fe41f66c70b10f4d2d1a1c41bc27379fdbb802282f38439e930fa1bf7ac9e417704eb8e19a45e6746b1ab25019e6f1b7d894d6c3b0afbe672b9"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 70) 06:53:37 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55) [ 2867.750997] loop0: detected capacity change from 0 to 40 [ 2867.752494] loop7: detected capacity change from 0 to 16383 [ 2867.759939] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2867.762214] EXT4-fs (loop6): get root inode failed [ 2867.762572] EXT4-fs (loop6): mount failed [ 2867.771113] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2867.771752] EXT4-fs (loop7): group descriptors corrupted! [ 2867.784102] loop7: detected capacity change from 0 to 16383 [ 2867.792532] loop5: detected capacity change from 0 to 40 [ 2867.796562] loop6: detected capacity change from 0 to 16383 [ 2867.798602] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2867.799397] EXT4-fs (loop7): group descriptors corrupted! [ 2867.836674] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2867.838196] EXT4-fs (loop6): get root inode failed [ 2867.838555] EXT4-fs (loop6): mount failed 06:53:37 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7a, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2867.896613] syz-executor.2: attempt to access beyond end of device [ 2867.896613] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2867.897609] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2867.935441] syz-executor.5: attempt to access beyond end of device [ 2867.935441] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2867.936408] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:53:37 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x48, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 71) [ 2868.111879] loop6: detected capacity change from 0 to 16383 06:53:37 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56) [ 2868.137548] loop7: detected capacity change from 0 to 16383 [ 2868.154119] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2868.161571] EXT4-fs (loop6): get root inode failed [ 2868.162496] EXT4-fs (loop6): mount failed [ 2868.167082] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.168549] EXT4-fs (loop7): group descriptors corrupted! [ 2868.200690] loop5: detected capacity change from 0 to 40 [ 2868.229156] loop7: detected capacity change from 0 to 16383 [ 2868.232891] loop6: detected capacity change from 0 to 16383 [ 2868.251841] loop2: detected capacity change from 0 to 40 [ 2868.259252] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.260694] EXT4-fs (loop7): group descriptors corrupted! [ 2868.266541] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2868.284962] EXT4-fs (loop6): get root inode failed [ 2868.288184] EXT4-fs (loop6): mount failed [ 2868.395315] syz-executor.5: attempt to access beyond end of device [ 2868.395315] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2868.396381] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2868.397145] syz-executor.2: attempt to access beyond end of device [ 2868.397145] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2868.399152] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:53:38 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x84, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:38 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2868.545240] loop7: detected capacity change from 0 to 16383 06:53:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 72) [ 2868.573386] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.575252] EXT4-fs (loop7): group descriptors corrupted! 06:53:38 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57) [ 2868.649677] loop7: detected capacity change from 0 to 16383 [ 2868.651598] loop6: detected capacity change from 0 to 16383 [ 2868.656627] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.658087] EXT4-fs (loop7): group descriptors corrupted! [ 2868.716905] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2868.728311] EXT4-fs (loop6): get root inode failed [ 2868.729144] EXT4-fs (loop6): mount failed 06:53:38 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x86, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2868.767542] loop2: detected capacity change from 0 to 40 [ 2868.788574] loop6: detected capacity change from 0 to 16383 [ 2868.793968] loop5: detected capacity change from 0 to 40 [ 2868.852055] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2868.854513] EXT4-fs (loop6): get root inode failed [ 2868.855532] EXT4-fs (loop6): mount failed [ 2868.865519] loop7: detected capacity change from 0 to 16383 [ 2868.891693] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.892876] EXT4-fs (loop7): group descriptors corrupted! [ 2868.922357] loop7: detected capacity change from 0 to 16383 [ 2868.925182] syz-executor.5: attempt to access beyond end of device [ 2868.925182] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2868.926907] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2868.940235] syz-executor.2: attempt to access beyond end of device [ 2868.940235] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2868.941939] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2868.945566] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2868.946802] EXT4-fs (loop7): group descriptors corrupted! 06:53:38 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x20000000}, 0x0, 0x800, 0x0, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x0) r4 = getpid() pidfd_open(r4, 0x0) syz_open_procfs(r4, &(0x7f00000000c0)='fd/4\x00') r5 = dup(r0) write$eventfd(r5, &(0x7f0000000040), 0x8) r6 = perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x820, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r4, 0x100d, r3, 0x2) write$bt_hci(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYRES16=r6], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x1, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0), 0x5}, 0x0, 0x0, 0xffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x200000}, 0x0, 0x8, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:53:38 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x60, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:38 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000400)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) utimes(&(0x7f0000000340)='./file2\x00', &(0x7f00000003c0)={{0x0, 0x2710}, {r0, r1/1000+60000}}) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000000)='./file2\x00', 0x652c02, 0x11) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000240), 0x42400, 0x0) openat(r4, &(0x7f0000000300)='./file1\x00', 0x200, 0x11) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30051bfb09a831289154939612ade470b50333f3a52b14b0000000100000005000000000000005cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) openat(r2, &(0x7f00000001c0)='./file0\x00', 0x202040, 0x9) 06:53:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000001c0)={'batadv0\x00', {0x2, 0x0, @initdev}}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) sendmsg$sock(r2, &(0x7f0000000500)={&(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x2, 0x2, 0x2, 0x2, {0xa, 0x4e21, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0xfffeffff}}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000380)="847e614b5b516745e7f19490c53c9979541672c4d4dfeb7fcb86be01f03f907124e1f7cc54c26f8670590a369594061461c115fcc541d591759067c2298cccb06b86a31439afaaef76ecfbaef794853276e236d2a7d92d81b25439de42fe6b9b2b22e81d93e5c554b0a0d6c5cf9f4ba5a84190516a616bb05eae66374122ba3a8eeb1064688804647e74841d766fa798ebed84292c4e2f3b2825321f93abc4cb5972", 0xa2}, {&(0x7f0000000240)="f5848982de74785686997f3fcc40f0b2a0b65d82d1758ca59c733d471d24dc41e03a0f073b50b1712f8f992e82726b736330df4566", 0x35}], 0x2, &(0x7f0000000480)=[@timestamping={{0x14, 0x1, 0x25, 0x7}}, @txtime={{0x18, 0x1, 0x3d, 0x7}}, @mark={{0x14, 0x1, 0x24, 0x9}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x3bc}}], 0x78}, 0x8890) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$BLKRAGET(0xffffffffffffffff, 0x1263, &(0x7f0000000540)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) [ 2869.068696] loop0: detected capacity change from 0 to 40 [ 2869.088375] loop4: detected capacity change from 0 to 40 [ 2869.108909] loop6: detected capacity change from 0 to 16383 [ 2869.143029] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2869.149754] EXT4-fs (loop6): get root inode failed [ 2869.150756] EXT4-fs (loop6): mount failed [ 2869.152140] syz-executor.0: attempt to access beyond end of device [ 2869.152140] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2869.153969] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2869.202392] loop6: detected capacity change from 0 to 16383 [ 2869.229421] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2869.233890] EXT4-fs (loop6): get root inode failed [ 2869.234633] EXT4-fs (loop6): mount failed [ 2869.285540] syz-executor.4: attempt to access beyond end of device [ 2869.285540] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2869.287389] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2884.153628] loop5: detected capacity change from 0 to 40 [ 2884.155987] loop4: detected capacity change from 0 to 40 06:53:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 73) 06:53:53 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x0, 0x9, 0x6, 0xf1, 0x0, 0x1a8b274, 0x40, 0xd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x4, @perf_bp={&(0x7f0000000000), 0xc}, 0x1051, 0x200, 0x0, 0x2, 0x7fffffff, 0xff, 0x0, 0x0, 0x6, 0x0, 0x8}, r2, 0x10, 0xffffffffffffffff, 0xa) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) chdir(&(0x7f00000001c0)='./file2\x00') accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x140, 0x100) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5}, 0x0, 0xffffffffffffffff, r2, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:53 executing program 4: recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000300)=""/113, 0x71, 0x0, &(0x7f00000001c0)={0xa, 0x4e21, 0x7, @mcast2, 0xff}, 0x1c) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:53:53 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc8, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:53 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x68, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:53 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) write$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1, @le_ltk_reply={{0x201a, 0x12}, {0xc8, "e6a25a6e8180aebf22a58a614b3bb9ea"}}}, 0x16) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190dd05000000000000000b83ff4129c9141955adc3e0b7f001a30009ba7c98c644cd694939612ade470b50333f3a526e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(r3, &(0x7f0000000040)='./file2\x00', 0x80, 0x1) write$binfmt_aout(r2, &(0x7f0000000580)=ANY=[@ANYRES32=r1, @ANYRES64, @ANYRES16=r0, @ANYRES16=r1, @ANYRESHEX, @ANYRESDEC, @ANYBLOB="60b1fbfd9af36ebc8a9604647d3cf4dfe7d6184d98fd105d4bfb5cbfe2707c987b6bc39336b5108821d8be580fbaed9dc9e61d445f6132fa8c5ed29796a7d2aa4ae08729523e56fae530211b4d0e6214a694cef698646b11063763f9ef66be8574faaf03b12ebe51674ca1c42b57f66df73adb142cd48d47007e6347d71a75d1d251b9fe315a4a6dc56bb154d4c3cefb1f7d474269ccaa36da76e14cfa72eb29edd29367b86ebd6ef6ca9650c55bd14ae68ee4810fa01dacfbf2fd38567e8fd5", @ANYRESDEC], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c7735836105bfaf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20204, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:53:53 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58) [ 2884.167533] loop0: detected capacity change from 0 to 40 [ 2884.171100] loop7: detected capacity change from 0 to 16383 [ 2884.179599] loop2: detected capacity change from 0 to 40 [ 2884.180697] loop6: detected capacity change from 0 to 16383 [ 2884.204416] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.205743] EXT4-fs (loop7): group descriptors corrupted! [ 2884.223304] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.224612] EXT4-fs (loop6): get root inode failed [ 2884.225001] EXT4-fs (loop6): mount failed [ 2884.236422] loop6: detected capacity change from 0 to 16383 [ 2884.250862] loop7: detected capacity change from 0 to 16383 [ 2884.254060] syz-executor.4: attempt to access beyond end of device [ 2884.254060] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.255187] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2884.256635] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.258113] EXT4-fs (loop6): get root inode failed [ 2884.258465] EXT4-fs (loop6): mount failed [ 2884.279753] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.280963] EXT4-fs (loop7): group descriptors corrupted! 06:53:54 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2884.320558] loop6: detected capacity change from 0 to 16383 [ 2884.327938] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.329261] EXT4-fs (loop6): get root inode failed [ 2884.329612] EXT4-fs (loop6): mount failed [ 2884.339727] loop6: detected capacity change from 0 to 16383 [ 2884.343640] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.345429] EXT4-fs (loop6): get root inode failed [ 2884.345986] EXT4-fs (loop6): mount failed 06:53:54 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x101042, 0x24) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) mknodat$loop(r2, &(0x7f0000000240)='./file2\x00', 0x8000, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c144999620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612a2988b0c610de470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a000000000000"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc3, 0x0, 0x0, 0x0, 0x0, 0x40, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x2}, 0x2820, 0x7, 0x60, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd) [ 2884.372617] syz-executor.2: attempt to access beyond end of device [ 2884.372617] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.374278] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:53:54 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x74, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2884.391251] syz-executor.5: attempt to access beyond end of device [ 2884.391251] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.393011] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:53:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 74) [ 2884.495366] loop6: detected capacity change from 0 to 16383 06:53:54 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd3, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:53:54 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r1, 0x40047211, &(0x7f00000001c0)) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2884.529293] loop5: detected capacity change from 0 to 40 [ 2884.531246] syz-executor.0: attempt to access beyond end of device [ 2884.531246] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.533065] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2884.536696] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.544497] loop7: detected capacity change from 0 to 16383 [ 2884.547199] EXT4-fs (loop6): get root inode failed [ 2884.548031] EXT4-fs (loop6): mount failed [ 2884.553346] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.554231] EXT4-fs (loop7): group descriptors corrupted! [ 2884.565071] loop7: detected capacity change from 0 to 16383 [ 2884.573487] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.574238] EXT4-fs (loop7): group descriptors corrupted! [ 2884.577666] loop4: detected capacity change from 0 to 40 06:53:54 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59) [ 2884.598601] loop6: detected capacity change from 0 to 16383 06:53:54 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd5, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2884.646371] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2884.652699] loop2: detected capacity change from 0 to 40 [ 2884.655579] EXT4-fs (loop6): get root inode failed [ 2884.656353] EXT4-fs (loop6): mount failed [ 2884.661451] loop7: detected capacity change from 0 to 16383 [ 2884.678564] syz-executor.4: attempt to access beyond end of device [ 2884.678564] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.679536] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2884.680996] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.682572] EXT4-fs (loop7): group descriptors corrupted! [ 2884.706079] syz-executor.5: attempt to access beyond end of device [ 2884.706079] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.707083] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2884.719248] loop7: detected capacity change from 0 to 16383 [ 2884.751385] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2884.752148] EXT4-fs (loop7): group descriptors corrupted! [ 2884.837546] syz-executor.2: attempt to access beyond end of device [ 2884.837546] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2884.839332] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:54:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffff7fff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) r2 = openat(r0, &(0x7f00000001c0)='./file2\x00', 0x440000, 0x2c) r3 = creat(&(0x7f0000000340)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000240)='/\x9e!/:%//{\x00', &(0x7f0000000300)='./file2\x00', r3) 06:54:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x2}, 0x6) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:10 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b982727c1c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:10 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60) 06:54:10 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:10 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7a, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:10 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240)={0x1f, 0x4}, 0x6) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) open_tree(r0, &(0x7f00000001c0)='./file0\x00', 0x8000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0xf4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x8004, 0x401, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 75) [ 2900.991142] loop5: detected capacity change from 0 to 40 [ 2901.010652] loop2: detected capacity change from 0 to 40 [ 2901.016396] loop7: detected capacity change from 0 to 16383 [ 2901.028462] loop4: detected capacity change from 0 to 40 [ 2901.030689] loop0: detected capacity change from 0 to 40 [ 2901.033015] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.033675] EXT4-fs (loop7): group descriptors corrupted! [ 2901.045054] loop7: detected capacity change from 0 to 16383 [ 2901.060206] loop6: detected capacity change from 0 to 16383 [ 2901.064460] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.065200] EXT4-fs (loop7): group descriptors corrupted! [ 2901.096046] syz-executor.4: attempt to access beyond end of device [ 2901.096046] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.097286] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2901.112088] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.113506] EXT4-fs (loop6): get root inode failed [ 2901.114028] EXT4-fs (loop6): mount failed [ 2901.143043] loop6: detected capacity change from 0 to 16383 [ 2901.161689] syz-executor.5: attempt to access beyond end of device [ 2901.161689] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.162958] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2901.172976] syz-executor.0: attempt to access beyond end of device [ 2901.172976] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.174230] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2901.177611] syz-executor.2: attempt to access beyond end of device [ 2901.177611] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.178566] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2901.180085] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.184982] EXT4-fs (loop6): get root inode failed [ 2901.185663] EXT4-fs (loop6): mount failed 06:54:10 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfe, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 76) 06:54:11 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) openat(r0, &(0x7f00000001c0)='./file1\x00', 0x1080, 0x30) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:11 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mknodat(r0, &(0x7f0000000000)='./file2\x00', 0x4, 0x5) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:11 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 61) [ 2901.349052] loop7: detected capacity change from 0 to 16383 [ 2901.360451] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.362400] EXT4-fs (loop7): group descriptors corrupted! [ 2901.365418] loop4: detected capacity change from 0 to 40 [ 2901.376120] loop7: detected capacity change from 0 to 16383 [ 2901.385559] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.386245] EXT4-fs (loop7): group descriptors corrupted! [ 2901.406667] loop6: detected capacity change from 0 to 16383 [ 2901.406804] loop5: detected capacity change from 0 to 40 [ 2901.417311] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.420619] loop0: detected capacity change from 0 to 40 [ 2901.421951] EXT4-fs (loop6): get root inode failed [ 2901.422336] EXT4-fs (loop6): mount failed [ 2901.448641] loop6: detected capacity change from 0 to 16383 [ 2901.456474] loop2: detected capacity change from 0 to 40 06:54:11 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x115, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2901.476698] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.491978] EXT4-fs (loop6): get root inode failed [ 2901.492638] EXT4-fs (loop6): mount failed [ 2901.539526] syz-executor.4: attempt to access beyond end of device [ 2901.539526] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.541289] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2901.564530] loop7: detected capacity change from 0 to 16383 [ 2901.590424] syz-executor.5: attempt to access beyond end of device [ 2901.590424] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.592237] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:54:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xda, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2901.604388] syz-executor.0: attempt to access beyond end of device [ 2901.604388] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.606022] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2901.608468] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.609225] EXT4-fs (loop7): group descriptors corrupted! [ 2901.619241] syz-executor.2: attempt to access beyond end of device [ 2901.619241] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.620944] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2901.647652] loop7: detected capacity change from 0 to 16383 [ 2901.652433] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2901.653355] EXT4-fs (loop7): group descriptors corrupted! [ 2901.683601] syz-executor.0: attempt to access beyond end of device [ 2901.683601] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 06:54:11 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 62) [ 2901.685165] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2901.784978] loop2: detected capacity change from 0 to 40 [ 2901.796652] loop6: detected capacity change from 0 to 16383 [ 2901.819432] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.821698] EXT4-fs (loop6): get root inode failed [ 2901.822801] EXT4-fs (loop6): mount failed [ 2901.862545] loop6: detected capacity change from 0 to 16383 [ 2901.881554] syz-executor.2: attempt to access beyond end of device [ 2901.881554] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2901.882570] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2901.894436] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2901.898504] EXT4-fs (loop6): get root inode failed [ 2901.899457] EXT4-fs (loop6): mount failed 06:54:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 77) 06:54:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) r2 = socket$inet(0x2, 0x5, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x1d, &(0x7f0000000240)=0x1000, 0x4) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:26 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000180)=ANY=[@ANYBLOB="01bb11a8b625e2691ff20000000100000017f50000", @ANYRES32=r0, @ANYBLOB="00000100000000002e2f66696c653100"]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='./file2\x00', 0x836202827efdbb56, 0x0) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:54:26 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xdc, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:26 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x100) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:26 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 63) 06:54:26 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x116, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2917.061920] loop4: detected capacity change from 0 to 40 [ 2917.068946] loop7: detected capacity change from 0 to 16383 [ 2917.087375] loop5: detected capacity change from 0 to 40 [ 2917.092129] loop6: detected capacity change from 0 to 16383 [ 2917.092981] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2917.093016] EXT4-fs (loop7): group descriptors corrupted! [ 2917.111077] loop2: detected capacity change from 0 to 40 [ 2917.117651] loop7: detected capacity change from 0 to 16383 [ 2917.122011] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2917.122894] FAT-fs (loop0): bogus number of reserved sectors [ 2917.124082] EXT4-fs (loop6): get root inode failed [ 2917.124113] EXT4-fs (loop6): mount failed [ 2917.124649] FAT-fs (loop0): Can't find a valid FAT filesystem [ 2917.140515] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2917.141549] EXT4-fs (loop7): group descriptors corrupted! [ 2917.176568] loop6: detected capacity change from 0 to 16383 [ 2917.220066] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2917.231299] EXT4-fs (loop6): get root inode failed [ 2917.232282] EXT4-fs (loop6): mount failed 06:54:27 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x117, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2917.285924] syz-executor.4: attempt to access beyond end of device [ 2917.285924] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2917.287554] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2917.348017] syz-executor.2: attempt to access beyond end of device [ 2917.348017] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2917.349552] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:54:27 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xdf, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2917.393795] syz-executor.5: attempt to access beyond end of device [ 2917.393795] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2917.395578] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2917.448705] loop7: detected capacity change from 0 to 16383 [ 2917.455013] loop6: detected capacity change from 0 to 16383 [ 2917.465820] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2917.466688] EXT4-fs (loop7): group descriptors corrupted! [ 2917.481986] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2917.487893] EXT4-fs (loop6): get root inode failed [ 2917.488728] EXT4-fs (loop6): mount failed 06:54:27 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 64) [ 2917.500877] loop7: detected capacity change from 0 to 16383 06:54:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 78) [ 2917.516930] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2917.518096] EXT4-fs (loop7): group descriptors corrupted! [ 2917.527407] loop6: detected capacity change from 0 to 16383 [ 2917.554422] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2917.560015] EXT4-fs (loop6): get root inode failed [ 2917.560513] EXT4-fs (loop6): mount failed [ 2917.611454] loop2: detected capacity change from 0 to 40 [ 2917.662052] loop5: detected capacity change from 0 to 40 [ 2917.824354] syz-executor.2: attempt to access beyond end of device [ 2917.824354] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2917.825713] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2917.865399] syz-executor.5: attempt to access beyond end of device [ 2917.865399] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2917.866623] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2917.969537] FAT-fs (loop0): Unrecognized mount option "./file0" or missing value 06:54:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) getpeername(r0, &(0x7f0000000300)=@in={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x80) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000001380)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) getsockopt(0xffffffffffffffff, 0x500000, 0x2, &(0x7f0000000380)=""/4096, &(0x7f0000000240)=0x1000) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:42 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x153, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x27fe}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27af9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b8352a229c9141955adc3e0b71102a30009bb7b98c644cd694939612ade470b50333f3a52b14ac26c08819cd7806e26eeec6ddb53578508d04cfe1032abac2aa1f70113a09d7801b100"/156], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:42 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998220000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a31babb40009bb7b88c644cd694939612ade470b50333f0600b1d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x200801, 0x10) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x440482, 0x20) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020001fdffff0000c2b4fc28c94cc58c2705000000f3e3a0cfda8c7735836105f921e7451d80c7d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a13a0074683ec14dbfb95f9ab29495edb3a190ddbaa96c077ec487870b834aa2f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d001d7904b1a1730ee2117fc82ac09febc64aa74af78bc6a4010d5e2c051752ac9eb8ac024602fbce344b9cc108a016b4a8a3eb14fd56df8be5883c716643f78605788c04c6e5ed7f97f98dd34bbf5223798ca078b00c809ac3b141fcb14b301bfae65f868a4a8455fde34668bfa584f049971e2fa4807fb0345e8ea60ccdb027c6c00"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x8, 0xb2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r2, r1, 0x0, 0xfffffdef) fallocate(r0, 0x61, 0x4d, 0xfff) 06:54:42 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 65) 06:54:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 79) 06:54:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:42 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xe9, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2933.132134] loop7: detected capacity change from 0 to 16383 [ 2933.147179] loop6: detected capacity change from 0 to 16383 [ 2933.151541] loop2: detected capacity change from 0 to 40 [ 2933.169109] loop5: detected capacity change from 0 to 40 [ 2933.170319] loop0: detected capacity change from 0 to 39 [ 2933.172484] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.173689] EXT4-fs (loop6): get root inode failed [ 2933.174100] EXT4-fs (loop6): mount failed [ 2933.176318] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.177433] EXT4-fs (loop7): group descriptors corrupted! [ 2933.198102] loop6: detected capacity change from 0 to 16383 [ 2933.209929] loop4: detected capacity change from 0 to 40 [ 2933.216298] loop7: detected capacity change from 0 to 16383 [ 2933.218130] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.218783] EXT4-fs (loop7): group descriptors corrupted! [ 2933.225863] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.233061] EXT4-fs (loop6): get root inode failed [ 2933.233446] EXT4-fs (loop6): mount failed [ 2933.284445] syz-executor.2: attempt to access beyond end of device [ 2933.284445] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.285429] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:54:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf9, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2933.316595] syz-executor.5: attempt to access beyond end of device [ 2933.316595] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.317573] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2933.347119] syz-executor.0: attempt to access beyond end of device [ 2933.347119] loop0: rw=2049, sector=40, nr_sectors = 4 limit=39 [ 2933.349139] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:54:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 66) 06:54:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2933.377272] syz-executor.4: attempt to access beyond end of device [ 2933.377272] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.378576] loop6: detected capacity change from 0 to 16383 [ 2933.379082] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2933.389949] syz-executor.0: attempt to access beyond end of device [ 2933.389949] loop0: rw=2049, sector=40, nr_sectors = 4 limit=39 [ 2933.391052] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:54:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 80) [ 2933.411476] loop2: detected capacity change from 0 to 40 [ 2933.421440] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.422561] EXT4-fs (loop6): get root inode failed [ 2933.422954] EXT4-fs (loop6): mount failed [ 2933.434627] loop6: detected capacity change from 0 to 16383 [ 2933.452880] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.455523] EXT4-fs (loop6): get root inode failed [ 2933.455975] EXT4-fs (loop6): mount failed [ 2933.491357] syz-executor.2: attempt to access beyond end of device [ 2933.491357] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.492326] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2933.523311] loop5: detected capacity change from 0 to 40 [ 2933.525874] loop7: detected capacity change from 0 to 16383 [ 2933.528780] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.529390] EXT4-fs (loop7): group descriptors corrupted! [ 2933.568484] loop7: detected capacity change from 0 to 16383 [ 2933.570738] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.571397] EXT4-fs (loop7): group descriptors corrupted! 06:54:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfe, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669ef7b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7, 0x0, 0x6, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) fstat(r2, &(0x7f0000000300)) ioctl$BTRFS_IOC_SCRUB_CANCEL(r2, 0x941c, 0x0) [ 2933.647451] loop6: detected capacity change from 0 to 16383 [ 2933.682787] loop7: detected capacity change from 0 to 16383 [ 2933.686671] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.687407] EXT4-fs (loop7): group descriptors corrupted! 06:54:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file1\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) openat(r2, &(0x7f00000001c0)='./file2\x00', 0x0, 0x2) perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x1f, 0x1, 0x1, 0x0, 0x0, 0x48000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x6fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 81) 06:54:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x410, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 67) [ 2933.715129] loop7: detected capacity change from 0 to 16383 [ 2933.718314] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2933.719140] EXT4-fs (loop7): group descriptors corrupted! [ 2933.723283] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.725463] EXT4-fs (loop6): get root inode failed [ 2933.725868] EXT4-fs (loop6): mount failed [ 2933.726909] loop5: detected capacity change from 0 to 40 [ 2933.742752] loop6: detected capacity change from 0 to 16383 [ 2933.756480] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2933.757895] EXT4-fs (loop6): get root inode failed [ 2933.758237] EXT4-fs (loop6): mount failed [ 2933.778518] loop2: detected capacity change from 0 to 40 [ 2933.779308] loop4: detected capacity change from 0 to 40 [ 2933.798893] loop0: detected capacity change from 0 to 40 [ 2933.861269] syz-executor.5: attempt to access beyond end of device [ 2933.861269] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.863024] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2933.965405] syz-executor.0: attempt to access beyond end of device [ 2933.965405] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.966419] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2933.985128] syz-executor.2: attempt to access beyond end of device [ 2933.985128] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2933.987175] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2946.501421] loop6: detected capacity change from 0 to 16383 06:54:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 82) 06:54:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:56 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x82307201, &(0x7f0000000580)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) openat(0xffffffffffffffff, &(0x7f0000000000)='./file2\x00', 0x80000, 0x156) perf_event_open(&(0x7f0000000080)={0x4, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) ioctl$BTRFS_IOC_QGROUP_LIMIT(r1, 0x8030942b, &(0x7f00000001c0)={0xf8, {0x1, 0x45, 0x9, 0x2, 0x7f}}) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r2, 0x40047211, &(0x7f0000000240)=0x20) [ 2946.510956] loop4: detected capacity change from 0 to 40 [ 2946.530586] loop7: detected capacity change from 0 to 16383 [ 2946.530843] loop0: detected capacity change from 0 to 40 06:54:56 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) pwrite64(r0, &(0x7f0000000300)="db0ec89fdceb27d7d9c37785edd4f9eb7b73a1e41a5ff9dc680af35d7665651ff21ce4cae1860db3c5ab7c0591213efc3f0a99b6f263dbc9bbf5ac7c1b76040490ab610f25b86b4ed6c69d91f6164334d9b3ea306eeff77916e017986e59", 0x5e, 0x401) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:56 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 68) 06:54:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000300)={0x5, 0x80, 0x0, 0x71, 0x2, 0x40, 0x0, 0xfffffffffffeffff, 0x18040, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x18d, 0x1, @perf_bp={&(0x7f00000001c0), 0xf}, 0x200, 0x401, 0x6, 0x4, 0x4, 0x2, 0x100, 0x0, 0x9}, 0x0, 0xf, 0xffffffffffffffff, 0x9) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2, {0x7}}, './file2\x00'}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:54:56 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x500, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2946.540323] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2946.544056] loop2: detected capacity change from 0 to 40 [ 2946.550084] EXT4-fs (loop6): get root inode failed [ 2946.550511] EXT4-fs (loop6): mount failed [ 2946.559321] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2946.560966] EXT4-fs (loop7): group descriptors corrupted! [ 2946.567863] loop6: detected capacity change from 0 to 16383 [ 2946.597148] loop7: detected capacity change from 0 to 16383 [ 2946.602073] loop5: detected capacity change from 0 to 40 [ 2946.603932] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2946.607999] EXT4-fs (loop6): get root inode failed [ 2946.608346] EXT4-fs (loop6): mount failed [ 2946.611400] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2946.612090] EXT4-fs (loop7): group descriptors corrupted! [ 2946.670375] syz-executor.4: attempt to access beyond end of device [ 2946.670375] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2946.671506] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2946.719564] syz-executor.2: attempt to access beyond end of device [ 2946.719564] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2946.720728] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:54:56 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x600, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2946.734166] syz-executor.0: attempt to access beyond end of device [ 2946.734166] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2946.736127] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:54:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11d, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2946.760592] syz-executor.5: attempt to access beyond end of device [ 2946.760592] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2946.762598] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:54:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000a00), 0x40, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r1, &(0x7f00000001c0)='./file1\x00', 0x301040, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:54:56 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 69) 06:54:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 83) 06:54:56 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000000)='[*[:\x00', &(0x7f0000000040)='./file1\x00', r0) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2946.882589] loop6: detected capacity change from 0 to 16383 [ 2946.885577] loop7: detected capacity change from 0 to 16383 [ 2946.911454] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2946.912242] EXT4-fs (loop7): group descriptors corrupted! [ 2946.924911] loop7: detected capacity change from 0 to 16383 [ 2946.934514] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2946.939003] EXT4-fs (loop6): get root inode failed [ 2946.939826] EXT4-fs (loop6): mount failed [ 2946.942869] loop4: detected capacity change from 0 to 40 [ 2946.944373] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2946.945156] EXT4-fs (loop7): group descriptors corrupted! [ 2946.967564] loop2: detected capacity change from 0 to 40 [ 2946.970261] loop5: detected capacity change from 0 to 40 [ 2946.984848] loop0: detected capacity change from 0 to 40 [ 2946.985983] loop6: detected capacity change from 0 to 16383 [ 2947.010504] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2947.013619] EXT4-fs (loop6): get root inode failed [ 2947.014496] EXT4-fs (loop6): mount failed 06:54:56 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x700, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:54:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11f, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2947.124607] syz-executor.4: attempt to access beyond end of device [ 2947.124607] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2947.126336] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2947.194610] syz-executor.0: attempt to access beyond end of device [ 2947.194610] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2947.195404] syz-executor.5: attempt to access beyond end of device [ 2947.195404] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2947.196333] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2947.197904] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2947.212477] syz-executor.4: attempt to access beyond end of device [ 2947.212477] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2947.214293] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2947.226178] syz-executor.2: attempt to access beyond end of device [ 2947.226178] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2947.228050] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2947.302303] loop7: detected capacity change from 0 to 16383 [ 2947.330574] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2947.332118] EXT4-fs (loop7): group descriptors corrupted! [ 2947.364676] loop7: detected capacity change from 0 to 16383 [ 2947.399946] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2947.401337] EXT4-fs (loop7): group descriptors corrupted! 06:55:10 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:10 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$binfmt_script(r0, &(0x7f0000000400)={'#! ', './file2', [{0x20, 'vfat\x00'}, {0x20, '-'}, {0x20, ','}, {}, {}, {0x20, 'vfat\x00'}], 0xa, "0c4230a517f37717c1b18afc3cc13245ed66716ad745b3d9adfe169d97916e4ecaf9446b5e175caecdef65ee1043807a695ecb3a746bee1fd63513ca21045dbea6e4a2bc8274285b41f622d00f34102e0e44dd0664c8d02b5541961899abc5e825eb8fa045f556d16f2b9d01ac0cfc2b4418a5d357237b58d45673"}, 0x98) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_bt_hci(r1, 0x800448d2, &(0x7f0000000300)="3c0efb76e2e413b2de0277f11628c9bc495dde811e6a2853a34d804c4d3d8909c0da730521f80b4873f344168d2c42036ab08d6b362454fe6883fb1b3cffc2b85906a958b78fd3c613cfb52bbdae8a46f30acf4d831b2f836def9ed5d018475e7aa92efe7538f0bd92c0d9121f631f1fa32022201eb50c") chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) open(&(0x7f00000000c0)='./file2\x00', 0x103400, 0x20) write$bt_hci(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a13448dc706c077ec487870b834aa229c9141955adc3e0b7f001a3007d59e15cc644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a8f0326478e5792f7a4c4a193b65798b3b90cc1a1a6742feba180d305fa74abc050977a3be7a2bf5bbf2dab6e904adfb33ae67f677d55901be3e7619514b6d553d1c2902e6ed769408bc3d43029e59cd12ec5659e47ddcca892e8830507c21ebe44be6db4aaa79780deccdbaf8ac0e3393a64603e635b3b776895a87e41b6a9da38f7b08ee7e161a8fa70c69eb4caf36faa29c537dd4c749aa0e08e2e4d30fb56597718e5b6dbb7767dd9d2e55e37d4979494e8983655fea26a6e0e74707f34198f686afc102f23c7e8f696ccb1cecfeeb5"], 0x13) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0xbe, 0x0, 0x0, 0x0, 0x0, 0x5, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7, 0x0, 0x0, 0x0, 0x50}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:55:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:10 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x900, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 84) 06:55:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, r0, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:10 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r0, &(0x7f0000000000)='\x00', 0x40, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:55:10 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 70) [ 2960.922046] loop4: detected capacity change from 0 to 40 [ 2960.986081] loop0: detected capacity change from 0 to 40 [ 2960.989041] loop5: detected capacity change from 0 to 40 [ 2960.999023] loop2: detected capacity change from 0 to 40 [ 2961.009415] loop6: detected capacity change from 0 to 16383 [ 2961.013331] loop7: detected capacity change from 0 to 16383 [ 2961.017387] syz-executor.4: attempt to access beyond end of device [ 2961.017387] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.019127] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2961.031333] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2961.032652] EXT4-fs (loop7): group descriptors corrupted! [ 2961.059303] loop7: detected capacity change from 0 to 16383 [ 2961.067119] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2961.070456] EXT4-fs (loop6): get root inode failed [ 2961.071253] EXT4-fs (loop6): mount failed [ 2961.089025] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2961.090873] EXT4-fs (loop7): group descriptors corrupted! [ 2961.116917] loop6: detected capacity change from 0 to 16383 [ 2961.131148] syz-executor.4: attempt to access beyond end of device [ 2961.131148] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.132791] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2961.134277] syz-executor.0: attempt to access beyond end of device [ 2961.134277] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.136035] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2961.137363] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2961.144731] EXT4-fs (loop6): get root inode failed [ 2961.145757] EXT4-fs (loop6): mount failed [ 2961.200080] syz-executor.2: attempt to access beyond end of device [ 2961.200080] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.202051] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2961.232275] syz-executor.0: attempt to access beyond end of device [ 2961.232275] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.233874] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2961.244102] syz-executor.5: attempt to access beyond end of device [ 2961.244102] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.246076] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:55:11 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x410, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20018, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./file3\x00', &(0x7f0000000240)={0x4000, 0x82, 0x18}, 0x18) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63cf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x4) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 85) 06:55:11 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 71) 06:55:11 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="040000000000000000fdffff0000c2b43d24c94cc58361059faf9ca735702669d86c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b40333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe5b0e057801b1ee46c9f107e007f37a9a56c5ef9d356e4630f68ea35ac33050008ec54b91d09cc9a5b7965180280bf0be027b979d60131b3af367126815b6d2d7d135c111607f2786768ac99ff34fe11ab0576d724af377cd7ed14b4ee2f52e31152e5d2f41422c5b0577714925060000000000000034490f347947d72532b714c200574ab1bf35917cd217bce5ba5bf0039f4f7d03a4fe616c939e97b1080000000000000012089598fe9751a9ab570985852795521e939d3fcf57693783ecd94f99ba2e9c2d42fe4a03363d3d85ac362ebcce3d371ddb339aefc8e7282a7bd4a77e"], 0x13) perf_event_open(&(0x7f0000000080)={0x5, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2961.555059] loop7: detected capacity change from 0 to 16383 [ 2961.570270] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2961.571510] EXT4-fs (loop7): group descriptors corrupted! [ 2961.611259] loop7: detected capacity change from 0 to 16383 [ 2961.624987] loop4: detected capacity change from 0 to 40 [ 2961.650060] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2961.651528] EXT4-fs (loop7): group descriptors corrupted! [ 2961.671665] loop6: detected capacity change from 0 to 16383 [ 2961.712518] loop5: detected capacity change from 0 to 40 [ 2961.738658] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2961.745941] EXT4-fs (loop6): get root inode failed [ 2961.746648] EXT4-fs (loop6): mount failed [ 2961.752286] loop2: detected capacity change from 0 to 40 [ 2961.758463] syz-executor.4: attempt to access beyond end of device [ 2961.758463] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.760087] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2961.770183] loop0: detected capacity change from 0 to 40 [ 2961.843892] loop6: detected capacity change from 0 to 16383 [ 2961.889970] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2961.898277] EXT4-fs (loop6): get root inode failed [ 2961.899045] EXT4-fs (loop6): mount failed 06:55:11 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2961.922651] syz-executor.5: attempt to access beyond end of device [ 2961.922651] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2961.924415] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2962.019150] syz-executor.0: attempt to access beyond end of device [ 2962.019150] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2962.020966] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2962.023155] syz-executor.2: attempt to access beyond end of device [ 2962.023155] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2962.025082] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2962.062033] loop7: detected capacity change from 0 to 16383 [ 2962.073673] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2962.074888] EXT4-fs (loop7): group descriptors corrupted! [ 2962.097117] loop7: detected capacity change from 0 to 16383 [ 2962.112881] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2962.114186] EXT4-fs (loop7): group descriptors corrupted! 06:55:27 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2977.441901] loop4: detected capacity change from 0 to 40 06:55:27 executing program 3: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') renameat(r1, &(0x7f00000001c0)='./file2\x00', r0, &(0x7f0000000240)='./file2\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:55:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = pidfd_getfd(r0, r0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3}, './file1\x00'}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:27 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x500, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:27 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, 0x0, 0x7, r0, &(0x7f00000001c0)={0xffffffffffffffff, r0, 0xffff4913}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:55:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 86) 06:55:27 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 72) 06:55:27 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'ipvlan0\x00', @ifru_hwaddr=@remote}}) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x4, 0x7, 0x0, 0x0, 0x0, 0x2, 0x8960, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffe, 0x0, 0x1f, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x20002}, 0x0, 0xe, 0xffffffffffffffff, 0x2) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2977.472251] loop7: detected capacity change from 0 to 16383 [ 2977.479836] loop5: detected capacity change from 0 to 40 [ 2977.483168] loop6: detected capacity change from 0 to 16383 [ 2977.490395] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2977.491663] EXT4-fs (loop7): group descriptors corrupted! [ 2977.504384] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2977.506547] EXT4-fs (loop6): get root inode failed [ 2977.507003] EXT4-fs (loop6): mount failed [ 2977.507857] loop0: detected capacity change from 0 to 40 [ 2977.508158] loop2: detected capacity change from 0 to 40 [ 2977.526705] loop6: detected capacity change from 0 to 16383 [ 2977.529598] loop7: detected capacity change from 0 to 16383 [ 2977.553536] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2977.554364] EXT4-fs (loop7): group descriptors corrupted! [ 2977.558912] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2977.567220] bio_check_eod: 1 callbacks suppressed [ 2977.567231] syz-executor.4: attempt to access beyond end of device [ 2977.567231] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.568906] buffer_io_error: 1 callbacks suppressed [ 2977.568915] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2977.571563] EXT4-fs (loop6): get root inode failed [ 2977.571937] EXT4-fs (loop6): mount failed [ 2977.638583] syz-executor.5: attempt to access beyond end of device [ 2977.638583] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.639684] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:55:27 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:27 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x600, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 2977.689601] syz-executor.2: attempt to access beyond end of device [ 2977.689601] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.690751] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:55:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 87) [ 2977.775579] syz-executor.0: attempt to access beyond end of device [ 2977.775579] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.776539] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2977.793242] loop6: detected capacity change from 0 to 16383 [ 2977.810099] loop7: detected capacity change from 0 to 16383 [ 2977.812242] loop4: detected capacity change from 0 to 40 [ 2977.818975] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated 06:55:27 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 73) [ 2977.823060] EXT4-fs (loop6): get root inode failed [ 2977.823562] EXT4-fs (loop6): mount failed [ 2977.839396] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2977.840089] EXT4-fs (loop7): group descriptors corrupted! [ 2977.841086] loop5: detected capacity change from 0 to 40 [ 2977.873244] loop7: detected capacity change from 0 to 16383 [ 2977.880596] loop6: detected capacity change from 0 to 16383 [ 2977.885938] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2977.886706] EXT4-fs (loop7): group descriptors corrupted! [ 2977.925893] loop2: detected capacity change from 0 to 40 [ 2977.927566] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2977.938819] EXT4-fs (loop6): get root inode failed [ 2977.939225] EXT4-fs (loop6): mount failed [ 2977.944183] syz-executor.5: attempt to access beyond end of device [ 2977.944183] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.945320] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2977.959867] syz-executor.4: attempt to access beyond end of device [ 2977.959867] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2977.960677] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:55:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000280)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="6001a59ae5f478859a7200"/23, 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f00000002c0)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c7794358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed06001bf1a2dd6998a1a190ddbaa96c077ec487c90b834aa229c9141955adc3e0b7f001a34009bb7b98c644cd694939612ade470b50333f3a52b14bc27508d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000240), 0x10) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x105000, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x4, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x800}, 0x0, 0xc, r3, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 2978.001405] syz-executor.4: attempt to access beyond end of device [ 2978.001405] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2978.002368] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:55:27 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2978.044213] syz-executor.2: attempt to access beyond end of device [ 2978.044213] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2978.045156] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2978.076478] loop0: detected capacity change from 0 to 40 [ 2978.096621] FAT-fs (loop0): bogus number of reserved sectors [ 2978.097505] FAT-fs (loop0): Can't find a valid FAT filesystem [ 2978.136402] loop7: detected capacity change from 0 to 16383 [ 2978.155267] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2978.156503] EXT4-fs (loop7): group descriptors corrupted! [ 2978.181330] loop7: detected capacity change from 0 to 16383 [ 2978.192236] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2978.193512] EXT4-fs (loop7): group descriptors corrupted! [ 2978.916572] loop0: detected capacity change from 0 to 40 [ 2978.919493] FAT-fs (loop0): Unrecognized mount option "!" or missing value 06:55:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 88) 06:55:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 74) 06:55:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x700, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1004, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:43 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="0008fc7b5a000000000007b52d6416040014387e422fff696c653000"]) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000300)={0x1f, 0x3, 0x4}, 0x6) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x20400, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='net/sco\x00') mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000a, 0x4000010, r3, 0x33f01000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xbe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000240), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x5, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r2, 0x0, 0xfffffdef) 06:55:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r3 = getpgrp(0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0xfc, 0x0, 0x4, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x1000, 0x0, 0x1}, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:55:43 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) signalfd(r2, &(0x7f0000000000)={[0x5]}, 0x8) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000300)={{{@in=@local, @in=@broadcast, 0x4e20, 0x546, 0x4e23, 0x9, 0x0, 0xa0, 0x20, 0x32, r2, 0xee01}, {0x1, 0x9, 0x6000, 0x0, 0x76, 0x100000001, 0xffffffffffffffff, 0x9}, {0x1ff, 0x409fe250, 0x4, 0x60}, 0x72d, 0x6e6bbd, 0x2, 0x0, 0x2, 0x2}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x13}, 0x4d6, 0x33}, 0xa, @in=@multicast1, 0x0, 0x2, 0x3, 0x8, 0x7ff, 0x2, 0x924}}, 0xe8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0xffffffffffffff05, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xc0000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xd, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) [ 2993.432270] loop5: detected capacity change from 0 to 40 [ 2993.466260] loop0: detected capacity change from 0 to 40 [ 2993.474936] loop4: detected capacity change from 0 to 40 [ 2993.506107] loop2: detected capacity change from 0 to 40 [ 2993.508571] loop6: detected capacity change from 0 to 16383 [ 2993.509959] loop7: detected capacity change from 0 to 16383 [ 2993.527221] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2993.528176] EXT4-fs (loop7): group descriptors corrupted! [ 2993.533327] syz-executor.4: attempt to access beyond end of device [ 2993.533327] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2993.534297] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 2993.537121] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2993.539383] EXT4-fs (loop6): get root inode failed [ 2993.539740] EXT4-fs (loop6): mount failed [ 2993.545727] loop7: detected capacity change from 0 to 16383 [ 2993.551677] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2993.552802] EXT4-fs (loop7): group descriptors corrupted! [ 2993.567655] loop6: detected capacity change from 0 to 16383 06:55:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 89) [ 2993.595534] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2993.602528] syz-executor.0: attempt to access beyond end of device [ 2993.602528] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2993.603433] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2993.613481] EXT4-fs (loop6): get root inode failed [ 2993.614014] EXT4-fs (loop6): mount failed 06:55:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1020, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2993.702277] syz-executor.2: attempt to access beyond end of device [ 2993.702277] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2993.703460] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2993.708513] loop5: detected capacity change from 0 to 40 [ 2993.753045] loop7: detected capacity change from 0 to 16383 06:55:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x900, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) accept$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0xa00, 0x10) openat(r1, &(0x7f0000000000)='./file0\x00', 0xc5905eef3ad541da, 0x0) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c278899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec4adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b143cdf9932206c154e436e9b132fd9830ff070d1772418a26182694c3c3e0f7a46c37f68e79ba6e2d1e4c9c0ba3a13b7ec90a550e00edffa959d3177730ade0a610c186ed2cec6ae983434b18fe7eadb4"], 0x13) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) [ 2993.774516] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2993.775179] EXT4-fs (loop7): group descriptors corrupted! 06:55:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000300)={{0x10b, 0x5, 0x6, 0x22b, 0x158, 0x3f, 0xdd}, "31e6c38ad26fa94de4a5acb0e6da00b4d3374523da867e886b0a1c3b24abb59c20a91ba077822ac728fed7ef408b4328a01c51240404c3746b5c6b11c1bad981b41c00511c39cfc839f9c6d649f39063e04047e11c0fb485aea956434a2d591d74ad25858f", ['\x00', '\x00', '\x00', '\x00', '\x00']}, 0x585) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r1, &(0x7f00000001c0)='./file1\x00', 0x82, 0x1) sendfile(r1, r0, 0x0, 0xfffffdef) [ 2993.801748] loop7: detected capacity change from 0 to 16383 [ 2993.816870] loop4: detected capacity change from 0 to 40 [ 2993.823537] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2993.824242] EXT4-fs (loop7): group descriptors corrupted! 06:55:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 75) [ 2993.852651] loop6: detected capacity change from 0 to 16383 [ 2993.855163] syz-executor.5: attempt to access beyond end of device [ 2993.855163] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2993.856322] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 2993.877566] loop0: detected capacity change from 0 to 40 [ 2993.889561] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2993.890844] EXT4-fs (loop6): get root inode failed [ 2993.891203] EXT4-fs (loop6): mount failed [ 2993.907899] loop6: detected capacity change from 0 to 16383 [ 2993.918265] loop2: detected capacity change from 0 to 40 06:55:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1100, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 2993.965103] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 2993.966199] EXT4-fs (loop6): get root inode failed [ 2993.966553] EXT4-fs (loop6): mount failed 06:55:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 90) [ 2994.066008] loop7: detected capacity change from 0 to 16383 [ 2994.070556] syz-executor.0: attempt to access beyond end of device [ 2994.070556] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2994.071591] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 2994.098143] syz-executor.2: attempt to access beyond end of device [ 2994.098143] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2994.099268] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 2994.105129] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2994.105915] EXT4-fs (loop7): group descriptors corrupted! [ 2994.106398] loop5: detected capacity change from 0 to 40 [ 2994.116065] loop7: detected capacity change from 0 to 16383 [ 2994.131592] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 2994.132638] EXT4-fs (loop7): group descriptors corrupted! [ 2994.218144] syz-executor.5: attempt to access beyond end of device [ 2994.218144] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 2994.219521] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:55:56 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) r1 = accept4(r0, &(0x7f0000000340)=@l2tp={0x2, 0x0, @multicast1}, &(0x7f00000003c0)=0x80, 0x800) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000580)={{r1}, 0x0, 0xc, @unused=[0x0, 0x8, 0x9, 0x5], @devid}) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) umount2(&(0x7f00000001c0)='./file0\x00', 0x5) r3 = syz_open_dev$loop(&(0x7f0000000240), 0x5, 0x400400) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000300)) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount_setattr(r2, &(0x7f0000000000)='./file0\x00', 0x9800, &(0x7f0000000040)={0xf0, 0x100001, 0x20000, {r0}}, 0x20) sendfile(r4, r2, 0x0, 0xfffffdef) 06:55:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000240)='./file1\x00', &(0x7f0000000300), &(0x7f0000000340)={'L-', 0x8001}, 0x16, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f00000003c0)='./file2\x00', 0x4c000, 0x84) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe, 0x7}, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000001c0), 0x4402, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./file1\x00', 0x400000, 0x20) sendfile(r0, r1, 0x0, 0x1) 06:55:56 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x117d, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3006.656029] loop6: detected capacity change from 0 to 16383 06:55:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:56 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(r0, &(0x7f0000000240)='./file1\x00', 0x1, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca7354d2669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96a2a7ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000001c0)={'lo\x00', &(0x7f0000000300)=@ethtool_rx_ntuple={0x35, {0x12, @esp_ip4_spec={@empty, @multicast1, 0x100, 0x6}, @usr_ip4_spec={@private=0xa010101, @multicast1, 0xffffffff, 0x2, 0x1, 0x4}, 0x1, 0x7, 0x1, 0x4, 0xffffffffffffffff}}}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3006.665572] loop5: detected capacity change from 0 to 40 06:55:56 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 76) 06:55:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000640)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1e4574b93148ad3ecb8bace0bdc88d71536a000f9258619cc521ae9e6b98541578bd71bd45bbb126b7f91bd5264cce84ad2f162219abfdd71050d89592a81c02316f37986986e9fc303b94ca7013146773cbb3656d40c73ee01cab137f0a0be0001b9362ee4fab659e9db050d7f50eee15e6961ebd5072c39898f7270a882b26803b03e6b33a791cecac36bdc9a6902758fcef6fef83090bcf358f63a1b0ed61ea161e4295135706c5371377086f5a564c7567786b617c58b3629693d915ae961dbc838cac591eaf9"], 0x13) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000000)={0x1000, 0x0, 0x20, 0x10000, 0x9}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0x0, 0x5, 0xc, 0x0, 0x0, 0x1, 0xd1984, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0x7, 0x3ff}, 0x880, 0x100, 0x400, 0x5, 0x83, 0xffffffff, 0x9, 0x0, 0xe51, 0x0, 0x401}, r2, 0x0, r0, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 91) [ 3006.684942] loop4: detected capacity change from 0 to 40 [ 3006.695407] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3006.699409] loop7: detected capacity change from 0 to 16383 [ 3006.706972] loop0: detected capacity change from 0 to 40 [ 3006.709319] loop2: detected capacity change from 0 to 40 [ 3006.712917] EXT4-fs (loop6): get root inode failed [ 3006.713314] EXT4-fs (loop6): mount failed [ 3006.713349] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3006.715197] EXT4-fs (loop7): group descriptors corrupted! [ 3006.739028] loop6: detected capacity change from 0 to 16383 [ 3006.740689] loop7: detected capacity change from 0 to 16383 [ 3006.766099] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3006.767269] EXT4-fs (loop6): get root inode failed [ 3006.767632] EXT4-fs (loop6): mount failed [ 3006.772191] syz-executor.0: attempt to access beyond end of device [ 3006.772191] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3006.773522] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3006.793210] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3006.794019] EXT4-fs (loop7): group descriptors corrupted! [ 3006.802326] syz-executor.5: attempt to access beyond end of device [ 3006.802326] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3006.803576] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:55:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3006.858334] syz-executor.2: attempt to access beyond end of device [ 3006.858334] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3006.859601] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3006.883716] loop6: detected capacity change from 0 to 16383 06:55:56 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11bd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3006.912188] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3006.914216] EXT4-fs (loop6): get root inode failed [ 3006.914942] EXT4-fs (loop6): mount failed 06:55:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff000051b95f8b08000000000000000ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c6441bfe4939612ade470b50333f3a52b14bc26c08d7806efe1032abac2aa1f70113a09d7801b100"/153], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3006.958530] loop0: detected capacity change from 0 to 40 06:55:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 92) [ 3006.971993] loop6: detected capacity change from 0 to 16383 06:55:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') accept$inet6(r1, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f00000001c0)=0xfffffffffffffdea) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:55:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0}, './file1\x00'}) fcntl$setflags(r3, 0x2, 0x1) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3007.006425] loop7: detected capacity change from 0 to 16383 06:55:56 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 77) [ 3007.018163] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3007.018816] EXT4-fs (loop7): group descriptors corrupted! [ 3007.024400] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3007.028025] EXT4-fs (loop6): get root inode failed [ 3007.028719] EXT4-fs (loop6): mount failed [ 3007.029539] loop4: detected capacity change from 0 to 40 [ 3007.049453] syz-executor.0: attempt to access beyond end of device [ 3007.049453] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.050438] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3007.059950] loop5: detected capacity change from 0 to 40 [ 3007.072343] loop7: detected capacity change from 0 to 16383 [ 3007.076830] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3007.077416] EXT4-fs (loop7): group descriptors corrupted! [ 3007.112500] syz-executor.0: attempt to access beyond end of device [ 3007.112500] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.114068] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3007.122018] loop2: detected capacity change from 0 to 40 06:55:56 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3007.147110] syz-executor.4: attempt to access beyond end of device [ 3007.147110] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.148280] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3007.212704] syz-executor.4: attempt to access beyond end of device [ 3007.212704] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.213895] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3007.225099] syz-executor.5: attempt to access beyond end of device [ 3007.225099] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.226044] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3007.236993] loop6: detected capacity change from 0 to 16383 [ 3007.256543] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3007.259575] EXT4-fs (loop6): get root inode failed [ 3007.260258] EXT4-fs (loop6): mount failed [ 3007.279577] loop6: detected capacity change from 0 to 16383 [ 3007.286225] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3007.290403] EXT4-fs (loop6): get root inode failed [ 3007.291300] EXT4-fs (loop6): mount failed [ 3007.320714] syz-executor.2: attempt to access beyond end of device [ 3007.320714] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.323148] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3007.707189] loop5: detected capacity change from 0 to 40 [ 3007.710071] loop7: detected capacity change from 0 to 16383 06:55:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ce6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1db94c403bc0dc4"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141006, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:57 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1200, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1ccb27bff27d6f9f8a695245e898dc16fadc7eca5f5d614fc026a403901fab5b733553cb20429976c6af6373f6b94b5e3af012d64bf2f0d7132"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:55:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 93) 06:55:57 executing program 4: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() pidfd_open(r1, 0x0) syz_open_procfs(r1, &(0x7f00000000c0)='fd/4\x00') r2 = perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r1, 0xd, r0, 0x2) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000380)=ANY=[@ANYRES64, @ANYRESHEX, @ANYRES16=r0, @ANYRES16, @ANYRES64=r2]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file0\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) 06:55:57 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 78) [ 3007.735550] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3007.736865] EXT4-fs (loop7): group descriptors corrupted! [ 3007.743357] loop6: detected capacity change from 0 to 16383 [ 3007.752378] loop2: detected capacity change from 0 to 40 [ 3007.767309] loop0: detected capacity change from 0 to 40 [ 3007.776599] loop4: detected capacity change from 0 to 40 [ 3007.783944] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3007.798111] EXT4-fs (loop6): get root inode failed [ 3007.798884] EXT4-fs (loop6): mount failed [ 3007.800870] FAT-fs (loop4): Unrecognized mount option "ÿÿÿÿÿÿÿÿ0xffffffffffffffff" or missing value [ 3007.806710] loop7: detected capacity change from 0 to 16383 [ 3007.827694] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3007.829083] EXT4-fs (loop7): group descriptors corrupted! [ 3007.831247] loop6: detected capacity change from 0 to 16383 [ 3007.864700] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3007.887655] EXT4-fs (loop6): get root inode failed [ 3007.888464] EXT4-fs (loop6): mount failed [ 3007.895973] loop4: detected capacity change from 0 to 40 [ 3007.912870] FAT-fs (loop4): Unrecognized mount option "ÿÿÿÿÿÿÿÿ0xffffffffffffffff" or missing value [ 3007.937542] syz-executor.2: attempt to access beyond end of device [ 3007.937542] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3007.939306] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:55:57 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1501, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:55:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) sendfile(r0, r1, 0x0, 0xffffffffffffffff) 06:55:57 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3008.111212] loop7: detected capacity change from 0 to 16383 06:55:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 79) 06:55:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 94) [ 3008.145122] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3008.146279] EXT4-fs (loop7): group descriptors corrupted! [ 3008.180204] loop6: detected capacity change from 0 to 16383 [ 3008.184463] loop7: detected capacity change from 0 to 16383 [ 3008.198862] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3008.200010] EXT4-fs (loop7): group descriptors corrupted! [ 3008.210499] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3008.213226] EXT4-fs (loop6): get root inode failed [ 3008.213976] EXT4-fs (loop6): mount failed [ 3008.234595] loop6: detected capacity change from 0 to 16383 [ 3008.264319] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3008.273201] EXT4-fs (loop6): get root inode failed [ 3008.274011] EXT4-fs (loop6): mount failed [ 3008.295953] loop5: detected capacity change from 0 to 40 [ 3008.304380] loop2: detected capacity change from 0 to 40 06:56:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 95) 06:56:10 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 80) 06:56:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) write$binfmt_aout(r2, &(0x7f0000000580)={{0x107, 0x8, 0x5, 0x2a5, 0x4a, 0x38, 0x357, 0x2}, "a3b909acc534902b3eacdde173c838b0728d8bf2c2bf999a93d0b081f54fcbc54d9f4ead25b1774cec1849c0584b664827d97783fa83ab1f4e8bd072a5a409c5df599fc2e134fdd494454ef9ccf23318a5677bf1f5e9e30702ad0d6c1c2ac70e4a2d14d14dd39fe0ebcaaef05e1671fbe76a76bd3d62083931e318f4361e27b670a7e608dd8f7815504e054438009ae97538949bc59f809b3afbf4f7accc5997ed8fadc8a36a17e424f7db74220c8afafefc", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0xad2) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f00000001c0)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x3d}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='net/packet\x00') r4 = perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) write$binfmt_aout(r1, &(0x7f00000004c0)=ANY=[@ANYRES32=r3, @ANYRES32, @ANYRES64, @ANYRESOCT, @ANYRES32, @ANYRES32, @ANYRES16, @ANYBLOB="e3664b1d3366fbb3bcb5e36b198262705fa3144f3a35b0dd4ee6dd50b2139974cf83258732281d9acd8e1c125248346c793f898c3b55e9dbf78d0eeb37389cf248eb87c954d98ed88298050f794265d9c2a8a7596589d3ff4da8ee719930455671c8e6dba505e51af2439b99c467476f25d405b323a1879495cc78e15e6b922ff9ce066d6447d236d983ab7888a34b483a7b62972a4f14425063759faf9b2264affd1ecccc8428f55234b3f0969709ae732e48ab48d45c451bd934c2fb6948aaf2e9f5d55e", @ANYRES16, @ANYRES16=r4], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:10 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1004, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:10 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1601, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:10 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000580)={{0x10b, 0x8, 0x14, 0x3a5, 0x2f2, 0x349, 0x12, 0x1}, "c4499ebc10e92e393d2bee2754c1ebf87df456379365943d5ee58cdcf7bc6acfdb591b7af963f5736aeb42a54047593885fff9327a654d699812f52125c4a61f532890843282aee83be0ed46274cc936100b3a8aaac3cf1e7342b526c615e0216703087a4186ba8648d25f963b56b47074221a70d84d972aa5884e1ad863460f4d4e572f1c64ed9b068043ceaca3b5d4900b5cb74d6b07fe5c0a54f0ae53379d4d93d9b54cbc6e365a8f94a6a00d0c9f4eea6eca0cef1b436c1063f6963dbb0fe3fda290211914e136503817d13f60f4666a123150233d6dec641891403a1b4a3636fe1c9ffa2ad5a9b07136f40a56750f776f99fea69857439bbdf8473392c9977690caf4e7d8c549a9e5a2a741f8eef9974699b1cab04be6f825b56871000616f783a67bfaadf0e368bf1c35e90d1dabe66eccc8a8fbf350d9b4ee76a4198c01e8cd3dc5feae3de777a9a2eaa30c7c87b4412e762127f12ac6e33187e5b465fe9eac0527e833b1bd35914273c9a12c21f24be4c1fb45a99672c0042cfdb8697664250abb415899ac9f187efb528f9cd6cf732f746624b47589405caaf6036bfebc7c827191640bf1c5545d3b8e15a477ee93c32e55e3f7a4ecf66669a00b3bc8255c9ac950996678d59aaa8342399dcbb0ee00506c8f5150a8384fb8cb4d75ce162032e2f6f6e6c2cae68ce4063aae571ace5c19f819e47c52171641946f656f0430ca24b1916552cb3c9fa7102f3d1009717b80e53aef618b27e7fdfcd317ef6403e97b61f015df1868c03bbd3bdf4c8c197e48d795340e761ba62ff7d0f235761102c8f74495b0b2f5795628f7515034ba307a7eba394f98a64e04c767d0c626705218a45a641c18ee37f273de325954d6406bbb259297491189ffdd987c863d6d4548b66eb095d917004b85353e687097a06f09aaf0aba1c13d42a271e3c56654a5b2234f5f9462cf68a8732d13763846274641b0d74ea6eb1a731caf7ca77f68d449e8dc2cc9038331bd1d10805ee39534e7617b3eefc7f0720eca5186eb22df0b643e0796d29376e4f26ea0dd802bce6d9de9f552f016bb95e01ca4884131d01b19882e737410f9b8234e33be4fdecf3dba40f4fe75b6c1d2dd6320123ab399939595c6713f9aa2f9275df139820295540cb8cfdd7af8a9a9fa570872164aa9b87872ad3ee480ac10b0856ce069a41010a8614e87306daa3cace8f18fc8e1ffae18524404e3343a4e90fcb561670cc0221cc8f0415d42ce56a8f37af529ddfb513a19ab08fa576547730dfa4463f50a35ed43aabf894ac78ea56512372635ae5c9e1e4692685544ace04f1ef9970795cac7da147a257793574d5dd92cb1233e6e0f7af36d0ddfe95fe31448d16ff3632ad08f92739f8a07af2e768787e583ed517540fa27de0746ebc49d6627565f52537288f37d1f12f021dbf6d99e9afdae40ff01f4e7184573f723f5c01b77d5f4ff71fc7fd2606a7763592f89fce4ab78998e53a66dd40f6145141601ebc229b3eaff24e7161977e95bc474d2bf50a234774b029e91a760848daf3405608de5a7c2b091572991fc97eda420eadce59a6e35c23ac6a1536c0d524ddb250298395d80945241a68f0a1c384a6314a5c56bf53b840cdecf59c6020914e4d3c682435c4428d04dba7f16fe953f43ff2fbb75f7d32d31d85a727ec31eb69db7636ce16628db5958962b0ea34873481fe51f0859ad6e213e319214af86ca2b8f32808764a929350c8bb71f69e93c7c91cf0fdc38ace13f40284cb78a533564b4eff77d235d5a2030a6c8a045898d36812c8eaa040577c1e887dfef7a9994090a50d6e124f481afd9438d0360e613d372689ae0aa3ee84d2849d6e39b348169b0e7df7ae060fa09929635c4826f0f669ded0ea234182807bbb9aa905cdcc9645252ea1e10d16040558fa863f665aa53bd47915d00c04bdf05cb3a8bb5ba3bd8df3abbb4d82875b7383c58153febb66dee60b631cdf2155ac48140310344953b9c97a75abf01f353ea58c7026ffc611d57e9102bfcd5b6d50f323b2b26ae1aac2469d3cc86a0347cb909c81dbb6f06a82c7f446b907e7a1f5d3bca665c334529a987f1df2b75765e639b74616b58794420b80f7cd99fc2d53e07e31d66dcf737c0f4c41a1225ef8cffc972144530b8489bdb25a5d9c17ba1b299fc0c4c26d8ac3019332375cbdf8c3c0eff7247c8f66e35bc74154f346f751de622776343fb5ca5e25bfe0a7bce7bc0c8d3dd93caab08f1956acccb55a0f530709e7bb0470d768ef34c61f6a7a01c84dacc9ab138d2a302ec50995e0fd355276dd41b5a1a5a6a6f341c865c72bdcab16536b1ee0eeac5d4c3e6334e667b1c240d4bb95b5401b859b1896a1bcc16fc71def9298cc8b968fbed3adbd20a0492e591b94c901f31677de4ceb7edad660dffa02ed219cacf05880904420148dafb1e0c76d66f094a2cabc4b9a1eb24d1bbc5ec45e79ea79759ce6ef2e61bb082542ebc61766a803c4c0aa2fc6bc0016f1090bd1de1b2a520f7667c69bced4057c8e671483532fccd6fab07bc8ccdb51ad437dda79f55c06ff79150228cd1e3ed1ebecf22aff911f385a0b644d8be78697c01d4058c609fc08c2bb4be93aaecba0ea30d7f5e31c82f5ff8e8128e292675d19bf911e3043d7e8ea21c9e51666d6988a364ca46344642ddf4d9cd748de0bfac98b57134026dedcdd20914c6c544bfe6148748d1e66f789aacb33dc693486f0eb25ad1ce296abb9ea56853be8244d4d1b61c6e5606562c0bbbe60b4aad334b59218df5afb13a73eeae0f42cf78388c6cd9392ce48c55a3ae4044bedc6a77ff13377622b6c12677388d61f68693007e953c061e492b34e334f175c9b2e80f046cacf6bfd173cc9d94361bcdf94077d77e42cbe94390cd5144613a48ef5c22bc10d2af8e04a539a4faeeef734c0a48d5780f024404d39ae9187f82304d02474250b932308e077256143eb0331d78814ea783e4f26c6858d68180f0ced1b99a78b9d81621c48ee911cb3a1d8dec50a5c7286a97055d09ddeaaea8d640131d45f9a597a3d7110f2ab4789968ef1ca9fd55dc92bb2dd478fdca93af2e071f4194bf80aee865dc9c9278692f1780081c343da07e51d6811536e14992f1c94965236059ac82b6208ed9f92ff80b7f6a5a808873c6f6a94fc90ca5e223ca969f4135033ed10feb1af2771a787126770c43e693232083307d0bc3ded0ea17cc1253aafdf0733630ab11e49cde212b519bbdeca1e9fe664250f1a4331b7905d3bba6a784d61f719d020e5fd3da4d657c4a38371ddb1c4886fe0df06650bfa8915e70dc039a6455eae2ac6bf4b78771694bfd859c710d1ba89b0e44bf61b73b1cf31ee792de65a0c5a511884f3dfdeaadbc1110625f2b214c54c15c58bdd2f6a95ba16b79ff0612375a1d78d57cffca6311f70a63b774b952d02303b0552fdd41ae95127957b197478e743889f6486dc2b10bfca3638d2d4696a5cbf1705142a5a92f9105d9998f34dbbf94c5846631422fb6ceac04be76c9eb67d1b6ee09c6800d4a192c2029372bacbdb7d978ec38915be4011c18c619e0d18a6a11c72bafed0b54b3f4467ef25159e8c66284393dd54e57287bb40ce28c36013ef057c52d75fece0845c377f315f48b6493e12bbcd44cf433135d0f4b552a58b10d131e0b42e6c1374a54513eff47248428f4b2b52e245fef7240a1839e16168f9fe52d5123515b01f24967cced1c67acd8f57d85345d6af565d5a94ee3557263cdb07745da09decd20350eb926f18e665647ad4642b4a377e388014a170bf5069154fe2f1865593a5b1de9a4475a427917ee0562fab92fe3bafc3ba303afe64aba0ae6173e7c4c84b67c7aaff2d580b6962b8edf2ff64ef6ba70709eed3eb8aa436d5ba6455f74b07443a89588d8151b4a4f57f8e3290aa0f5bedc560ca4a9874b88a7f357d3f0a482ca002bf67d6402d441deacb8093f9253739754746790c910f57502863b72b7812836c3021b10fb6ee9634497cf7e577c0cba2043df003147b7abc15b1682f871e56dfa6548a173297f39961885cd545b6ad882bc0a0b0355130b7ec881ce5cdfe576d12eb0fab36ec0107eede03dfdebf1afa91cdfc09ac752fa5041db04efcc84464751f1b5453e1a15f3901240fba83d7e94b833e1f5b615ef3ea4b390a71148ddec2dc376e9be19c5687b15ebf6ab6839923f559e02dbcf29215518a1c2c2209d004815383588b7f593d3508dafe3e19dc604b331d8736922373bd061c7f5c082a8f90ab78d264237beb83d6ad867e8fcfb65abdbc570792c98a6793c84f7a65623e580dd337e93f669a563cf93070ff846c29b48557226838455e79b456bec03cb2f33fc554e7626b8323d0a1ebc3f9fffae69ecc6e978afe351e1e8aa77a544e6cc0197d9a933ef3d1d3f179e1038ff4eccf0b3b33a552f26a16c38c19ad95d2adca4d06d888e50e1cd1faa4a10ecc8030730efeb0b33ed867dbbe983c162e5c59da843547bf30ecf9c350f184ddbd09c72aaa3c3585c2658da51498b50fa7c7ddcddb80ae969cb1d6303a202e8b3cb7c02445215cfeb6ae9b9d617dd3f123527aea60277f858545e7ec00e07976b6f8156bb7905e5fffdcf9db11eaee4f29bc4b8921a871f20af65ecdf484450f70b99b3ef1148e124724f241277c6f5518d4455a825f3b476db2752d65cf781324a5ad3cbca973e64aa35e6f1e8860f81bfeb1b4251df810006b27aa4de55b5dc8bf00ae8dd3fc3a91d6b18a7ed7e6264d527d7c48536164071920d5c82de6954fc508a7689e261512746100de399691064f5cb30f287f41801e72fe0ff8c35322ed1916d6ee162fe90d71d40d62b7247b0cb1e172b5ed46e778456fb13658f7c8328a49dd98b0b27b469e51e2d81fdbad635e4141dcc4392f33edda7a6a5f5287d3987e7e00d1df5e7939f316082e85f84f92dfcf7c0d6e06a57caf7d403cfefbc52066f41cac9f3a8953983afdb8bddb3c1720b00b720fbf38de2deadc7eb628753f79a87d09d0e5f53187d86598d2ee3385c2ad9d062a68ced650f09232e2fe3cc9af4aa00c2dd98313ff4981f171e3392700b01524e33f87e8573a1cb67ad48c39f4d1bc548a3384183db6cd415378585fbc1750381fa67d6a8837f55675f603ad2b389f6b043d9180b49e07985c077e1d068aa077657bbcdaadfa1eba961562690148664ad789c57cfcb256b7838fd5e048ec2bd5788b6c314275e936b11475e340bde15d68352c9663fa68b0bd36250293c7782bffb65d1a9fdbd3eb9fc08a32597c7572272b894ab1669407e535259dd5855699b6ed6b5b2497c716eb0628b291ce802f4c466e713b37a9565b4b45afa4ac4bdbdd7c245cb499cfcb75b79256b16ce59144753cede2c69fdc168e06430b0a47139682cc257bb806f0c58abe57caf3fa8bccc9046c47ded4836645692739c6ba359173c16f24efb308b879f8a4de911e7524c039630a32185be03710056b9d53ae6f8092420cb20bccb20d139740d0a5628f44a8ce9204975a6f4a3b5e3f8a63d6c8c6a2cee684161accf1a4aad9bffe86c218ca1bf9265b06d694d7269e2f30765b42a16fbad20db4804290846e2cd866675f4cf6a02a6c1f740381e22ba42f45547165f26e81d10df0824edc6b31fd8d4e74175df8d97264e1df2d3d4181fbb6f2359e875aba29e72ad24e4c74c39b7672c45f3f58975eeb81e7c80a3557abc706c49bde326190a11e9dc58f8d3d5d0e57140a864f9ca9ab78d915e3988e211eb078531", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x1620) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x8000, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/diskstats\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3020.979166] loop4: detected capacity change from 0 to 40 06:56:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) clock_gettime(0x0, &(0x7f00000065c0)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000006400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f0000000300)=""/94, 0x5e}], 0x2, &(0x7f0000000380)=""/97, 0x61}, 0x1}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/36, 0x24}, {&(0x7f0000000440)=""/35, 0x23}], 0x2}, 0x3}, {{&(0x7f0000000580)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000600)=""/195, 0xc3}, {&(0x7f0000000700)=""/41, 0x29}, {&(0x7f0000000740)=""/137, 0x89}], 0x3, &(0x7f0000000840)=""/53, 0x35}, 0x3}, {{&(0x7f0000000880)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000001d40)=[{&(0x7f0000000900)=""/1, 0x1}, {&(0x7f0000000940)=""/9, 0x9}, {&(0x7f0000000980)=""/183, 0xb7}, {&(0x7f0000000a40)=""/218, 0xda}, {&(0x7f0000000b40)=""/214, 0xd6}, {&(0x7f0000000c40)=""/254, 0xfe}, {&(0x7f0000000d40)=""/4096, 0x1000}], 0x7}, 0xffff}, {{&(0x7f0000001dc0)=@in6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000003140)=[{&(0x7f0000001e40)=""/16, 0x10}, {&(0x7f0000001e80)=""/230, 0xe6}, {&(0x7f0000001f80)=""/223, 0xdf}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4, 0x4}, {&(0x7f00000030c0)=""/107, 0x6b}], 0x6}, 0x4}, {{0x0, 0x0, &(0x7f0000004200)=[{&(0x7f00000031c0)=""/4096, 0x1000}, {&(0x7f00000041c0)=""/1, 0x1}], 0x2, &(0x7f0000004240)=""/19, 0x13}, 0x5}, {{0x0, 0x0, &(0x7f00000053c0)=[{&(0x7f0000004280)=""/14, 0xe}, {&(0x7f00000042c0)=""/4096, 0x1000}, {&(0x7f00000052c0)=""/64, 0x40}, {&(0x7f0000005300)=""/160, 0xa0}], 0x4, &(0x7f0000005400)=""/4096, 0x1000}, 0x8}], 0x7, 0x40000000, &(0x7f0000006600)={r2, r3+60000000}) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000006640)={0x52522ba3, {{0xa, 0x4e20, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}, 0x1, 0x5, [{{0xa, 0x4e22, 0xa6, @ipv4={'\x00', '\xff\xff', @local}, 0x1ff}}, {{0xa, 0x4e22, 0x10001, @ipv4={'\x00', '\xff\xff', @remote}, 0x8001}}, {{0xa, 0x4e21, 0x7, @mcast2, 0x7}}, {{0xa, 0x4e23, 0x2, @empty, 0x7fff}}, {{0xa, 0x4e23, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}}]}, 0x310) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50f9faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r5, r1, 0x0, 0xfffffdef) [ 3021.009148] loop2: detected capacity change from 0 to 40 [ 3021.015177] loop7: detected capacity change from 0 to 16383 [ 3021.025914] loop0: detected capacity change from 0 to 40 [ 3021.029046] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3021.030382] EXT4-fs (loop7): group descriptors corrupted! [ 3021.043292] loop6: detected capacity change from 0 to 16383 [ 3021.043711] loop5: detected capacity change from 0 to 40 [ 3021.048434] loop7: detected capacity change from 0 to 16383 [ 3021.057959] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3021.058519] EXT4-fs (loop7): group descriptors corrupted! [ 3021.062717] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3021.078342] EXT4-fs (loop6): get root inode failed [ 3021.078678] EXT4-fs (loop6): mount failed [ 3021.095159] loop6: detected capacity change from 0 to 16383 [ 3021.116353] bio_check_eod: 5 callbacks suppressed [ 3021.116365] syz-executor.4: attempt to access beyond end of device [ 3021.116365] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3021.117808] buffer_io_error: 5 callbacks suppressed [ 3021.117825] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3021.157112] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3021.158169] EXT4-fs (loop6): get root inode failed [ 3021.158494] EXT4-fs (loop6): mount failed [ 3021.182092] syz-executor.5: attempt to access beyond end of device [ 3021.182092] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3021.182979] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:56:11 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 81) [ 3021.225939] syz-executor.0: attempt to access beyond end of device [ 3021.225939] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3021.226899] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:56:11 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x168c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1020, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3021.280035] syz-executor.0: attempt to access beyond end of device [ 3021.280035] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3021.281619] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3021.323720] loop7: detected capacity change from 0 to 16383 [ 3021.345573] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3021.347074] EXT4-fs (loop7): group descriptors corrupted! [ 3021.354003] loop2: detected capacity change from 0 to 40 [ 3021.378204] loop7: detected capacity change from 0 to 16383 [ 3021.380428] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3021.381085] EXT4-fs (loop7): group descriptors corrupted! [ 3021.384893] loop6: detected capacity change from 0 to 16383 [ 3021.423132] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3021.424856] EXT4-fs (loop6): get root inode failed [ 3021.425356] EXT4-fs (loop6): mount failed [ 3021.449149] loop6: detected capacity change from 0 to 16383 [ 3021.480551] syz-executor.2: attempt to access beyond end of device [ 3021.480551] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3021.481906] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3021.486380] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3021.487703] EXT4-fs (loop6): get root inode failed [ 3021.488141] EXT4-fs (loop6): mount failed 06:56:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 96) 06:56:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) stat(&(0x7f0000001280)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=unix,cache=fscache,access=client,access=any,access=', @ANYRESDEC=0xee01, @ANYBLOB=',privport,dfltgi', @ANYRESHEX=r3, @ANYBLOB="2c6673636f6e746578743d73797374656d5f752c6f626a5f757365723d656e7669726f6e6e767b726f6e002c657569643dbda74ccf2e4e9d86d03ea2b9769f82ceb08e843d24c057d6e5cc69ac3ae73d52c02c7200d1ce8035419f7ea25f8cb6afca70c044cb13ffadc7306d94fb8d516487aef045c54db2519a08245e25cd6bbde76411b82f4c8f3b4e4e8d2f0c9224eac418f7547e32b38f94cf14133b6ad3eef81ac4f6a8fd379c2144c48ff98879b382", @ANYRESDEC=0x0, @ANYBLOB=',measure,\x00']) fstat(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000003c0)={{0x2, r4, r3, r2, 0xee00, 0x8e, 0x6}, 0xd590, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffc}) fchownat(r0, &(0x7f00000001c0)='./file2\x00', 0xee00, r3, 0x100) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:28 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0xfff}}, './file1\x00'}) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r3, 0x40189429, &(0x7f0000000040)={0x0, 0x10001, 0x4}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:28 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(r2, &(0x7f0000000000)='./file0\x00', 0x200102, 0x1) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:28 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1701, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 82) 06:56:28 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1100, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:28 executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001e00)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000024c0)={0x24, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x4e}, @val={0x8, 0x3, r1}, @void}}}, 0x24}}, 0x0) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, 0x0, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x16}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x16}, @NL80211_ATTR_MAC={0xa}]}, 0x38}}, 0x1800) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x9afae000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) [ 3038.589121] loop4: detected capacity change from 0 to 40 [ 3038.609267] loop0: detected capacity change from 0 to 40 [ 3038.611398] loop7: detected capacity change from 0 to 16383 [ 3038.616978] loop2: detected capacity change from 0 to 40 [ 3038.641081] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3038.641709] EXT4-fs (loop7): group descriptors corrupted! [ 3038.659872] loop6: detected capacity change from 0 to 16383 [ 3038.665644] loop5: detected capacity change from 0 to 40 [ 3038.671829] loop7: detected capacity change from 0 to 16383 [ 3038.686123] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3038.686712] EXT4-fs (loop7): group descriptors corrupted! [ 3038.688464] syz-executor.4: attempt to access beyond end of device [ 3038.688464] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3038.690419] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3038.724015] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3038.736705] EXT4-fs (loop6): get root inode failed [ 3038.737623] EXT4-fs (loop6): mount failed 06:56:28 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1fff, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3038.760674] syz-executor.2: attempt to access beyond end of device [ 3038.760674] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3038.761652] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3038.813583] loop6: detected capacity change from 0 to 16383 [ 3038.827220] syz-executor.4: attempt to access beyond end of device [ 3038.827220] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3038.829160] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3038.871394] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3038.879592] EXT4-fs (loop6): get root inode failed [ 3038.880356] EXT4-fs (loop6): mount failed [ 3038.923277] syz-executor.0: attempt to access beyond end of device [ 3038.923277] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3038.925275] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3039.022865] loop7: detected capacity change from 0 to 16383 [ 3039.031710] syz-executor.0: attempt to access beyond end of device [ 3039.031710] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3039.033843] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3039.049453] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3039.051023] EXT4-fs (loop7): group descriptors corrupted! [ 3039.063093] loop7: detected capacity change from 0 to 16383 [ 3039.069744] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3039.071301] EXT4-fs (loop7): group descriptors corrupted! 06:56:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 83) 06:56:43 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) name_to_handle_at(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000300)=@nfs={0x90, 0x24, {0x1390, 0x81, 0x43, 0x80, "8048c3bb28e59ebc63a2ebd84998ae82ce0f4267144b0a4f36c72a55f5ca662b6180a1250a15ea6ab3222b5f0444dd2453b233fccf09cd82bb97040d9031112b89177cff5ab4cc229be72608976382193f70159feadcd3ba3a0d2114c71e719ab55db8868abee698688bf74d3e7de34f8feacc8be8b4b52ca0054d6cf961340b"}}, &(0x7f0000000040), 0x1000) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:56:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_evm(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), &(0x7f0000000300)=@ng={0x4, 0x7, "5cc1ec1b0d85a055289c301a"}, 0xe, 0x3) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x117e, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0), 0x24180, 0x0) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x40189429, &(0x7f0000000240)={0x0, 0x338, 0x64e}) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:56:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 97) 06:56:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file1\x00', r0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3053.518219] loop6: detected capacity change from 0 to 16383 [ 3053.524989] loop2: detected capacity change from 0 to 40 [ 3053.543277] loop0: detected capacity change from 0 to 40 [ 3053.543372] loop4: detected capacity change from 0 to 40 [ 3053.544736] loop7: detected capacity change from 0 to 16383 [ 3053.547538] loop5: detected capacity change from 0 to 40 [ 3053.562265] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3053.563227] EXT4-fs (loop7): group descriptors corrupted! [ 3053.582021] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3053.583709] loop7: detected capacity change from 0 to 16383 [ 3053.595022] EXT4-fs (loop6): get root inode failed [ 3053.596090] EXT4-fs (loop6): mount failed [ 3053.598740] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3053.599844] EXT4-fs (loop7): group descriptors corrupted! [ 3053.667481] syz-executor.0: attempt to access beyond end of device [ 3053.667481] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.668924] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3053.673290] loop6: detected capacity change from 0 to 16383 [ 3053.701979] syz-executor.0: attempt to access beyond end of device [ 3053.701979] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.703896] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:56:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2010, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3053.748075] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3053.754419] syz-executor.2: attempt to access beyond end of device [ 3053.754419] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.756381] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3053.764606] EXT4-fs (loop6): get root inode failed [ 3053.765483] EXT4-fs (loop6): mount failed [ 3053.816564] syz-executor.4: attempt to access beyond end of device [ 3053.816564] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.818294] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:56:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) rt_tgsigqueueinfo(r1, 0x0, 0xc, &(0x7f0000000300)={0x24, 0x1, 0x9}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) [ 3053.861204] syz-executor.5: attempt to access beyond end of device [ 3053.861204] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.863020] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3053.893725] syz-executor.4: attempt to access beyond end of device [ 3053.893725] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3053.895530] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:56:43 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11be, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3053.904011] loop7: detected capacity change from 0 to 16383 06:56:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 84) [ 3053.950960] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3053.952479] EXT4-fs (loop7): group descriptors corrupted! [ 3054.009578] loop7: detected capacity change from 0 to 16383 06:56:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 98) [ 3054.045470] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3054.046880] EXT4-fs (loop7): group descriptors corrupted! [ 3054.069256] loop6: detected capacity change from 0 to 16383 [ 3054.106641] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3054.115095] EXT4-fs (loop6): get root inode failed [ 3054.115798] EXT4-fs (loop6): mount failed [ 3054.119163] loop0: detected capacity change from 0 to 40 [ 3054.130990] loop6: detected capacity change from 0 to 16383 06:56:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000240)='cgroup.threads\x00', 0x2, 0x0) mmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x6641dc81b82024a5, 0x12, r1, 0x72449000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, 0x0, 0xd, 0xffffffffffffffff, 0x2) ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000300)={{0x2, 0xffffb7dc}, 0x100, './file2\x00'}) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r2, &(0x7f00000001c0)='./file2\x00', 0x40100, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) 06:56:43 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2400, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3054.168382] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3054.171202] EXT4-fs (loop6): get root inode failed [ 3054.171965] EXT4-fs (loop6): mount failed [ 3054.178173] loop4: detected capacity change from 0 to 40 [ 3054.194471] loop2: detected capacity change from 0 to 40 [ 3054.249525] loop5: detected capacity change from 0 to 40 06:56:44 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3f00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:44 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1200, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3054.412263] syz-executor.0: attempt to access beyond end of device [ 3054.412263] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3054.414310] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3054.468302] syz-executor.2: attempt to access beyond end of device [ 3054.468302] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3054.469979] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:56:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3054.516391] syz-executor.4: attempt to access beyond end of device [ 3054.516391] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3054.518225] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3054.535066] syz-executor.0: attempt to access beyond end of device [ 3054.535066] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3054.536679] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3054.584732] loop7: detected capacity change from 0 to 16383 [ 3054.616920] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3054.618055] EXT4-fs (loop7): group descriptors corrupted! [ 3054.645988] loop7: detected capacity change from 0 to 16383 [ 3054.650822] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3054.652068] EXT4-fs (loop7): group descriptors corrupted! [ 3054.664551] loop6: detected capacity change from 0 to 16383 [ 3054.724218] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3054.739938] EXT4-fs (loop6): get root inode failed [ 3054.740616] EXT4-fs (loop6): mount failed [ 3054.786917] loop6: detected capacity change from 0 to 16383 [ 3054.811436] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3054.822534] EXT4-fs (loop6): get root inode failed [ 3054.823514] EXT4-fs (loop6): mount failed 06:56:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 99) [ 3068.510622] loop5: detected capacity change from 0 to 40 06:56:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file2\x00', 0x8ba7, 0x2, &(0x7f0000000200)=[{&(0x7f0000000240)="601c6d6b646f7366d8924800080101000440002000f80136e9d4f9", 0x17, 0x422}, {0x0, 0x3f, 0x2800}], 0x402, &(0x7f00000001c0)=ANY=[@ANYRESOCT, @ANYBLOB="ef9667e714ca6b73ddcf06", @ANYRES16]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) connect(r2, &(0x7f0000000300)=@isdn={0x22, 0xff, 0x20, 0x1, 0x7}, 0x80) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) io_setup(0x6, &(0x7f0000000040)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) io_submit(r3, 0x1, &(0x7f0000000680)=[&(0x7f0000000200)={0xeffdffff, 0x8008, 0x10, 0x1, 0x0, r4, 0x0, 0x0, 0xfffffffffffffffd}]) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x80, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:58 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0x74, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xbc31, 0x3c}}}}, [@NL80211_ATTR_KEY={0x48, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "9b8124fcf82fe9631778dae1bb"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DEFAULT_TYPES={0xc, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x1}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000000}, 0x40800) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:58 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3ff7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:58 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 85) 06:56:58 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(r0, &(0x7f0000000300)='./file2/file0\x00', 0x4d2980, 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat(r3, &(0x7f0000000040)='./file2\x00', 0x22800, 0x111) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./file2/file0\x00') 06:56:58 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5000943f, &(0x7f0000000500)={{}, 0x0, 0x12, @unused=[0x1, 0x1, 0x7ff, 0x6], @subvolid=0x80000000}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000300)={"cce1a9ff0edb338d4e0fe570ae5463ee", 0x0, 0x0, {0xe73, 0x10000}, {0x7, 0x5}, 0x0, [0x8, 0xfffffffffffffa8b, 0xdb37, 0x2, 0x0, 0x6, 0x6, 0x1f, 0xfff, 0x7, 0x401, 0x674c, 0x2, 0x3745, 0xffff, 0x100000000]}) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000580)={0xff, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x7, "494e8f61ff83ce"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000001580)={0x0, r4, "f55748289bfd6b0ef9e11aba96fad2af35f6564499ebc41111569f08fcdb5ba2bc0798d94eb29f195ef5f040c04fe35500a4414f50e87bf32ea381954cca12e2a7d9e6e60c5c3a477a3de969ee70a4850d62e42bdef1d141ce2643e68632881ba05804057cf3d1a038f184139a192b9cfbc2be0794b166d0143e4b5ff8c8c1d0a67c3bb3b3dfceca675249caa1cdc31ff36fea0fdca708f4ec67e88381c3edd998302743278d171e540c02a540b728690bb79f4d850da753a53aeb9f913b1207514fdd5e49141ae8bc53059d8bfbdac0fe883b3f81ddb0d1e8257f62ee72e6685f291b8cd296281cb42390742a89850a72039979e16fcfc6bac007b3e8f74283", "e45713e59dc8b742149d757118599e21d41baa98643723f4954e6b5d4bf030cf0480062191f0a7e75067bf759f5f55b4a031af4564373c1a43510b08abbe830990a305fcb600e7842739174dccad0c752a3d9a3bf1702b0e7d453b83582bb4aa44f8c5cfa71e3a83c631013b5be8aa229c694c12edbf1d34684620a3acd2f2400542f6913e6491db4f0327640eb5aacf6156b1ae819f781d9aa7edc740990a1e9579931cec0b790a2e05ecb2932f4e2c406d504d43c2504bc0f28aed1f8c27ed9ff7e4e7a5bed38a07b21523c5d4749c10f1e578c908eccbb2b38e391d71ad693ce6227659cf0099baa15b5cb46c845cafa31ff996e7916b5986a0d14a9b2dccd2469a47aa590e7539a4453dd20644fd7ffdb6491e0e75c1f8a6f89a8b4b4f5df6933e897336556a03c11b618ac35fd90aa031cc2061c4b15b7c4476ee013e77089fa187cec2514123095732b8528eeb40daf2945db583b527877d574324f5351028a8a934d38ae6a47718ebb94e82f8442fbdd7e0fdbd4280a18da4f7628084714f086570e3af5ef5b72a76a351144190edbeeac0e1e626281a15090ce79c91dbbe91f929be89e20b0b4b73d5a27e36fd874ad4ea124f5f91618d0752eb3353a9333ff185344764e5d91e26e8e24a2f81505eb5fce40a3282d073e5c9420f274fefbfb0e01c51b76c7f77ad2c8c5bbc46e3ef1663c0b7831b7e8e34f5e594c8833cba3d4da3ea36ab10af09dc013b7b51dfededede444ad0675b74d8e21e4a34694179f067214124df481b89814878fded4430f7198b5b75975a784c0b3deebaba1c94e8044f239dbe4014ee9f29ab858776f68418eca052a1b4bdb2ae664724254c08f5d15f898529df996b0e246ca50bbc00de158c720340fd564dcea1e87794a514fc887e40da940172c034d1720b620946c9dadfdf3b001bfd534265ba5e595ea74eaa7660d5f4068e2b7195cc6ce76fa836954cc0628478fa39f894dc22fc356f1f324961591929ce8f0fd0dcfbdf5452db0a369afaa067dcbf9db224f7178e29c198dc05a35a934819b7412717e019e404f5839ec5e5a47b84737abf136d900db21dccae588073021634311d536d48afe009eeeaa2936fece9503efda7235c793acc06f4c5f1c987d2102bdf4942b0ce0a8f23ec7c6db2d9e29467ec476004b9dde71326f58b4d25cf1450f8e8ecb9a5f3512b04bbf7bb64ce917be6cfef2bf19c1500304aa70581de16fe3e470f99edf9ed2d6f03f4a3785e2003f3c5d8e44344336c2cbe14f705f273bc42827ab1672b18c383f8aeeb7052e41c41fbf57a8632fefef21fc07337828c2129c7fd72a472a6d5d8d95dd97ab07ac4e6dee771f2f56f33a707e403348f2218291f2ec9b36efb06717b61e36944b70827f1fc55ab61060015f67d47c211c0d1db23d2f62a27dffb3e9754bb341693705ed2f0ffac7ffd83b45f7a9ce1c5bc56ea97880aeeaee703c5c46160f830c9697ba0875c510334802d484475ce7b1df33712ad0ebc378b6f2f11cd30162bf312a0de454dcecfdf9a9ab473d895a2b8503c4a76516ae5d95f54dede6e9c741850e93ca4909e8021f485c5c6e85924e2592104cece0acfe06fd0a7961bde63fc61329788898a452b2e423e5c103d09a698f1d10a19eb6ccf9ed1b4189d43112062770caf0f997b7a3c614248c3ca0f8c8f91d962fc0e9f2f9f4193c48e35e5e8c3555f14067875d2206af2b8f73478e4d779f29af8501871e136f8053a5103311a8fcdc433b63bed4be1057cd4b39e26290389fb332f7640d53b16026aab04878b3034827a44c4ae30d1329dd2d6a5ac6fed4642a92631cccdf638d864d6ea6a8889d6dce72a10f8486cdeee3ffff801a6654b04ea276b39cf7adda011256c2d32fa5e90d6c05503810289b51549dd6d1a2a80e82942c4536e507058ef5d192d776399ea740388a287b7e541e084c0b535a446755470986f1ca72925a3d1a963eff054613808c6c6d525c2612dedee9fdbaa755856940969079aaff125f2d16192d051e5c3e7d28fe6945d013e6c5772294b53b64502fa967ef8590dad926b8b735f80f5648823af5fd9e899566c5ce4171a54e8f1f0559331346fa63145547cd89d42d6ee3c93749e9f5bff1b2cc4bf73ad0a7f3b5ecf0f61449fe0ed3797ba6815090471661e7532e4fb9949fd2725a1432db726fcebaa771a2f0c1893417a933ec4c8459e957573d5da4c0cf408f293a7a8908056252769c3deb25774a6f0299851a0a05b2d6b4fb5e8156222f63e0866cd54cafea04042185744e93bed5dcbfd2b7094a9405817bddb1d4ab50960080efb94d922ea9c784c29563a115e3a20e63ba2d657b5289c64ebaef41eefac9af2ad631d7f8425f5f6f3028749e10130a9ffb3172663a403bc0e8896d8bb21aded56a350a9c121d4c572cb9db284a85b55fff444c524ef2c34bf4156d274b4bc782e4ef02478837007700477ca58be16ae92ee63371b83e57f807fe33afbed7eb9a76cc24b0c224652a7f9322c5d2726704c0a18a6c90b60b38d63bafcc4275c4187f5031085adb6d6b979cf3fd5fa7af057342f9ccf1c0579d31630917818e485d9bd285e0076bc6bdb149d10252382516bdc56cc3361187f30b375f59ac003b39394c0269c029655c852b076aa716e3ce947998f9ce12174b63a1b8ed84d3b124fc4a6d6761e4e40864ff4251f91f9eedbe2ceea2b3309473a59463213049f7bfb25da318174a36a14fcc4504c22a6f9937423628305388fac184c64b70b2bb1921905db89c2048414edd5aff6229537c7daa6d95c58e9ca0753506e77ca5c91db4474ed344186456a6323003654b500d96657b6fb5db942689df2565a34688bf6f9727ca0231e9570b662b4ac8ecdc09f6b5494cae2c6a363e65589ae76628a26810d033d47f3c9b13af626883786ed36ec8d26bfe587af601fd61c13ed04dfd95924853000407520046b951e50b6376cb7f9bbc2af06086af63161cf98c08cd0a73b25cba4a5a8602deb0da002e51cb804faee9bdef791ef124fd79c5bc49be40034853a040b5070cecd6d097b8c0fda85633c4be9e4289c93340d27b339927f6c38e41194f6d80981ddfd224c9cf11c9b80f79cc13a8b7f872fca9e5489644e5e72d3b2c52d9fc4954439b27308573226c25623918fdf916fa2df100e2190dc90fd9175c49503104164ae9898b08844a19c2a05d0a671e45e8212acd1575263e6d5dbecf144ac44ffe7d3578ade584f1e1fe610a3df1d1e078f2de65a6c1463e00525c6afb8397ef1a8ea31f9cc527e7b5631f2698cb31b080d6adb34afa53c3710f5ba3ffcf7b3e7da3eda3a9ba7be4c804009157fc0e5034f57828d0a5d942f02f5ee1901bdf19d228e88f6190c96e94e04213c58331c2b2aaf350c446d11bb25808c52a5b10bbe5225c2075c2bc013ad03914f8dde76b1504585edf155ccf2d363a2f855cf3d39a36920ba14a57ed6287c452a04378b7f7778bd35f03085ecc22d0a331702ee3ffdda4c0c8162abd7ee0fc4d439d3c9d0241c86fd85481bd8fd386471e2162f9584c27109ed0d739b8b28d47f0bcf6c667387a33814abbe1ee31d9ea93acb6eb8bece3553caead6975968e11570f0b491549eee834c707154e999b81527f40af3a785407b8223ff1ac9617ea069bf8ccf6010a48e9b97a6f3589a8388aef7163e0843cf9035891b83ee0c5363726595a63e346332c6929130b9206327aaf07757b7fbd6404d99c8f8c3cde8a4cc65945726c104fb804f9da3ec8b5c2506096e0241a2d6cbe98b49aee1d576140215c0e1ca6612d6e73574f4a8dd03d1b4add2d2566e963c156e1db6bea612b900b0b56e9b7301e146f54cba0bf410fad27465668d278b9242a84580cb6dfc01c506252e178a2600a87572e05d1813c024ba92974d2d9802fd6fdd7f154922589a7eb96392bc75aaac6c69bc7f9cbddb5715413a53a5c4403931473f168feed934ba428e834d12ceb80949496b0c2e0ea5358608db1711e6da8ea733ab1d3b37f4c953add2c783720c5ec4fcbc4f2613b38a00f17df8b95516d049331d6e6b39fa93459850b51516e2a97ff15fdb0d981fc7557d8995cf418b05a0b116d9d44234c8f806759e463264b189de1e8a7d90ee3b573d3158bac15e0ebaf3d5dee4d8e811117b7d2cd7866125b25a949c15631bb5fdab10a4a0ae7e95720534a1e283a299a12239d8eb9099b99d10acaccf1466f24de7fd24791afdddde9abe3d20692dfeaf8015b223d00f54636b1157c091b2d0b47743e991723c68891fe3fe57919eab7bf2dcc30b9968ba62b0e2c8417817c7b85cccb3668a501b429228c4c6b202d294c8b310dbc470bf1e095c10b305ec12ea3068cf49a42163e127493fe067d27f15aa255204a73ef667a47c0f8f1d4e145ee86043c1707f8fea401580ce31e31fe084892130cdf0c4ef2c50ac1795f5595c04668608dff1c930c95a40e07e98d468ba1c68290bb20c5a9a4aceff0c364fbcaf8bb619c86653dc533f9d3ae7407b0ab75dd5e75668f4f2138e696783cffe5f19bf3cbd1d0f8ca9a066f80f97c8a15c3bdf83d767310fc63b25a7d99d7429e1691e0019393a62b250ee85418b7a0b4974a8f220096a9b71cb160a5236729bf0e132fc8e1d6b49035540877bc2b773b28eed56b078b7a16d21ecf7c01c3f717dc251730f20f786712156f5714228dd3643dfdea4ad7facc54e8649bfa936684911e04eb32e7cc63fe9775812780c0140f1ba8edff219a4544e4f6cf01512750652c7bd6502070c757ced9e58198c0777e194e5fe7ddce93c69ecc36c1547345a343a5d616a0f3803f5ac3f854c5037e7df418944c0e93b02abc5784f95a41edd33c12e5f039a594005a77606e3c589fd8f671f2816272b40989255a0ee61516c78b0073b0e26a2380f71f99352271596afdec443afb67f7e097b64802f5f2e2ed5d19ec5627ce1b0ed0509ea0e667c2056f764428dfac430d0eb6c163fb6d1487add63c37e18158f57a9fae33a4784076e1e0a72ef331da397e155fa8788a51ed3238e052f1e29a6a1d3df8b62a5e0a3a79b4d13a8ea94a71dce1619e84476b5237858f9928b5e37837bb6b2dd97d5f85ed4041eb282d021414137f9d558b07894eb5c010c6a92b4483ca6fe9eb09e67e325d346ddcc79bd68352f067fe1445444a50b605e891f7b652eb3856ee7dbfd0d450611e2291d4150165f45616f3a68409e9b2d7634ca625bdbb5e02204b9c8f285d5c58df9f1fdbc052693550824626dd3388fa796117b6629509783fe41e5e599f0d52bc305ce88bb999f88bb7329fd35e7a44568e748c84a6be318f3c7d83b4dfaaa877ed77c0bac0416205e131bbc1d113ca8d1d717706e164366aac1989650b4ba2c630a3"}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:56:58 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x16d5, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3068.536048] loop7: detected capacity change from 0 to 16383 [ 3068.548496] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3068.549148] EXT4-fs (loop7): group descriptors corrupted! [ 3068.549187] loop2: detected capacity change from 0 to 40 [ 3068.560655] loop7: detected capacity change from 0 to 16383 [ 3068.574593] loop0: detected capacity change from 0 to 40 [ 3068.579503] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3068.583127] EXT4-fs (loop7): group descriptors corrupted! [ 3068.591495] loop6: detected capacity change from 0 to 16383 [ 3068.600454] loop4: detected capacity change from 0 to 69 [ 3068.608850] FAT-fs (loop4): Unrecognized mount option "01777777777777777777777ï–gçÊksÝÏÿÿ" or missing value [ 3068.632372] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3068.633584] EXT4-fs (loop6): get root inode failed [ 3068.634100] EXT4-fs (loop6): mount failed [ 3068.636136] bio_check_eod: 1 callbacks suppressed [ 3068.636157] syz-executor.5: attempt to access beyond end of device [ 3068.636157] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3068.638569] buffer_io_error: 1 callbacks suppressed [ 3068.638585] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3068.647431] loop6: detected capacity change from 0 to 16383 [ 3068.675639] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3068.677225] EXT4-fs (loop6): get root inode failed [ 3068.677592] EXT4-fs (loop6): mount failed [ 3068.713022] loop4: detected capacity change from 0 to 69 [ 3068.714673] FAT-fs (loop4): Unrecognized mount option "01777777777777777777777ï–gçÊksÝÏÿÿ" or missing value 06:56:58 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x16d6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3068.738216] loop6: detected capacity change from 0 to 16383 [ 3068.741080] syz-executor.2: attempt to access beyond end of device [ 3068.741080] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3068.743091] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3068.748787] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3068.750534] EXT4-fs (loop6): get root inode failed [ 3068.751072] EXT4-fs (loop6): mount failed [ 3068.766272] loop6: detected capacity change from 0 to 16383 06:56:58 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3fff, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3068.795416] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3068.797511] EXT4-fs (loop6): get root inode failed [ 3068.797934] EXT4-fs (loop6): mount failed 06:56:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 100) 06:56:58 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 86) 06:56:58 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x16d7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3068.970566] loop7: detected capacity change from 0 to 16383 [ 3068.972515] loop2: detected capacity change from 0 to 40 [ 3068.979178] loop5: detected capacity change from 0 to 40 [ 3068.982157] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3068.983474] EXT4-fs (loop7): group descriptors corrupted! [ 3069.024258] loop7: detected capacity change from 0 to 16383 06:56:58 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x2}}, './file2\x00'}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x8}, 0x0, 0x7}, 0x0, 0x3, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:56:58 executing program 4: r0 = accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000240)=0x14, 0x80000) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000300)={0x2, 0x5, 0x1, 0xe229, 0x3, [0x1ff, 0x80000001, 0x5870000, 0xfffffffe]}) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = getpid() pidfd_open(r4, 0x0) fallocate(r1, 0x0, 0x7, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) [ 3069.047865] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3069.049121] EXT4-fs (loop7): group descriptors corrupted! [ 3069.069068] loop0: detected capacity change from 0 to 40 [ 3069.075080] loop6: detected capacity change from 0 to 16383 [ 3069.132592] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3069.139145] EXT4-fs (loop6): get root inode failed [ 3069.140028] EXT4-fs (loop6): mount failed [ 3069.145985] loop4: detected capacity change from 0 to 40 [ 3069.157967] syz-executor.2: attempt to access beyond end of device [ 3069.157967] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3069.160023] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3069.188488] loop6: detected capacity change from 0 to 16383 [ 3069.222374] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3069.228468] EXT4-fs (loop6): get root inode failed [ 3069.229210] EXT4-fs (loop6): mount failed [ 3069.255033] syz-executor.5: attempt to access beyond end of device [ 3069.255033] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3069.256858] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:56:59 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:56:59 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 87) [ 3069.379445] syz-executor.0: attempt to access beyond end of device [ 3069.379445] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3069.381242] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3069.425413] syz-executor.4: attempt to access beyond end of device [ 3069.425413] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3069.427037] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3069.488214] loop7: detected capacity change from 0 to 16383 [ 3069.495841] loop2: detected capacity change from 0 to 40 [ 3069.525094] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3069.526258] EXT4-fs (loop7): group descriptors corrupted! [ 3069.572367] loop7: detected capacity change from 0 to 16383 [ 3069.587987] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3069.589095] EXT4-fs (loop7): group descriptors corrupted! [ 3069.641159] syz-executor.2: attempt to access beyond end of device [ 3069.641159] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3069.642958] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:57:13 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 88) 06:57:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:13 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3084.125124] loop5: detected capacity change from 0 to 40 [ 3084.126577] loop4: detected capacity change from 0 to 40 [ 3084.139548] loop6: detected capacity change from 0 to 16383 [ 3084.140180] loop7: detected capacity change from 0 to 16383 06:57:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file1/../file0\x00', &(0x7f0000000240)={0x88000, 0xe5, 0x8}, 0x18) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:13 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1c01, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r3, &(0x7f00000001c0)={r0, r2, 0x400}) pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3}, './file2\x00'}) 06:57:13 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(r0, 0x10, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_mount_image$msdos(&(0x7f0000000240), &(0x7f0000000600)='./file1\x00', 0x80, 0x1, &(0x7f00000006c0)=[{&(0x7f0000000640)="16985d4313cbb8fe80afc248488c49ed96bfb8bbca4aa504c4b738c8bdd5faf0db495be5c8b1c37b9bc5c751dc90cd5b404931896f462935cc170aac646495c2ed24127661964dd51f3151ea168594c35e86d32fbf264664d6819bdf348373f05058f6f1979dd28e", 0x68, 0x5}], 0x800000, &(0x7f0000000700)=ANY=[@ANYBLOB="646f74732c74736b0000f40000000000000005002c00"/41]) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000980)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x800}}, './file0\x00'}) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000300)="6a1b8362c15fba960f04e45a4e546d0f2ad4e9e2cf51164d699c652a4318e9b1bedb31f13259e59c976f55da88702ee2ffc06b4daab152931d8b9b134379dc61e42fc385dc32ca959c433e9d1e1104230372e2664f74fdd0839e1291f68833cd85", 0x61}, {&(0x7f0000000380)="63b406fdc2ed928de8d1f2f5cf21f1d9bd791b6c5854bda513677e780e0618d50c688ac50ee8e4f586da62ff5f376de393141449a106d62a326566bbf956c8cc9fba8b1542d31d105d5212433850bb19c6285168a9eac1fcd38f28bbf590e2cc8ca63b4f0c0c4c82b65e6e284669d3a02510b92a29d8e48a87d932483a85bee28504bd02bd8567cc2ef350827ba71186a4c7174ad2fe35905303b3ad75443794d7d3e05de243a0347fa33ebbb0ee54eae06441d2e62d3b705f44ccf696619e1b4f950bba59aad720", 0xc8}, {&(0x7f00000001c0)="c937722e66871bd5c7df9e70c004c7fd4dfc8217c79caf277474985e03548a680e9def7f25a1acc8c7cc8d31611f43a1ec104b7cab7af7f481f3", 0x3a}, {&(0x7f0000000480)="e2266c0c7d1c79ba9f64d0a74382baa29cd5fec043749d973ab5cf0a24a477516d441f94f3b3eb8b0a6554970abec6b6ac9f7728e260016893fdd7a237a092e7125cb030f24148b05e97ff0092848d90a45706fd3f782d9d69286a0ac82d1b57a7ce55cf69c6d3cbf9ade16773016abc3ad32fbce65f3a5a08cdc93b", 0x7c}, {&(0x7f0000000500)="10a6e3f7b4d2a9439a56388f5b4130828185b1a800fd96f2547d43135225b1f65a008d32a9c88096474d229879b14255fce67f4974b6d38ce4f70112969a3717b0d4308b3ffa4da8413bf433ecd91cb5886df0634f5dbf2ac8a83665b7ca", 0x5e}], 0x5, 0x8, 0x800) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) execve(&(0x7f0000000740)='./file1\x00', &(0x7f0000000840)=[&(0x7f0000000780)='dots', &(0x7f00000007c0)='nodots', &(0x7f0000000800)='nodots'], &(0x7f00000008c0)=[&(0x7f0000000880)='msdos\x00']) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000900)) 06:57:13 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYRES16, @ANYRESDEC, @ANYRES16, @ANYRES64, @ANYRESHEX], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r4, &(0x7f0000000300)=""/98, 0x62, 0x280000) write$bt_hci(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cf69d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612a26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b100"/137], 0x13) fcntl$getownex(r4, 0x10, 0x0) accept$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) sendmsg$unix(r1, &(0x7f0000005380)={&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000580)=[{&(0x7f00000001c0)="540d4075d9d1f596f265f5e31df01a0b", 0x10}, {&(0x7f00000005c0)="0786cc9b5d4510cc702fba9cf4e85d75e33aef7c0e69d31163c2a12912a795bd125a96700120e7096100de6ab7c0023917c2f63ea4c7340473e31ee914e41b6a4a6f3d68869f2617d2b9ed45dfafcb533abdc28b830edd44c4985376db34ef34e77a802a926daddcbabc722b1e43253916b80480d092d9d839dfd52ef51f58265b0ada4f56b8811826a06c98292d6bdd8b12e9a1bfd236b116989a790144a30b8a2f391c776cd774b73ca3204ba2d723f75b4c7a8e9b534338", 0xb9}, {&(0x7f00000003c0)="6a7ea0d6364eb448935176515cb07090df03d81da69539569dad11f405b4c69d12d273210f6a22ccc1e5216a91d3334926ae03d0a4cda47276bd29cd3d2133fc613fe583cf83b47d66ba981070376d5f7365320d7943d7ec1a60f3bbcb6112ddbf5963e33672074d6cac03f7f76b07f2ab01bcb4ab5187c25be46c8efa2d5c55173e624a7abf65b1477dce031eefec3046f37537fcbc1f55b53f9782a2895377fca738fb44495741b83d5f59b52846a00c5ea85e72bd676dc7876a224b01f521df3f82cc8a1548b7aa0f0844955d3cff9e29a87bf37f8903a185862c2898044b35ae83cbe8db08d0b31db5f0", 0xec}, {&(0x7f0000000240)="33cb1e1039af7ee3c94d556cf19a43baef43d3135d3f6c0ed90eab92707bdf53642d96df44f93c8141cff187a579af5be22e", 0x32}], 0x4, &(0x7f0000005280)=ANY=[@ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=r3, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32, @ANYRES32=0x0, @ANYBLOB="0000000014000000000005000100000001000000", @ANYRES32=r2, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r4, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r3, @ANYRES32=r0, @ANYRES32=r1], 0xd8, 0x48010}, 0x4) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b83caa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f760452e918ae0f5c1363041b8905e82fe373e6de4082d9159407fc11fa10da87a38522886777f7997ef2caaf3f4fb727ecfb558451e53753ed53f137ab59ed311b4b7be6b981c3acfdee37938784bf27462504800fcaef17a3f37ec41043f9002875be57dfe42a83114ed00"/263], 0x13) fallocate(0xffffffffffffffff, 0x48, 0x6, 0x6) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) [ 3084.166263] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3084.171276] EXT4-fs (loop6): get root inode failed [ 3084.172189] EXT4-fs (loop6): mount failed [ 3084.174326] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3084.175712] EXT4-fs (loop7): group descriptors corrupted! [ 3084.182726] loop2: detected capacity change from 0 to 40 [ 3084.186679] loop0: detected capacity change from 0 to 40 [ 3084.193973] loop7: detected capacity change from 0 to 16383 [ 3084.206068] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3084.207598] EXT4-fs (loop7): group descriptors corrupted! [ 3084.228168] loop6: detected capacity change from 0 to 16383 [ 3084.268277] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3084.271185] EXT4-fs (loop6): get root inode failed [ 3084.272019] EXT4-fs (loop6): mount failed [ 3084.307154] syz-executor.5: attempt to access beyond end of device [ 3084.307154] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.308831] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3084.342405] syz-executor.4: attempt to access beyond end of device [ 3084.342405] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.344095] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:57:14 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3084.415708] syz-executor.2: attempt to access beyond end of device [ 3084.415708] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.417720] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:57:14 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1d01, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:14 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) openat(r0, &(0x7f0000000180)='./file0\x00', 0x100, 0x68) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) accept$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) pwritev(r3, &(0x7f0000000240)=[{&(0x7f0000000300)="5b53579eac4b6e3761faa30df24448a461a7fcafcbaf3863a68bc8b0f69a0161f6296686a19a3c1bcc59da3ef46bb76b5a055286fda387a8e710f45a70b63db8763db49cb47f1c5cee6d431d8b761cbac388099a1649747c652f2b477fcfbfe746f6dd248c18b6294437a13ed10e98cc89b6983c70433b6a45ad0b86afc6857f6d6f52", 0x83}, {&(0x7f00000001c0)}, {&(0x7f00000003c0)="2fbd94b3e4cb5397171c5af62a8b1b02b25fd7e39ed21113d022bd6fbe1bb7e92933eed99dd4d1bae1e86af353414d7c7afe0912ffa4932b92379c29566c735c3dd772824345", 0x46}], 0x3, 0x7f, 0x32) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3084.532187] syz-executor.0: attempt to access beyond end of device [ 3084.532187] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.534283] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3084.605631] loop7: detected capacity change from 0 to 16383 [ 3084.625835] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3084.627162] EXT4-fs (loop7): group descriptors corrupted! [ 3084.641701] syz-executor.0: attempt to access beyond end of device [ 3084.641701] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.643410] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:57:14 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 89) [ 3084.662719] loop7: detected capacity change from 0 to 16383 [ 3084.673166] loop5: detected capacity change from 0 to 40 [ 3084.679836] loop6: detected capacity change from 0 to 16383 [ 3084.685162] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3084.686457] EXT4-fs (loop7): group descriptors corrupted! 06:57:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000240)='./file1\x00', &(0x7f0000000300), 0x80b0, &(0x7f0000000340)={'trans=virtio,', {[{@access_any}, {@uname={'uname', 0x3d, ':\xcf\\'}}, {@afid={'afid', 0x3d, 0x1f}}, {@access_user}, {@aname={'aname', 0x3d, '[:[)-%'}}, {@nodevmap}, {@cache_mmap}, {@cache_fscache}], [{@dont_appraise}]}}) [ 3084.748111] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3084.751376] loop2: detected capacity change from 0 to 40 [ 3084.765356] EXT4-fs (loop6): get root inode failed [ 3084.766168] EXT4-fs (loop6): mount failed [ 3084.790735] loop6: detected capacity change from 0 to 16383 06:57:14 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4c00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3084.848255] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3084.851069] EXT4-fs (loop6): get root inode failed [ 3084.851807] EXT4-fs (loop6): mount failed [ 3084.886551] loop4: detected capacity change from 0 to 40 [ 3084.925230] loop7: detected capacity change from 0 to 16383 [ 3084.973575] syz-executor.5: attempt to access beyond end of device [ 3084.973575] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3084.975285] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3084.989481] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3084.990633] EXT4-fs (loop7): group descriptors corrupted! [ 3085.017393] loop7: detected capacity change from 0 to 16383 [ 3085.043463] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3085.044891] EXT4-fs (loop7): group descriptors corrupted! [ 3085.080536] syz-executor.4: attempt to access beyond end of device [ 3085.080536] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3085.082304] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3085.175011] syz-executor.4: attempt to access beyond end of device [ 3085.175011] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3085.176564] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3098.807052] loop5: detected capacity change from 0 to 40 06:57:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 90) 06:57:28 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x5301, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:28 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1f01, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:28 executing program 0: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open_tree(r0, &(0x7f0000000000)='./file1\x00', 0x95495fca46bee35a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmmsg$inet(r4, &(0x7f0000008f00)=[{{&(0x7f00000014c0)={0x2, 0x0, @multicast2=0xe0000003}, 0x10, &(0x7f00000047c0)=[{&(0x7f0000001500)="a2df", 0x2}], 0x1, &(0x7f0000004840)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev}}}], 0x20}}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000040)={@empty, 0x67, r6}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:57:28 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000000)=0xff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="c84f4007ffcaf79453ca9640daef38eefa7ebfaf6354edc17cae"]) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0), 0x3}, 0x0, 0x10000, 0x8, 0x6, 0x5d0, 0x4, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, r3, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) getxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)=@known='trusted.overlay.redirect\x00', &(0x7f0000000340)=""/55, 0x37) [ 3098.816829] loop2: detected capacity change from 0 to 40 06:57:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f00000001c0)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000580)={&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff7000/0x6000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f00000003c0)="9939fe7132c761470058ef06a5c7c9bc7549cc53f3a3e721e233fc3f8e7335fc01b6410289d41312dd8977077fb4156d901dbac46a625cd29037c0e94f4a71e5c2fd5d246fb6cd63d6ccb45e30c13137d4f4492817e2e59b4e99e6bf85f345e9f1daf1c4d7842bd44a17308446d59158405a3b546f9b0e08a02b01ad8fb1c11d5524f2d093b6940d40f50da44426f22ee17a883b400c13db8dd5176a3769137d26668f42f09b7b2a933bb238ae166f4898fd68231128439d51d5b45df43864f8bfaf803e8fe91d008666b5d57081f4ea884ee4", 0xd3}, 0x68) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r2, 0x10, 0x0) accept$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) write$bt_hci(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc7e9, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, r1, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000280), 0x2}, 0x0, 0x0, 0x1, 0x1, 0x1, 0x81, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x101040, 0x100) [ 3098.821016] loop4: detected capacity change from 0 to 40 [ 3098.832243] loop6: detected capacity change from 0 to 16383 [ 3098.850526] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3098.852209] EXT4-fs (loop6): get root inode failed [ 3098.852617] EXT4-fs (loop6): mount failed [ 3098.869469] loop7: detected capacity change from 0 to 16383 [ 3098.874415] loop0: detected capacity change from 0 to 40 [ 3098.877467] loop6: detected capacity change from 0 to 16383 [ 3098.895665] syz-executor.5: attempt to access beyond end of device [ 3098.895665] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3098.896647] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3098.905973] syz-executor.2: attempt to access beyond end of device [ 3098.905973] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3098.907014] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3098.911622] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3098.912869] EXT4-fs (loop6): get root inode failed [ 3098.913217] EXT4-fs (loop6): mount failed [ 3098.920178] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3098.921406] EXT4-fs (loop7): group descriptors corrupted! [ 3098.924553] syz-executor.5: attempt to access beyond end of device [ 3098.924553] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3098.925445] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3098.977408] loop7: detected capacity change from 0 to 16383 06:57:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 91) [ 3098.990053] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3098.991323] EXT4-fs (loop7): group descriptors corrupted! 06:57:28 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1fff, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3099.089246] loop2: detected capacity change from 0 to 40 06:57:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0xffffffffffffffff, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x6100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3099.127938] loop6: detected capacity change from 0 to 16383 [ 3099.132545] syz-executor.0: attempt to access beyond end of device [ 3099.132545] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3099.133961] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3099.149080] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3099.154063] EXT4-fs (loop6): get root inode failed [ 3099.154428] EXT4-fs (loop6): mount failed [ 3099.174094] loop6: detected capacity change from 0 to 16383 06:57:28 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000240)=0x1c, 0x0) accept$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f00000001c0)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x101042, 0x100) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3099.202060] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3099.203645] EXT4-fs (loop6): get root inode failed [ 3099.204137] EXT4-fs (loop6): mount failed [ 3099.226811] loop7: detected capacity change from 0 to 16383 [ 3099.230967] loop5: detected capacity change from 0 to 40 [ 3099.234218] syz-executor.0: attempt to access beyond end of device [ 3099.234218] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3099.235415] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3099.236242] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3099.237104] EXT4-fs (loop7): group descriptors corrupted! [ 3099.243449] loop7: detected capacity change from 0 to 16383 [ 3099.255063] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3099.255965] EXT4-fs (loop7): group descriptors corrupted! [ 3099.296464] syz-executor.2: attempt to access beyond end of device [ 3099.296464] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3099.297616] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3099.298842] loop4: detected capacity change from 0 to 40 [ 3099.347937] syz-executor.5: attempt to access beyond end of device [ 3099.347937] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3099.349110] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:57:42 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 92) 06:57:42 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:42 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3112.679716] loop6: detected capacity change from 0 to 16383 [ 3112.683311] loop0: detected capacity change from 0 to 40 06:57:42 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='./file0\x00', 0x40000, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) accept$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) 06:57:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x901, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x80800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0xbef5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r1 = syz_open_dev$vcsa(&(0x7f0000000180), 0x10001, 0x900) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0x3, 0x4, 0x20, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x80, 0xd91, 0x1}}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r3, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x4e24, 0xff, 0x4e22, 0x4, 0xa, 0x0, 0xe0, 0x8, r2, r3}, {0x400, 0xb5, 0x7, 0x80000000, 0x8001, 0x0, 0x41, 0x9}, {0x1f, 0x9, 0x8, 0x8001}, 0x0, 0x6e6bb4, 0x0, 0x0, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d3, 0x8b}, 0x2, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x400, 0x330, 0x8001}}, 0xe8) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000480)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r5, r4, 0x0, 0xfffffdef) 06:57:42 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:57:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(r1, &(0x7f00000001c0)='./file2\x00', 0x20000, 0x1) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) [ 3112.688631] loop4: detected capacity change from 0 to 512 [ 3112.692012] loop2: detected capacity change from 0 to 40 [ 3112.692129] loop5: detected capacity change from 0 to 40 [ 3112.704830] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3112.705064] loop7: detected capacity change from 0 to 16383 [ 3112.712689] EXT4-fs (loop6): get root inode failed [ 3112.713388] EXT4-fs (loop6): mount failed [ 3112.721887] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3112.722503] EXT4-fs (loop7): group descriptors corrupted! [ 3112.736224] loop7: detected capacity change from 0 to 16383 [ 3112.740496] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3112.741846] EXT4-fs (loop7): group descriptors corrupted! [ 3112.751192] syz-executor.5: attempt to access beyond end of device [ 3112.751192] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3112.752201] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3112.767728] loop6: detected capacity change from 0 to 16383 [ 3112.799360] syz-executor.0: attempt to access beyond end of device [ 3112.799360] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3112.801057] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:57:42 executing program 5: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f00000003c0)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}, {&(0x7f0000000300)="823c984b295bfd62d9c2764f5d9955b2fb78de031a2b379fc63e6ddeaa841a13c7d38f8af35dbd1157224e89293363e7fa359c62054386f466d7adce9cc8e8a07a216b57eece464165b6d0a71c19cbe84c224b3041554013fbed042012bc7fdc460581caafe3f13ecef0bb1dbbfe20e8033cdcab2683939773bd26bc1077f664f04435931b60387d304744", 0x8b, 0x65}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x101042, 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) lsetxattr$security_ima(&(0x7f0000000180)='./file1\x00', &(0x7f00000001c0), &(0x7f0000000240)=@v1={0x2, "53cab7644688a3"}, 0x8, 0x1) [ 3112.833282] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3112.837426] EXT4-fs (loop6): get root inode failed [ 3112.838113] EXT4-fs (loop6): mount failed [ 3112.860697] syz-executor.2: attempt to access beyond end of device [ 3112.860697] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3112.862096] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3112.863431] syz-executor.0: attempt to access beyond end of device [ 3112.863431] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3112.864358] Buffer I/O error on dev loop0, logical block 10, lost async page write 06:57:42 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6c00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3112.914666] loop5: detected capacity change from 0 to 40 06:57:42 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2010, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:42 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 93) [ 3112.984491] loop7: detected capacity change from 0 to 16383 [ 3112.999548] loop6: detected capacity change from 0 to 16383 [ 3113.003634] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3113.004277] EXT4-fs (loop7): group descriptors corrupted! 06:57:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) syz_open_dev$vcsn(&(0x7f00000001c0), 0x401, 0x141100) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000003c0)='!\xc1\x00\rn\xe7\x11\x9c\x81u\xfe\xdb\xf1\x1dfq\a\x00a\xc4iSR\bm\xe0\x87\xa7\xb3\x1f\x92\xf4\x905\xdfl\x9bW\xc2+y0xffffffffffffffff}, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r3, 0x40046721, &(0x7f0000000380)={r4}) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200, 0xce) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3113.542655] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3113.543303] EXT4-fs (loop7): group descriptors corrupted! [ 3113.559168] loop7: detected capacity change from 0 to 16383 [ 3113.567228] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3113.567913] EXT4-fs (loop7): group descriptors corrupted! [ 3113.619637] loop2: detected capacity change from 0 to 40 [ 3113.699593] syz-executor.2: attempt to access beyond end of device [ 3113.699593] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3113.700644] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3113.703234] syz-executor.5: attempt to access beyond end of device [ 3113.703234] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3113.705260] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3113.709588] loop4: detected capacity change from 0 to 40 [ 3113.817713] syz-executor.4: attempt to access beyond end of device [ 3113.817713] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3113.819921] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3127.634294] loop6: detected capacity change from 0 to 16383 [ 3127.643344] loop0: detected capacity change from 0 to 40 06:57:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f00000001c0)=[{&(0x7f0000000200)="601c6d6b645c7366d8a02b00082ee6931e6f7661e1f801", 0x17, 0x9}, {0x0, 0x0, 0x76}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:57:57 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) r3 = socket$inet6_udp(0xa, 0x2, 0x0) clone3(&(0x7f0000000440)={0x240000500, &(0x7f0000000240), &(0x7f0000000300)=0x0, &(0x7f0000000340), {0x1b}, &(0x7f0000000380)=""/103, 0x67, &(0x7f0000000580)=""/210, &(0x7f0000000400)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x3, {r0}}, 0x58) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000680)=r4) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:57:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000240)=0xffffffffffffffff) chdir(&(0x7f0000000140)='./file0\x00') getsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r3, 0x10, 0x0) ioctl$sock_proto_private(r3, 0x89e1, &(0x7f0000006080)="3abd8fed469a78355ef39647757737da86fbad04617185b592468c4a3f798561a9eb694337e41745e7998f1bc36cfaab891518fdb46b291d41784cb54f1bc35cda20a920ba7c3b5b70be65") ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000005fc0)=0x800000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) [ 3127.678788] loop5: detected capacity change from 0 to 40 sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000006040)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000006000)={&(0x7f0000006100)=ANY=[@ANYBLOB="585c00000d0a010400000000000000000c00000508000440000000000900020073797a30000000000900010073797a30000000000900010073797a310000000028240380100000800900090073797a3200000000440400800c000540000000000001000004000780b401018056000100883e01a3b091128f226ee854862e86a2e8985fd124361e559bf21495068bc4672f06875c79483fb50024d49b1ffdc75551eaeda03ff0062010ecc51222074da2ad4496e19866ec10808ced1115577e44778e0000e10001006ccaea21fddd5a08c5d86e9ed029ba18c94927642345480220b1a58cc3f6cb1b58c0469c779f6b797c509ec6b76709d7e6b1f8a6e22f0180c2aeb00c366388d96c4773a8672740eb9118c9934c39646ae1aa5c0ea37979dee1d66e2fd572101fbb79ac8728f63fde781833a616a08962aa24fb2b5aabbfa32940bb560c4cd0eff5f4a1ce6c4eea0f6717ec8887c95c5745e47e2d0d6f022c7cbe5c6122fd40bc5fe7d368aca8241116cdaa32d46f0ba609cd9a48bb0aa4576e380d5984584ce4b45521b5150a966282d8e50b5eb00c37c2ada56d268c2f349c8cfc4b110000001400028008000180fffffffb08000180fffffffb4800028008000180fffffffc0900020073797a30000000000900020073797a32000000000900020073797a3000000000080001800000000008000180fffffffd08000180000000001800028008000180ffffffff0900020073797a32000000007c020a80100002800900020073797a3100000000380002800900020073797a3000000000080001800000000008000180fffffffc0900020073797a31000000000900020073797a31000000004400028008000180fffffffe08000180fffffffc08000180fffffffe0900020073797a31000000000900020073797a300000000008000180fffffffe08000180fffffffe2c0002800900020073797a320000000008000180ffffffff0800018028c4a6840900020073797a3000000000b6000100f9c4468440ef915f9d7c4c7dd795a40e9589a96f5f385b9b0fa039de073773ef740ce4ebd285f0cb3af4a163494da5680558eb5b3029aa5df6c445dcbda70703be190d42a2b6ac05fa5747d8b4bb34e5245931388a63bb3f7dad32c678e9cc228de0e00f419256252fe724f3937a3ea7bb2c137b143e7b9006730a49c9f8ae7aff835a2d887dcdd3a5377762cf94332830660533eab079efee1d3d326d3b76d7ea2ef4f1fcae5453027feb7199423a9ec6c10000240002800900020073797a300000000008000180fffffffb0900020073797a32000000007000028008000180ffffffff0900020073797a30000000000900020073797a30000000000900020073797a30000000000900020073797a32000000000900020073797a320000000008000180fffffffd0900020073797a320000000008000180fffffffb0900020073797a31000000006800028008000180ffffffff0900020073797a310000000008000180fffffffc0900020073797a30000000000900020073797a30000000000900020073797a310000000008000180fffffffc0900020073797a300000000008000180fffffffc08000180000000000c00028008000180fffffffd2c0200809801018034000280080001800000000008000180fffffffe0900020073797a310000000008000180fffffffd0900020073797a3000000000920001009fa316811701fa4bb3ac02e17423a528790f010d609131e9a1aa61c4a0d78456a1d9fbb474c7f5ae07eef713f36c2a333e7d05c2e0a5d665c6558ee0ffd3e5adae7f26a5db06e9c67bb62dda18dfa37d580863f74dd753483943ac3afb28780063d71975bf471c9316a28eed615bef671c12880ed97b8e200fd0af3396f3c48fa687714ccdb6bc43a1c0a6b7824500005e0001009c3097f00d510e97e4a5bc9b6627c12302613a24e038a6e8bce9929bc4785c7dfa50a28f3eb12924093d5d0e916056a75c1d3fa0f02c42cbe082058be906c664a8eb38f96ee38a157b689505baf0b538797cab49d0a653469cd600006000028008000180fffffffc08000180ffffffff08000180ffffffff08000180fffffffc08000180fffffffe0900020073797a3200000000080001800000000108000180fffffffd0900020073797a32000000000900020073797a30000000000c00028008000180fffffffd4600064001bd0f00933cffbd1c23cd67841b7fb396bd72bf4eccdcddc82d5460d972c1de051e1f7c8bbdde0d4eabafd56baf8aee9c0ee0aa833fbea19c091801de4bb0365cc500000c00044000000000000051430900090073797a32000000000c00044000000000000000400900090073797a31000000000c00044000000000000008000c0005400000000000000005b01700800c00054000000001000000010c00054000000000000002930c0005400000000000000000b4020a80800001004d7a58407aeecbc7fb1e4cf41dd5af8a20a0558d0cd85928ecb789f62ecdf3bc9f7cbc4e8c1d933fa4d687761db3cdeba88c677169b62c2055e78538752605937b3abe3c6ed4af4ba83ece5a424d7eb85193552031c045ff637219323855abb0bb326b0dff8955af87c50b7fa482c0442418a7a292eef9a13e9ec45d1b00010033275db320c73dc4efd13458889e577883bfabf48542e1006100010084ead52fc9a3f8a626396d99b97bac955ae6aea8833418f9243f5237e299f61bf0540970feaf10a0c1e9e9ab09d9a02c2ef864366d2c0be313aeb755061b97206f9814a24c373c929fed9b8713f05ab5d89abba73c8ce94dc2cddbadb5000000fb000100d272914baf5bd91883d4a240d4b7f5aaf852911c7d0a78254256317ae441ea7648b2aa4c784a542e8269783459dcc366e06539c41602232feb03deb2b887dc5ec5e0ed1500fcc6a82d220f3e5eb5ea3059a20a7337092bda4b125002bc85474b0afce966c6cdb778d53a4326a2b2392b6a7b05e094e2f58aee1cdbec1a7d3872c1702f369af78164908f70d67643a2e68de71f7fd5564cf98ea7fc19e58a7108a6760756fed4b9b1ca8e2934a9796fe0d2bfd39fd3695045ee765146c1acf428b0659334ac3524fd6f5bb0017b366f07a02e716f5f6d9ec6b1d85e397a9fefd76a548da897a1f2bc0500b6f002cff986b1b12de2c0d25e003c0001000088d0176ded77e5f3bfb34d2cd058c265cfb35fc67f3c930a198196349ab426b0de895b751695fa852be84d15e7fb8b869769f7c800a879100002800900020073797a310000000044000100e418f35675de4cffef364c8ed66b69b67297df61dc5a02baab2f4371d390d63a332877ce68e8ff8ddc259dd817d5438fb285406e040736e2422ef679f7989920240002800900020073797a300000000008000180ffffffff0900020073797a3100000000cc000280980001001a54d1f57ad2371ec629d7374d566147d3e302e3d5e464abdaeed149294e5a2f5cc492f8128be5c49ccb42548cd6ead4e85a6204d40ada4da22ffde191369d318e97e631e6d8d1187297164812eb78edb1c928921474eda4294f54a9d408fa3ff848b33dc14c1eaf30544c86e69c2546f796e723ec48166f3fb20ed720fd7cf3c48a70d5c7e21f1514f68880faa9a93c80ee68ad3000028008000180fffffffc0900020073797a3000000000080001800000000008000180fffffffd08000180fffffffb8c0001800c00028008000180fffffffc7b000100526e4f83634d8ee3e108aae7386012a5a80f5bb3bbae9b4467a57fe0bd8830b421cf80d24027581e990d29ac43132b5422d7022e6ef3d8f659df2da4d4b2ff1a8228c3123efd1a0dda1d0d262885871d901655f4b2dd0c43e51d79a07f1290c358860dfb79ef83584f6578cb387b17acc1db8a4f7db7e700840102803000028008000180000000000900020073797a30000000000900020073797a30000000000900020073797a3000000000030101006e41475f96e781321cc122b55346e89e23b71e0f6d237d378d9c43a49de8aa4f67d1f680698430179b9c654281a558b0d764a94cebe312c564a7f63f3126bceb12295a553e8bc501036fc20df2797b7cbaf02746cf3f5cb525de11224f4fb843df9738b19dac98ea940c9ba681b5fb6d53d7e04a36502bddbaa8caba6106af28e23c086a421ea1fc93b438be1a5e2cbd776701b0a5ec3bf79af0fdfbe984affebe5b9793aa9304a926016d274815a4618e25b75b3f9856cdb0a04e4822145c0bc8b614090dee8dd316c6bfe628484958d59a633db13457d1df635fec6b2d41a16d950de5d6451e48357c9deb912c0ed24e8f10039521ecc3a92f770dba22c8004c000100314d42d76cb504c066ac85e432dd13a2eb73571df0aa7d18571af379705a4d0d4fb4b4d5be2adb8acfce82207f448e96b2961b90884d2f6a13b9cd9d7c8df9a194b71abfa39f3ff204000780f80006401565c4932a2fda54a75f5a3218a29b9225169b62f5ac2f391da74193d08c8a0e2ebd6691ef12977a3ce37444c249c484141750b3200da7b85e2e510b5379e1e0d4b24e315e6fc1d0c7080187250bb1ff06b368ae14832e969aa2e55c7f6c3b282ae2e5d9e19307dea2e6e4b191a8f92f5a756fb170c56fbcc99c29177d6b3fc6e6d1790cf769e410f25cafef79708999af416df6906c10134538f63e8e5cca9065de0eecd1b7d316d41f06d0834d8433e3a8505f304f14b0fa0e5985bc8a2ea43f793d493db8eb0e1bdaf7b06c56224951d331a03b4ce49d8a069c376c7e616f8ae640cbfa3d2e2d03f97ec0ba408d23c74f47b1fc1002806000028008000180fffffffd08000180fffffffd0900020073797a30000000000900020073797a30000000000900020073797a30000000000900020073797a320000000008000180fffffffe08000180fffffffc0900020073797a320000000004100100471b3b017bea4100297a0d754c337e6032c0cd616c5b5c516c3e59a43f002c7d2ddf98475b00b7499300e7c521da2e8436f1f726edf1249836bdba2cca580a7fa18d7b4c0900df8358abb9da078d5dc630dd4f3c869df3a448e00ea70ed14ce9f69fed74590e48ad00c98d2417a418ee5ff7acb6a4e034c76d33a42df76c6ca1cfa71fcb6f9990ef7106733a5d023ecd242045a3b377ed974ed7ad7b6a1f65edba5a0f58c14f8bf240c7ad20232abbd33b18d457108d7d5c35cfdbfed35019c6a2ae37c7faafeb09ef8170293ca769d6e9612a039174867353882865c3db097a147fcdc81812b9d12df9d6ff47ecb386b4ac2151460f53bf95feb1e70dc84b85c5cb2b287e21e9347c125934dc9231a7c1ebbb7af4ead24b0bebd4bc1711a5e0877d28265681c020e4966e34f9e66087af458234da801752ab89ad17fe3f817017077e81341caf8b2a25cf51a7063b7ec463d63fd11d18303678b9609366bcafd18357301c5b5041d5a750cf78d6d94d711bab9f7360c1b15b144cbbbab247fd4adf64e7decec319a04ec7ab0c99535153614f18fbca0effa0e1cbe3f7269f67e5a28b8569994867a44640928b5c7c15dd33ca99f27091f8e8d134be336863b111c9749fe7766b8c480687af14a86f209725fbbcfbde583c6820d185da37b6c35ca6ec59a8d0edc3bc91411374dfb6002a80d5ef1169e6eb716945bb9cd2f34fbe202b82c0d0f5938a903ce01510c1c945800bb84b467031e6e806cf5171a4261cc0bcc853e25928955d0cc45239093404d27de3c53335499c95d00c32ccc64e7d2402c2b817f596bf05ffc3cb6874c44e101b8cb19bfa44566561cccb3308839aff65512a121e42aa44ee069311c6ee709ee5c38b79acbd802f4c8fd0a453072c096307a02aa955b242da6e96e9367eef420551d90367fad75a7b91041619f4decead5819da4d67ab5abcd37055ecd04434de12235d3e9148b3ed4f64d74672b5caa724a73a1d91c176f54b634c57c2a9be7f18801b3dd8bfec337e1c80493ec7b6f16b558bcdca42dc5b2e881804dae3a1499fd095683c9a6a0cab33dacc705a3ad9963f9c5c27b31f8969e657a52e6892773b0f3e2d2a63668e10302ed763787d470668374f60b256114277ba488d8846c34e3cda55adb1bec3cfa05cb31db3d29a95f67f056343739417f9e5527afa9f7548d20bd78a9471ec0c8b16ee3a8f7a399aae9ad07657b0993e5ffddbc96f557a593cfc5e292d7e01051839f24e6b98c53b444c999154ee634576312c024caf3e3e87b87d55de5f5ad9ad18594e866dc33a6d888e911fa6ab22983f95dd57b40e7e76310a83df64bb503a2c04bd539b64fb6d739e1438998365263e24b78e606a1b8569ec79a50e32b0feaa49a2a20da55ee74435dd27879840186fd19d9f17cfec35648a6dac0ebf5254277fea7d6f26b33919fd0d82dbfc9708b0efa9a425d3cc07d19545f8e7debdd14908b7f8dd325fb17bca7631ea16a2b89f4f6f89733a42e5c173b78084dceb792d7ea433759f6b1f2a9d113ef2d237ae565cde9e89c2acffdc6b76cc892e31eaec34109b26223619c89f621bd152011d4ce034ba9b3385e01fccb65f5d7feaaf0324f7892b1ece3b9525f4863943543e216df621e87b8a6f7a96362625fa95113d7fa9274e72f6567c4e3d5ade23254122dda75fa1fa74d568cce5f681737656a0c22fddbc0638919473b4c7ce6b4f61001b745c395ef07519301f438429530a794551c1f2670a462ebe9ebc807cc999342838e4a75f7f614e3e0d37a2199d563163b06b4d6fe9c682cb36c868e130a741f8c31e5c81491077ab46c0702a616f4e22a4744c4a7b06246257bcee334109290cb27577f6b27bef538a636569322302de17257ade90cdb28bb594dbb264037e0962467d1470018766377c4a9e06127bc7b719781f01485b031e9656f214888f1a9da31261317447f302c8a9e18330f4b058b202a29cbc2f7f7f0d70a0f6a5f891ad3d4d7a5ba89042d6b24a09e3b0f23f21c8bb7e720a74dddaa9bb3cf37b64b779499d9744022d07e3ae47ebae3c305c6c22983ba90fa6df24958fbfd3743169318557164235efbea133c8d38388534f860d2174a33d0eaa850da6caa085367c9200ff31efc2c3849dfe16592ae2f283aea6a8e1cd07efe05eb3e3c5b1dceb0fba6479cbe61ad106ab9b83b81b5cacff4b5f8358eebdaf8be4df43d5519f9406b105de67cfe4f39e0765ee9e31eb53cbaec01bd5ddf6b1cc7b11fba581a1f59f7d2ef56613f4582037c3532e078c836885d16c304d8aff95e81379e2a6b601246bdcec4426d2dea1fc067413c45e9146127ad57213ad3fbd25ecde4c9922806439ccec44875d30e70003e95c1a24239dc422ddb9998545a281c98581b73a0cd1ddaa8a677e4e75ebaa63d8ec27dfb075529f6bd4b10da19022b4014908fb1c641708551d1bc8dc5c3e82147a6fd69829f35da32551d85ae345da761c12a4f64a706f89ace41dd345d1aa073cdcdd04e0a4e073f6876c1100df7c213c9b4cbf9ae250a01db735d4d5d6df275a1b519f1bec776bb25d7b8d86cd7906d21a1c78205b85be73cd08eececf690997e0cae5e5c7a36de8adfea3915b88e2b83766138cb0561f9a372c35be041e2a99fcb304a50acb9ede2d96c08fe8a0a583d648844787e253b641c5354555593eda52f5d8a698b727684b4b35355dea39b61ded6a43bb8a7188ed0200c9208a5511709c019789b4ab7c1239e9e67bdcb54d5f992c86e342364dbb21eb7d1ecc678b933201c4ea56ca8cb0da5294820056ec75b6fa4d1965019d49f800a359cc968479fdac751619aaf1da4b485b6aae220b1f6767456741d7fecee21a31968fe459cd05e417122ceefbb758fbadee8de7fbb741957e2a4178b7f9b573f4af2767d078cba92bbc7a8b492c5d14f86a669fface4dbbd1a0448dade74c392fb9964d895b6e6bff2e7df961b1dbb373dc7633a91c174677e6c7d45cab7183419072e10d9a2ae9c2325837eca1270c9371e8e3db75e8c2bf0a849684f9fe9c6b2a6b59c1e08247d0a60a3a4173f1511925992e8f7ae6fb8aac771ef64d3eea3d9b4c886ba171b91803d6604e7f9ecf7cdb1c30d7b2653b7fc67f1abe716b5921aace0abcd9e301b257507284d8bab6d49097ae0e4195576ca1d79af15f8e7b4e9af7141b4a06fc0dc8efd7154a88b6269037192fa7fa61e641035e314f0a32485e530a3d2f43052c6744fa718313859cfb1b109c94d9d6c2c19d936c4a2d44a511c67a0eda67b7e71e951529c59a4596a9b07070cc942fc0341298a71208ba537a7ee00ed16777af2f4469df8542307e0a2fb35f2e51b8dc6eb72ade7f8421841de3b2108721f7ea5859bd5cc8bc7162beb1ae7c5959c4cb12d375ef2275fce3729942ff2d1504ae377636f30087856ae5303e74de58a3a355657e074a61bf20822f310f595fccc32d195fccf5f0d045c57e04bfd2b5fd696e2370977bb45cd49a05b52d8ab70b464a655e485531fa42c25052e0055d2a8994aa06b44a0d000b2dcf7201041a3cf023c83fe63d94c3d938d4ad3109b54ab8973977c4184b52d6b1e64989cba892eb9aec7f716b39f1ad2413a16ad65cc9e86e9e92b5926f91a46863a6a4cf959dc1188b2944469cc1c6a568b3efc4d5b5d04d20325f22c63e9e623f34ea6e780946dade0373f25a6424019d8a007638acdef0074237c2a074c60eee8980641268cb085db2e2367a320f1104df6a511c9f212cd011b6123cb1208a25822648028581469d1da24c366e664a1293114de9e6a4f2c5231e4039b63e0032b99ae24a57d1214fc72fe3fdd59b96b6d84e26a0d7b38a02760b3d783260b8a68b9ee9bb772fc2a60f12be8847cebc7ee12b154c7716cae1ea5746f19d24ae1c1132624d2ed193ceec7aa59b2626a55c5eece700a4e86842bf8c2427d15f25c0404ea2c2cd4e8ef888f763e8c72df3e1bdfbef0727586bb5abf1ddc45a9b7c2fd07a4dd80e2138e1236a704843223c1772e83a26013f98b37c89d2c1ea5cbdba83fef5c1e27dbf24357de7d8ecced67c6fdbe4cf5f4b49390f537e25a3c2780cdaba447c651423eb78c64b483c6fe11f8a1d5a3bd529689cc9fc0f7b1f44d68c12b9d20903bdb742fad75157d25ad1fa964ebb78c3b994df452fab0789e8e52b216578c49815e95ca4a96070b8c06eb492e8eb9a26c6884c2d46b40482f27f49c65f6f1e8b2f0c485e3fc7afdbf0126623e4f7ae87890337953187bb6bba67ff7e0f4019fbae8c01d4eadecc5b8354ed90f08a06f1833612d637dc64bba955d66bb84cb3c3d202c80eb47df56d96dd2a801203a02c3c71ff8f03abbfbc6233a80e48b3fb4d71bdc9fd0022d7071debce10d6d87861a3cc3f956d78715371f1ae18760376172507d899b91d969b23316aeb8cb43f797ab737e94dc83aaf9db520053b8376bbfa37c9ab7a8c6fd3c7d61977b0160d64d3b3b6a10a35dceca4d288c359b3f8fcedb591e00f98d142c5ac8a7bd78f87d951deeaa11d9d90f6359a05e404c7c5be9e979852378a0f2b8b86702b989d24a3881d2b946749d537c7aef834f6fb54662f233a2e64c0e71494f65eb3187c0f3fb8001eff707c78cf6516958d6be77d30ce2721dae268f521b6cdfb10cbf826beee73b01f1524950b5cb60e87733ae2d712d2fd42b934b100525f2e24925923664dd479d34c2db056253d68c86ace7ad0efe381114e8bf38d79e014d324952b111852a72144f2c0fcb539fd0173230649f572b9b93a089f97f8ce509bff76a85e7f67c664bee1eff5c0e472b98e4f828d08723f2f4c359068a27e731bf542abcf26afe3ba883fe70a4ff7a693c588252f9cb4d621115279ff28bb4471fe80b43794a1321bb3d1832e007f3089709871059976136789f6895fcdb109e1c8d3261008d7a7ebd15d2dd1a398602a6f140239c77495f2e0af864419e639168f32d07dcecbed373ddfe02beb20091886227fcdf7fafbf551c84ed3a160ace348e3ab36c4ad6c5085eaf2de07e1ee608890903ca74b18598086dd557a1148f6720e61a9605e0044f6bdb6a3809b268e94b0e453739633b99bfb09a0698c604dc0185504d32779b39909f7aef5785e23133d91d99d1a279200104e4351a3caed8b79148a7f0748f0969fc448edcf3908e7b3397b6147767be2b34f85d3ea6484bc2e7cbeff080242db0cf2f29b4a8dbccff0901d8df0ade3dd5f4704f51e077c6c3deac9fcdc4a439982a6ebf0d7d4bb747498d93e6d3aec38496ca75f6b6bbd3db012ecbcd15f6130c4a52614edb745643f8f2148d18222774030f5a7bc1011417d78d6ec7d15a027bd9b2a17a1aa93c9872ebe3360abfcd00f22a5d8769be0a70efbd0abe19c1893e1bf846da644b0ab0da149cd5c00a4db94157e65770c86fead33195ad3e07fa255bda40472463ff2c67490cc9a8c6404ddd24a9ade4f3f0aa3ef9c539295a43513cb6eb6fe19cb353d49232bf4015c1c8f2bad7bf1892a1c3afc804d4d393db6951cabf95f2a3d276e50275d7d490124489f17a81bf4cb610b1a874fda1ac2a8920a74c23cb3ce5237fe6ca2801950cece9a6cd2b01eb151fa02a9703512f1d69d5bfd3ef21f7aa07386df3bb596844c38199fb94072d4311dd3184105d1f8cd283f2d8bd124fa0dc03e1a5efc00ac97c02c47a58809ac88100eb6d02b8b0a615e4a7fec4e50d59a67ad158bc39f26f3a1bcc4e65c12a8147ebec35f657b5ece543d222508000c7819139547be910001003577870d84d11eaa217547d1010866b917c5a17c9b01e7fa8defc5c02f2999d68a3d89d571c244425bbad2ca44e409bd6aa4f7d6618a70e7974e88e66d84e76cce63e261aee0740dd0974586460e6e328f6a5211baac77a3cb66a7bac393eb96bc42569d4b8817b0855dc140bfdbec20b2cfaa887c465e8e1d8393b5beb2337301238974e7a83bd2931b33b35a000000a00000809c000640c7120224e1aca008e0abf3b5fe06e784a52c231181076ff3495a886b98345fb881b4ac1dad1318ef56e1298a7e3d22603edbb98ab2c8923344d99d192d9ba67e0e686aa963409ef4cbbd128430a9f1d50638a9998cad9cbb17871cac58fd309952b4a83bfb9d8d90c63dbc8b05d066a72079eab443557bedbdec4c13f3667ba497bf1131fe0e7627d7e3fa14d8d478a290ed7dcb54b17834c8000080a6000640d9668ae13406849fe45d5b1cc834661bc72c08551213148d6f50294169d13b201b5b8dd3aa9bf150bfeec6d276abe64a0f8137ef0802814864c018e44b12c2c61e922686ff020fb42c6ce2b121b327c8c98920ea721aeebfb230cb67c794774f428674f9816e5cf06deb6322edfdd57ea81ecfdb0cca45071944dc5b833085ca74c328292263bfaa65a2f2e80f7a7b2947b792704fcbbea91928f621be3cb10daa530000080003400000000108000340000000000900090073797a3200000000600000800900090073797a320000000048000280400002800900020073797a320000000008000180fffffffd08000180fffffffc0900020073797a320000000008000180fffffffe0900020073797a310000000004000280080003400000000004040080b8020280100002800900020073797a3200000000c50001003c6c1573a957c22c92d7f20ba902749e1edd06ab274f902af6d8713f9d537a00a999954db1f5ef4d547c9d9f263d9cff0c1abd5eb1b90363d37f169de48f2e8995b8991193b48c1d6367919031f562b9457145a660e3dbf9cdeb3bf0c431106ba33039dc7a2a9394d940a55155fa893cf2ef0bd427e3dbb64de3d579a83f863697cc7209e77346a9136862212fa04af004b47d64f2caa839366917b33d24245183b63f3d8afb8076c592b35e7c39c8c40b420d42ecdf8e1c215e375e2af67041a0000000680002800900020073797a31000000000900020073797a31000000000900020073797a30000000000900020073797a32000000000900020073797a30000000000900020073797a310000000008000180fffffffd08000180fffffffc0900020073797a31000000007a000100ee4e71b46e27908ccb702e12a02a7a61f75229e9e0c75bcff6fde534928b21a57c56c0b66d35088396af95bcce9ab91cae67c561c25507080361e2ecedc868a76d3a2d3619eb84639f54243f0464b706da6fdfc71a4982bd8f9eabcc52a91641757b0b8fd7cce7e2dd088117a7d37652c3936bfac2fc0000f6000100d61cbcc11db442329249206449133d50c0dccb2d840c157491d9c28010ef1b82a6fd8a237b76cf29408c1cec0bf8e1cfbaa625349fccadfef6cffb4a4c346fabdc549ef7057519ec603871583f02b732d620c8c72ab28575e04823d00c4e93b6a959e6b0a392f1c2355761d43b856db7e956c21b950c50aff7297822c7ca846fca2e2295bf9db3c65c25653abac5cf83c87616857d9d478f101f12ed53c8e178baca8e1178c0d5b8237002685ad3e3b64ff56bffc4e2dbb7cdf5e5f3b8a9ac4eb5c03d942e09dcfd6a7c93d4a324fa417ae8131f59107856b82f8f1daeb7e076e5edb8784246855271710baf4f6791b77554000078000a80240002800900020073797a320000000008000180000000000900020073797a310000000017000100b9bbce3872a0e34b4c8337c929da354f0b54c200380002800900020073797a32000000000900020073797a32000000000900020073797a3000000000080001800000000008000180ffffffffc400064000d6dedbeaf580ed13441328a523d730da15a7fe5ef6248e5d538ecde475b0b4e549a4d6b5581055b4ff009a0ba49d20f40d7b149f4c4c8d39f2a9eee85a7ee3ec03f7e6a101aaf6b23cb3815b18fd2daebfe75826ecb7e911ae6ef215d8d8d7f30be5c7afc933f3d30a9cf88c6dcc74df6888e53097f19ca9810b25a42a78350c7d198790ba4e0579c7b1bf5e2a91a7946e5e026ecac4e67e49bb5b8eddca81a1604eafcb6c30651acc4102ad359b234296fa990b1f09efecc0abf4c16e73470c00044000000000000000032800008008000340000000010900090073797a30000000000c0004400000000100000000040007800900020073797a32000000000800044000000003d0370380dc1900800c000440000000000000086f88020a802c00028008000180fffffffd0900020073797a30000000000900020073797a300000000008000180fffffffc640002800900020073797a31000000000900020073797a310000000008000180fffffffb08000180fffffffc08000180fffffffe0900020073797a31000000000900020073797a300000000008000180fffffffe08000180ffffffff08000180fffffffbfd00010024b5cba2841ef18146e8c522a3d3f0299a42632e13d8244480ab2ade026c852ead5a1eaaf4dba0b55ad50691370e246f56854b2f72c770a12453d61c359bd590ebeb19ae96bf7ce6d7d6e4d2b3639d6ebd280899034506b9bf2966a28764130e1590f614a114376e5228bb1c865da4b9d2ed1bf765982b48f476317d3a545c1146b928727f3c28412c34bb9f84e0fb98fdc4d5f4803bd74cfc7781738eaf3931f498c49678663402cd0b5e84b8e02665bea9e817fa0567b09c72fdce00b6183eababf312b4d60c08fb0c7549e8a603c6bf07447daa19ebe7d7c364bfc46183fd1707311566e5f1dca8014f424d3b165b4325e9f675e5082f3a000000f4000100f05e74cbd4b171e16af640694aceeb7c1c1a18c347b7246b3d0f7fda6f108c2d6f0c86455a14b4dacf3a33e8de5f5e84825c5c1906031bc8589f6c8374834ce7fc474a9130f62190a394f85e7315c108a105cb54a293c6566d838157f0f8578d15a3caa62220930055bf38f11862e68fa5b5aaff55170fdffb55d1717777143a6e3a734e69a730055cae0f42727fe889f7358950230c8a5c313018f46694464f6ee05932ecf15dfc97370b2a4363a283503ff51a7fbd6f62a38e59740c70903b2e93fd963efcbda76c6f0dfd01c380465d120076d1e8734c899c3d7e7c8e06e212a1651182f8ce5cb6b05e9f22cfd51e0c00044000000000000000ff04100640cb2d21805a72e5a2dfbf60bf63e84810e539f4fef662bbd712565661d8f174e13205619871b6806cb4186634e333ca43114156706fc7db69577dd2e471cf56abd3a0180dc62af0d1a102f0c4f6767e77244db950c21b0ddf2d3e4b94bb2d57d16dd8c084489d5549a3fbc4e880275707f8b9fb45d88000ea16f384e7153dffd454f331b7c539d15b63a8869b8491f485a2c03018d12aaf852b780e557874e34e37e7e28871340715eba7ca31b50c96e8f23532f717bcc19eadb2a877b099e0350abb94f4ddb5cb4a75fa6a14490d1caef5fbd728069ce2a18b37551f918c173a72f50e10b478bd57dd035d899edfd6765991bed01a592d32d12ed20907139b718c3d3045f8df254d63eed8c6eedc34dc67c6328931f6e5e370e07679fe0e933c239a100107f16f3121fafc5a2797f9b85fdc1f4d804979e52b7879e931fb3bfb597826484c17c92baca4b9e940b4f540a14885203d00eadb92a366e0b554ea4a4cd6bf9abbb85b7629fc29c8b0d6461a1824fd2cc2571d30b9b387f1588cae9d620d6ed51413b4e9c97651096a719919da580ef91064a554d0e7f56d98cbdb85b698e1c0bb66220ef8413a16f77e3f37f0caae39f5f5b55e05e3ff574758d63d0b13c9324cd6f4b2b60f99371c6643df8b22ca74f032873dc1ed0fa48384816a189c2cdc84b5ab25130b1fde17c615675e7e806a41e491b1be714aacf87e3908634aefbb675164577634d056594609b5f14aac93e98738995ad47e13f481d9ca1a6483daf5a004e2e43460bcd6100f090d0b0d5c8aa32fedaeaf00df6cc9fd0a3b57aa7b0330a71907fb4e98ecdff0ffc56b6e38613cf7ff234c2dd7733404c16dc2c9df9323a3ca9bf363c9c8fd64d08340d4b5fd76906dcc805d02b924b878207abd6ee243c3d1481fe86a2522d0c0deb97edd9df07d0b679b5ac2d9c11c6cb9f266d52400364657c0abebe3174300d26fe9a4dcc8454f4c44d5f5444e4fad10b04ff6d74a3e585acacc7f7f9f60cff60658a1b34dc10aa63bf7ae741c3a98d3bcda90adc18eeae5478993367809232b48b4fe06343ad79d21609853fa144c4f4107f19e49fa7c5988a3ffb98f672b3e9542067728f0110a1eac80ef397c1471863e8949b4d1ae94c4e9c8211130cec6f18d8a76d8418f1a3a53f248ed4a81ff1b1cc2d448fb0cf10b399fbf4340579cf928c5d430637947da0555ab87517c3cf6b06618868a5bedfb121bb4a8106b87a04cfad6780614aa116c61d85c39886a9341dca76ca8b167c8da859ab2dc17553fc73db75b28ef4ac1081965601e2a380501cbf5661b29b020849a77ce01bdb53f13a3d60fdcc8eabda16040ce628fd6920aa45c373f6f4b760c85cc8a6967d20ddd124df47af70ce1bc240c2e3cc2dd65db6db467368a80f745621f0d3615f0e2b6eaf453165fd1dbb5225e12fdc0bc0d09706428433318d738581793320417fd7afce753a8006058e0ea5890cc723e07c78edd6bdba621a355c9e7331907363cfa2fbcd0f1939ba3696d4ca37b486bf2cd113f22fd559a3a196ab85e55a8007f865ea765f9b97e3bb8311ef84ca3a18cb48f173988d9ae17305e9cb53d42c7e88a9aed5020e42f6c0f079d8e722bcf0b7b429bda5bea480bce4271e766479478f0cc7fd65a576068a8464e97bd186f00bbca6e5f7430ea9959f5f85660e395a63e6307ec653e76ddf7f8cf7b8f6f807e1ea6c679d977bb4d876a5da49ee5d0ab47081beca50befa978c6aa840389e2907cbf5510c6c216f44be147ddee1b7b5b42795d31729d25daba1e233c79ef0856b7dbea2a9a6d1f7cc79839a112d030a5b1e639aa788f77edcd7ca6664042b566f3514725ab02ca2cd85f89b85fc37997a87adc9e7581e21952c9e522ccecc410cca8f14bbbd7db25369fe556c6a69120f1d44679f99b76fbd36c64ccaba4e9087125a8a1e25341213a71c186248a39e4932cb7074a92f85a98209819c9afc90672d34ebfffb4a919343118cd5d381d5c95f11add6a76259bfd172fbb696563b03ac4147be24b629a07688a8eee5a1198c590fad2d8bb0aefef057d4ad39cda460d56e99148533a88f9aba0e0e61610cc79f41fcc8e838827ae60c6972c08791287ee74c49e0cd4c92e1278869c58c9a9cd341b7eff10841f0db142650727217d2638df785b23beaa7531ec25fa2e2e1bf98eeac7f3842bc1dd07669b31e9623a4a0e1e7819c4058473990710ce135092784046c21db7e38651e48dc67b3c2955045de11229f679277b72d71b37bccf7afbc1fb08aa8cb3904794b2e31683b49b9055fc89ad1172af53ea0096d1c2a16405587850a142ab210c92018ef963920073709792ae6c364d237f54b12000ecc3352ea340529b57128681d49315c82bea6ed513183304b03e06b57585646ae4e90fe22a0e3460871bcc2660d63190e6c627ddc982ab86d33b4e8bbbbb8d9a8564e0fba70a7678bf4a8f973a130bb6218b0f15cf7ab7d68e566a20482cdfc0816ade07c4cf1bff757c107da9369f0c5884743c938faeeaaade140608a2499dce5fe02e2545b7d201b5a344ad7c957aad4dc2c008c33eafd2b22b3bac05810195aa4265fbc383086d7e4a1d1d0a9ab1a3cd52ce510c8534ac2f6799c17ce1f7986bce618f54b04ed033469fae510b3f138655e5eb9575c9097a298036c5b346286581ca00751924ff3f2bfa5140d9872995b64d7d24536b6f8381964b615272fa3a7b4f0f0d149186881708a2209ee510b86b277a5e172ec08db26cd79b3aa6e81cbeb54f0cb3aa0084ab6b8220294e72560fb7830c617582c18d8dac85616b747af2dfe41415a3e06c5ce6a5846a56a0f7372ebaa6be1f91f37ba864974c2813b77d29f339f1dc728b6d9adcb1924271bb2ef382a71b7d997de59a0b9890b0a41e146f0e6c4bb9da99e49250db3f23e3dbb6cac06d98f15afa6144249493a5472742e18c9647c7d68112f1d2d90efb141d98b72999d058d19c90c3a4b963635a71016d4c511d0a53bae1aafec9a40274bfa4aed9eb786ef9466533c4a8803a5b0d1540acdf1aa18be6818f1c68af168173739f4319391fa872d9330a1f54291aa1d6fc0f9bdc37f1c0680f5cc69e7bc7ff985d6138038db902faef24d9dd6d5f0b79672f24ebcabe0722644fed1eee427972bb3ffc1e2559536eab0154e3cbb377ae8708254e0d978e548e1ca5e8f36ce7eb8a7293814bf104ecb198c685561ad626db6f0d4115321874503b7a5f7713828c9141263ea21b7841e31f411c772c819e5902b607a29965a345713d287777cbfbdef2baf21ff528259f4ddd76c487c4d65dd436e5583bea929b57304ab531563d115c436cd51e41a15a1eb29a8f65f2245d87449845d4e21939f943c6bce8cead95fdfb3cc7e968c0e94d4866726255edc9f491bd79249c8b13af59232e871dcd1d03eb8eed53b6212e959e6a44c0c4d96e62c721a79df38ff63da5d0f7f66c70270995cf8867595a298b3ebd36e7966027b21287d4c1ffa1a9403019f1f4b5f165fca5eef444e788592903344754c344723058201d65854ec0ecdbdc0c606ac42cac5b91bd9018259ff06e17e32ee736fa97862407d3090c8ed137ab950f86fda03a863b02a2e4844ceb76214894d237dc9ef5d13f26c6e3c304498f8ecd3b382165632c896426f34fcbd2a89df16aabe0f2075ed38b520fca24b73416bcbff391049356774bb792f633a4585e6dae80314b4d20de618cdb7e0cb0f40b4a94e6a704a2c231c2b97c25d18af46adbfd3ebc0148b41760cdfa11c58c6b494e1820ad368d82187486e0b0a743ff6a55caff5ab34ab2656e66a8f407a39a7e61597b0307331ff3442db633b0a1082b69f8dabc7926a02242480458f3304132f58b443a132a81801a26336651c06b74fe09f59e44174679dbc677a5c1d919b5bac762878b6a78c98f3eb859e04005f6ad3766d4c78893837ef82782658ee9dfe2c64598339b13dd09cef83167afa40ba189ed2cc42650fa09c549d43a096563c2078d76d8bc1b2a929572e518e71443067cc34147b471c318b8b50ff5b3c61484dcf41d7374524fd77703a890a90e4eede29a629e45a8888fc007ce70921c6ce0f93fc2578aef3b57a36ffabf2827218de9ede85d0c445c9765ffee63fa026b35d6db3076f467aa3f866d47ef3b51f30d2575f5e41ce5bd03062238e0f2f830c193dc5b9d2020d1a610c1c6a6a132007086b60248a078f3d55e67b077765df0fa178dd7b7b6ed898b033251a159a2a487e35439cbd0a3a51da639e3c075eff391cc26f98ad304992ffdf40c442b1dda799336c54ead1215bc1f35f6feb138fc631e5f6f6a9611fadcd822b3c023c5d07642eef7abba6fd5ddab77396280a099c093efead1b31b95e1921e73d76e50b926067abecff9d980b0e1555ec0f4f375adcba96f9dd87202db3d57a57d0c96f4fcbbd78ca3987b2658e405d5df3c3f1dd4ea83d5e8d9474b6d140cf24592dbb03e18d6ddb729c915023a6674434eb7f55dc50b534c8a96a8828bb5cac10b97f3d5e1b7ce37d4c8f2fd4f5092ff23520db200b67a883b93317595fc55dc395065de41c427a8befe825d818ecd779bad7d95572dbba40bd23bad5283393a6be038ed38d38f1f6ccd4e578614f7de0ca3f0bca8908bc64de8172bfe56e126bfe044bd9126da433d387300d8f1fcb0dea97e33f5963ef96da056427353e59706dca2f43edad8960ab95442e13116e30255ba5bba7d02222c3b8afb1011c9f9cdf59ea3b6323301172cf65c5937df4cf0240b81898d062947c269bf683a359fc6eba1ac13a070f8305bf0fb03c0bd3466ec78bb42540a27b77685f451166c848447e1a6c21748fb39d35110b6e847fcaaf59db8cc8fae99d2535cab751f7f5b5892be7120075207bd4daf60379aaa7e87201cd0cafe2b428a249f6a01f8e13b0d7240f04d6254bf30c423f17c646de8f8a6315f1e031cb198fa5625cd7c4df69ebc3a66833f8bc7e96769a1ad40e7333dd6160fc9684a8487170dd4c4ce04333000b115329d75a7ab0bec1e4e3637d31fefa1d899ecc4fa640edf84c19e989de2df1a05eaf8dfde716176b5aa23ca5bf5f7d7b98215928e839445577433d26f85a6dd9daff448d2c6d1593035f3d13ee8c0876bc9afbc0706b15cf451667b0b69ca9e9eb84fdcb33b5d7f89f45f38e6d8c24fbf0b830a070a2a38c91db681e0f93662bbaa3affc5978c53306b8a78ed251d087595ace9fb16cfb5e32e29bfb54d641ca4328a5fa77353033d00d4e0734ecd3f891a90a42b79bf29edb8dd18b7157c1dd7a756a2c4beb07d846fd6d71d7b2b472a74234b2e077b3137fe6faaffc3a9e44a35fbbb457baefd908c41bf9cae931a0071d68b155e92e9f4567802f3cb30acf7c797a01e4c7a145c2556cd28863eb2b2ccac25b13bdc81811ba313712485cee29cc19582f9e66c60138f15334a5f747132a59deab0ad0fc839e35e353c2de5108c1235ff5cd2ebcb6c6c11df137663852e3bba96bbdefd5787161a901e2d7d1892a4f3f93f7ab134e54d165ab4e8fe9335f648495492a0f2dcdaf73ec37ab78d9ae41915c15e6d19fb339a8335b4921d38ac5c2c0121886441348446e2c4c0bea7c9ad01270d2c0f1b0e75b0da58e6a63138b4a66add126c773674a65ef07a53298b89d5866aba2cad75117fa48e375f2cb27e5a3a43a5ce9adc5b5c645dd20942bc1e8402598ce720456b55f56062b0d9e4958d98d75972b00b9d182e6c053b07c4dd49630df3218f01f68913e7010c0101805000028008000180ffffffff0900020073797a310000000008000180fffffffc08000180fffffffd0900020073797a300000000008000180fffffffd0900020073797a300000000008000180000000001c0002800900020073797a32000000000900020073797a31000000009a00010022a4e266a2a7fc4c8dbfea3980bf051704569e58081efe73d37debf939cfede88b14d5baabca474a16a635ec369b343aa22c739da907b6e24dcea3202a12524211817f22fe5a52be5713726d066a2f8a6e64d1b4b284017e769619de7a78f79ef50eecf004e96607ccaf1d4c69aeaf85d7349393ffbf34d8e32e550bb60649e1992c7715e78d73115812ca81796dd268b52bb73554b80000080003400000000064020a805e00010046917febe56ef620cbacef57088cfaabfea7b80b0530bfa8cc98b698dbc06f53ed2c240e06e1f1a323604f74d2a696cd6c90884eb6fca01ae7a2fdeedc7ae0977b9cfd34480a8437ce3dd3cb193a0fa5350b13e2ccb84a0446190000d100010006679926809276584348551d43232917efa1310ebe4ea2a2d89ad9973e747f1102e8b13558ae411f8e28ff8667ba93802d75dc72191babc04dd72ccf6f94d3234e5fadb6978e98807dcb183a00fbb1dad571a4919a8482c12e625e112e64b8e6cc8df1cec7790b2d953e584082a4dc42e1c3eee0c7213b4969f04955f26dd92f0c7db18bbf4824828ef55879366ff1b545dc59ad453a2c7a31632cdf4280c858c98590d610a0b736cdf0dff6e6f3098c90ba38dedc60c120ab558175c2c3b9a72010265c993c90eb5b4af2f0db0000008c000100896bd8ea335f42e552ce5e8db613d7c535ec90a218b52ca14d458cfbac8636d90c5b9ea62b9527cacd2e40f7204438cf1b421ad4994333edaf938b7aaf9eca7c112010a07bad4964a33a895a4bc756e749ae5c72889da1ba1ea6f2ddfcaf50a0b6779ca14511e8c556ca2497e494433817446d94eea18d7a2324ba2560319e000100bfaa2450a09c8718cdba66302cd88b64b7862b9db46197426af8030acaeef3e916af257bfb5bdd76dd8ef25ca94f26feaf9edc9d118a35040d1856d3892d49c9b8495f1774c59ade0317df6343ff3eefe2640b4e073fad45b9e0e3e04cfad53cad07a18c8be598543fe98035f69b9dd5761bdd63e31e2917d360d97e4f92e71dfaca02f73d40a05f17773a0a0b189d960f909f8fb4ade9b28b850000a40301809c0001006e1138ea038fc2d3b75a465e379a588976fbd8adb920f93f6f2f47f9a74915de52b6ecca24707012df8da129ca644604bd222b5839a4d0c7e12af970bde5ac3f56742fb0c8c88ab05bada8b427dda10f5b113e8dc7ca6ffee44bd52d152220f17c67037a7d75de0c1537e0cbce6973f3427421f164f9dbaf3eda7416eddedadfd4efc041f060be9d4b1c68c689c94027bca9b4a3acfe872f240002800900020073797a32000000000900020073797a300000000008000180000000000c00028008000180ffffffffd8000100eb9df96287bd8fdb992a8ecec2c7d54f899e94dbee0e26a81b8701db258766ad1f704c96497005d8c376a70f3d23b772038cf6b9bad263e22327e5a04047eb7ad991826c053c6721ed5a00e0fa5cb81966b960c6527c7ad86a6dbbd1d7e874d246cb9e94a187499f78cf8312220012b2f9d21cf2cffec9f26587a7797cf47ebd9f5beeffdabd588443ae9d5e33f1cb5220b5e6a1d4e64f01d83ddbf1abd050523183c696e6b219b8e4186002d1b37df617a245fa86ff1cb5b28e15320cae7c9dc0e9484c43890cb06311b7a7fd80d1b2ec6f91917d000100af4e200b4c548d48e6e415cb9c608d2739e15990f0b86833d72a179ac3fdc266919a8580204ec2b8a244731ca78f82510c4ee0e5f2763fe4a1042d76b078f2484f0aca1ea44c2c1791f0843d352457b9639fedb0bc6aba38c61f1f77bace910dd6bf8403be96761b6c5afcb91153c4873234a87ff53033b975000000d2000100f5fc8c6ce0f50d594f3a95bdee194f4e854a1eb5f6128ca5a6a51de4336f669a42d27a5063a072c9700c27fee89c6002f526372e29dd3048256c21d96af07aa6484938f7a102033c2444a9748c40966010d7337b22cb2900eaa3bfd555e160b18c6176e1246a69c03c12b60c658cbddf7cf25c37cad0a8f5f98d191324b4052021f763e654f50162b4371c4271e3e2a08957505e7b1c8ae1541356e2f917718da24959d2d5f8f433e6a8b6372cd2a4c990cf058ec8f5424027b17df3b1f71ca57030e62db4d5b2b82f455fa278920000640002800900020073797a310000000008000180fffffffd08000180fffffffe08000180fffffffb0900020073797a32000000000900020073797a31000000000900020073797a310000000008000180fffffffb080001800000000008000180fffffffd2000028008000180fffffffe0900020073797a310000000008000180fffffffd240002800900020073797a32000000000900020073797a320000000008000180fffffffb0c000440000000000000003f0c0005400000000000000008440500800c000440000000000000000728010a80fa0001006e51b5877003e4f867d66ba9f7b3bd802b55b1a616b748550c029173bc207c7b0320aecd4e0ea8ebfa08fcb1fb89eea51a0d50cc0f9678e02fb553e28532dfc3dcb30b65b52b8973f40700615b2d5d172e66ff66c12149c15b96dc64f492eeca319c7dda54a2d6bd2be4bcb168e1099f475fc53820f15f2d69b468803cdccd76773b7909ba7474ced4cd1eb5072e40c3939c815492c66e314a73d0c0cef31e678eddf88e5c963ddeb065d908edee3bee4e2062865d69c3115d6548b79c40b201d6135b9e4cbf6b1b26800bb58e46b91c3ee67549d771382e4a7170e45ad4d13395248abd14b9f733a8853f3eb2314e3a97a52e7c9ab90000280002800900020073797a32000000000900020073797a32000000000900020073797a30000000000900090073797a300000000084010180d5000100c7e64f3ffcf577cc58b5e33bfcf2c9984327d3cdf8b0f626ecd8cd39b267c14fea5c6387eb64863f77ba8d4ca92fed954211c101243cfba684b35bafb8a28619bc05827c25c1fe825c00c976596503cd7abf057eea3e29adb808bca9b62da024fb2e3f0b2b63711d57ba6b079a156495860c4acdabd2043f30bc4ae125f2c286c53a5b785e26f14872330cc20bced3c206e9004b05af9815a5517e35ac56fe014194d8acdc0ac3ced9200e60bbddb6e0dfbef378326d5a910b1770d6201c924d05e8e904f970ab1c395617058d354e914d0000008a000100d754096902e41fd78c1b73150292bee0b3485f798bf6884a4c85e962d1ee124df8bdba6461fd0ffe8f9410bd427dd23e3e3ce6a99b28e264135da6bbf668418b2688c27280269318b8fcee2befafa7cce71affcc6cb9f7afe044438c982670da7a16daf66a7b8be4c3ed345649f8938db12ef5b73fa82079f1c2b3b93ffc5016b02872b712cb00001c00028008000180fffffffb08000180fffffffd08000180fffffffc0c0004400000000000000003640101802c00028008000180fffffffb0900020073797a320000000008000180fffffffc0900020073797a320000000058000100f3d73abbb3aa76e24b24698907fa126d8e24911e611c9ac0eeaaa9d39ac58be5a5f5eab0030d162ac78d0d2c70cc1c8536d7a91e521c0fd01e266f7e66b1a0a6e09585b195096250f1e0df4239a6c93d9d53ed933800028008000180fffffffc0900020073797a31000000000900020073797a300000000008000180fffffffe0900020073797a30000000005400028008000180fffffffb0900020073797a30000000000900020073797a300000000008000180fffffffb0900020073797a310000000008000180ffffffff08000180ffffffff0900020073797a3000000000500002800900020073797a31000000000900020073797a320000000008000180fffffffd0900020073797a30000000000900020073797a30000000000900020073797a320000000008000180ffffffff0c000440fffffffffffffff7080003400000000104000780f4000a802000028008000180fffffffd08000180fffffffc0900020073797a31000000000c00028008000180fffffffd5c00028008000180ffffffff08000180fffffffe08000180ffffffff0900020073797a310000000008000180fffffffd08000180fffffffd0900020073797a30000000000900020073797a30000000000900020073797a31000000000e0001009f18e5171804a1f1aa6e0000580002800900020073797a320000000008000180fffffffc08000180fffffffc0900020073797a30000000000900020073797a32000000000900020073797a30000000000900020073797a310000000008000180fffffffe401100800800034000000000080003400000000028110a804e0001007cb4f9c17b37456385d2a5146db19bc272e22e85f7994b431f8205f7f43e5dff79403dc1efccf56a81a999de903e375ca98a7513241d751550af74558d165e0a3511395bb730d22da22000006000028008000180fffffffe08000180fffffffb080001800000000008000180fffffffb08000180fffffffd0900020073797a32000000000900020073797a32000000000900020073797a300000000008000180fffffffd08000180ffffffff3000010000eff54ced8690d6bf74a30958eedef63648bf27254fbdc03756bd017b8c398d2e3c6cc0f37ff50e3df13d2d041001003c241bde02dc076d1879dd7892c73ea420241596cfdd787c0c9c2fe9554dfbe27bfb2264265d8087066220315a5cd67e42ac4140a45f7443a8ba612ef9cdfa3ce303e3dd1632e19d1943151abb6d5e915370b051d6da2c93945fe18b2222b0d55c8ba186b8b330a4075e37df0dfbffa4430a5d8f0a10d0da8a1928e26569d8c6a64bfede905cd7290bac47b39d6c9efba4db8e69bed35d756b2fce3c08fc24c58e56182ed4fe89f3cd6ce28fa311c89cfc5f628f9bc3982bef25ec6ebb30ceead9b36fbb6e206d843c275d97bda6858329b422398964c39d41d4334c7af00690d49bfdc5ee0c85abd2287ea9a8b37796c64e4f795a58713fa92517fb4376a1ff20540def5e8cd6835ff26cb85942d1af7b43aa353136a95a65b1d660a4e7f8ffac01be01a540726bab33ed18f32d40058194e1397d2aff723174753ee13017f6cbe10dcacc009340505a6c9a38f263551924b2d2527f283166bf11b7b0c98308d76c1cfdc00ec4714b1ef976d27d8a5416f73eab32470218370fba2ea0a7a0317ccfdfa4ac57096bc28fcca8e13d9923435b45bf5ac8a13bafde515c214e08616d860a1460581fa095ee35c531465a233fcf94d91da1f4f4747705c020e249244587d575b3b939ae7b9e9a42fbd28fd91febedcb729ef29a275d8d444e3dd2ad187f9d97883596e607174f01667d7ec7078d96c998196f55ffe83e818753382c4b9962de33151a1dc5eaa263c60fa2b1c4592f3226f9d6483eb0f3d07c98f9842531d954e1a4cb93471e3add8da5d7ee4c99874ed865b416740321cb0f2a76002da6e39ffab481bc74ad00afcb106c83b6be6102d909f1d06dadfeffb385259f793402b4af59ed40aa4437a37fee6ea32dec02ebdb388bd00e7b084ec3cd60064f385c6508b3ce087a5741148b7626e3ddbe0f8403219bb22524bec576dc797c2726395bf13c66ba7fc4f80cc97fe05bd11dd8e1ef8decb300777957e8e21cb6aee0564d8c4e45fb52ac5612bb1f868c2fa216df868494c4c8a481ffacd49836251dca7e274ac8fe466e112bb0ed387689a7e85c6be6aa0216d65458fe8a420d1d20bb6bc7220c3dc1e178e2924fef348bae29fea1cc400943b1595d9495fa7c6433149d52937e126f9b47b176021b2238476a62b9a5410c677a6bb4cd9335ac8a495f755a5e10863ff3acca7f86c13d4e7c203ef76bf42ae18ba844256d0f8cd8c3aebf8eb08c50c3da6557428435a1e2246a34ea58b453f280a5dc8a78ee1ba4ebeea82c4da43603fb94fb7c04d3e29a3172d98f0825007cf0962344a26cf1c4ea88dc849761eb0d92bff7b7d93193a1d9f98bda1a6dcd7a907ca8d64c88b7c7ee1b98f0b3fe37d2f9ed4cd5733633aded8b88958e667c0b0cdaf6ba5c50035b0f47c3378fef5753944d633d45f8db926add2446c88677dc97ca3279b84ea5fd93bb49b48b8740f14b9c859f58ae81ddb2f9d90cbc1681b4c7a298c4dc7435bc6124ddb7da7abca8ddf35430246e1a6851fe873c452ea570fddf95ee48af34a1d6dff397508b4924b77cd1324c5b3d392013f78ec9b3106f7d74341db7b20dd6b05a53531188b91584ef6e54c81ed3e607f5d5b964f8cb00b7aae2f03b085bd2bc784cd8b6ebfb712c5e328162663ab42b39c70de064193a25c7a326f30400897ed06c8d11c49aae7d9f6133b02622b025ed62e57667cf990b91727cdd78abc8a48da8e5c85a1811b134fc9745efb5a4cad9f6d17b840cb3db48b11a3579866b0952943b6497e1d44c20656de0402ec16b934ae4d242157c1159c33fb6c21f02cbc5cf60ad83053bd5a493b15a1320c2d574aad6a13e87b86aa38467bb0e5c6233ff852751b7682d0ad95db84b68a3d8d341ab614c9e426029dd9f29c85a933832cf26d2054474148228908326bf38db8a334ad94252a11f780f7a5b745a795df58bdb199b0774f2e75f07830cec3ebc00aefb1f941bcc6a6ee283044e458307fba5486837776767486820e40b5e41a23d1e31f11ac35275dce12bc6b70ef08413a193251e67a30ce7ef462ae730537da9bcc8d7813ba62556c2c5cf433dfee65ee57c1372c62ba9fe63d4f7b17e5bcf32d97801991b4d99b68ebf74856094a09372064475b1880847d6c5b5ed1714b7dde2e29c616414d26a6f6508d9d104194a4717e145be4fa73b09119c714a63f8fc57a0e9ce7afd96b87d7be03912db0edd6d645ed5d81181a5b778f89eeebc4aeebb94148ecec374070193ba084fc4b21f96783a50a3f2d6ae8c1ae421a4ecfd155716ee587c200cdfb4a248d1cbbccc96d4e8d5608343edbcfeafd309f6372b57ce9797301cbb3b948024e3f741a89fe1dd66d69a50c3a95ec312a87268add40682e28e97dde86547de57699440ff178130b6827d64e70af1ad137821f54710970b2f5dd82ed620811b0dfddcf40703d7fd10d9603a512a15c5168eee172405dc339ee00b3ec7e254e1530fff0d5018487fb22eec948c79f7e90f21dac015bfd95a80e7a88eecadcfebfdb8baeea092874a70f361fb139272cca3162ffc812a06ad2d8d4915575b39ae85ee151c120786a43c6844e68cafcbb414c0cfefb7a5e8d33fe0e2e28cecca57d1ad71245ac59d82f6f8ab70a30f956d6e74fa37102f45697a4b7d661f043071cbd1a641a7b8c3e5b8c4725eb8f5b07366fd5cf18e914141ab8914e83bae9040666be266586a2bddf6e94f9849c615f138704c9b197be18c3eb375ddb1ec86feecda0206a0e0a42c55e7d30bf26a8dd7617e28cd1b8a4acc0af8d41f84601a6c0988d29b533d9c7225cb644d20be80899f1aea1bb007b2d31da4f52ca5bf0c99c964d3711e1fab259cd65873a50f4b75c55f6d40af8e367a70ccf13f0a695b22afc72fcb4429616d7f9e4e4b9bd39d1615e4e90d6c4a4f4f21f12f08216954379ce6542de3e00f82c09f5475bf56bf0da5376d71ec44e1fea6d683927f433d8a289a21648f4a18ee17b5926bebd4c38f0dbfc585dc38a87f1f575dbf420e7ffb764846ff505a775d4bc00acc0d5b0d410e3c1b0a3aa30f63ce863e70f570732c53a00f37006bffa6a081612669e1650839055a9eb04626bff185b8120d51c7a9ac40bf104e391159c78f5667b36078a0e30e7fef04b638ba1bae63f317d11f3020324ae599b25f32a16b7b180c405fc93f137e0ac6aa0c340a55e72089b43ea56d975c92ba92e419a9b8f5b8d603831f413ccd814625a28db433b440d8ededa3de5a9f6d5831bfecfcee31d949fb176f9bd1bc77dcdc3591cb58cd256c1defab14f2d9f01143485f29822c8033362f6ac58afd7833c014ae63cbde1c571338121da544bd8934c3932d926b0f0c762c4dab035a372369a598d5c0437e19bbbfc048c7ae65186482187381537051b4db2211a545c7295707a4eb95d661284709923024592d12c0484ccb136dca1fc02588ed238fc6dde83f3f868364ee12343837b6aa29b4644ec91cb89cf55c21a2be361da678cf4094a28ca544f5766be4d143718a5026a8c79bf07e8d0d1be9c845862d7d24d876daf30abbb654b7c79c81c534227ad774f187031d59ee31e69fa67615ba33760d9b1e23cc1f95a7a45c0270fa44426d62ea51f874873fa6ab66c54f210727bbf8a3fdc9e5d10db539636821f76d6c10b5784f5a5c30a5eee3eda68ec5fe0d8af7c31765041eaed24040cff9cf99fb1c98dee5b085bb3f842ba388fd728ae6f44cc0af34601fd275796799dc14dbce9f6085d72437230bdf51b6d1d4a531d41ab067b4a40aa28a74daa6eb770866d229a839dac8443f0a95b8e754aeca9d964672f3bfee234ea5ec0d5d4a4d230e871e11f6d657f418ee4fc2d6c346f67b3006ed0dcde974165c376aa19e347f64a6c82ab8f2ee4daf1103d17825e0808d948acab82b6a77bdfd028c5df498263cb524447681938c1ddcbe982da5baca8ec02b1e9ab17988d66bfb82ae4852b7d5ca81af1ff5e5b2238649071cfde57f793347249aa56ca6d77b5678cb96e6816cecc06d57d59f3560e91af5982da834767733bbc1ac59b043502fa2229214252191c81cdcddc11dfad784d6c35f10359c1a42413a6c9ae439fc17711947675812f83e250badab2291f81c7190d634add153aa7b9616a27c044978fc4062e6c77e21e55ef8c7de263723bdaa0a10b10106de06e9bce83e94225c62a8f0fa71540f5b1f7b3587ec818e5eb1633aaaf6507d46ab88b68eab173796070a81970b0da4e1486a7026416bc787aeeb45c3b0dac42ccf20325cdd832311394ada0b5505dabaa74b1304f67ee4881dc3b1e5e1bbb603920c84b50717f00beef2d1645b65f4432579e7b76a167d328d9e41e566f92fa50b1552ac9a29a899f22dd9606f6fcfa0dc0fbf8a24fab3f3651fbd51c463a645639b606291558918b1b7775e62caae4dec2542c4cab29e7437ce4998a8ce58979f643a00aae0b2a17be1d8345955780a7c2c9232e02123dfa87e3669696f7fcdf1e123d5927c30463280d9b1cea21ae20822cbf172d222f32c65a2cf27e5d40819a9755ecbfdd50963fe7a03e04bfd2276e5cf6d6dfad3a7880631ee6cfc3a03a7e02a6ae70c5403d719fd16bfd21f1da7305fdbc6cf2316e8bedc563c3ce2be91b01f1431e3f53b6254d7bccc16adedd409fafaa11d8eb8c9219e89d6f39b212c9b0a02274523d1967a0dfe08f043d51588e3dba91f053fcdc5b5175bd695fa313247d12c8072b49d2e3c7664ca9ff8cfc30740fa4a3aab6b6b53b9e1fc045a6b943a2a02e1f8b57fc21356780118cb89da1cf4eeae3147b0de5c3129f08bda6b87d6bb4ca11e9af7e6169c4f7d99da47be591fb2cd67fca998dfbdb3d389c02e17d1ffd9b79d7a5774141cebd55b3f3a49b7c20af3664a3ccbad81e5441a4e9dc9cf24a1b62351964ff8b6f549769c24f687367cc5d45ae0275d8b397c653f63b1516951a6f6ea18a24d98467ff47929b28dd58d7805707567f032c39125c9993d460158cb189b122820c21dba5ec81d8a77fd3b6806b3e66c6589bed2f4b3d790f1388ec479f061ba1b10dee54ebb9c6222f783b5a4d534d024044f8637ee5dcc178ef3e1b60c4a4f5cc125ffb8de65a159883cf30821a0e2f1ec5029f66f180120e5c41d5b74f64576a9bfbcb7aba67e9831a8e66a157930a8f5112f04abd80e8f240bdeba203a8243b8961d34b053533f41d2c9d3ab3838cb7d967f22a4f0996bf4485b67592982f94e2d827465cfeea2f6f98caa029915c6d980911abfdb9aab4818940b1701b3290f4c94920773e08d9ad7402a5a1fdfe7a0854de115005ff631172f67503cb85bb7e0b287e26cf5e3328b75869f694f0bb608c54ce65a4c881f52bebe37f04f19bed5de732dec642eb8d47abe4501b5f847a7f2c3777192e943fa11726ab1607046d4bcf46b99a6fd5f32616b01f792a8880c18e8f59bc6cd0903d7b97bee32e7e4d66fa4de1ebda7de5e17f89ecb26a598fe08be4a8f85b58a6c312f6a76779fbe02fd17cb7913fcc20253d6259594cf4d9c5adde346b080c076cbb7008f872fb1e554041a34bbea3943111e87e6ef9a9e8f2c1865e39a246bc1447e71da74af30483677f268f8d9653f8307d2c47c3cdb4b31dddff90918a4d7f2422ac5ac6b3fda985ca499f88f9af74adcbbf65ee45200d76ffe8f4a9cda3bf5db2240367c371e1e2828d45a7ea9fe7e2b10e91b760e8b6972b5fa3ef5bdea28efde137e6cf68b6305862f120f9212b808fb029ed0ff03ef2c10f6bc88d06ef8cc5494f96ced911e8ee86df83c00028008000180fffffffd0900020073797a310000000008000180fffffffe0900020073797a310000000008000180fffffffd08000180fffffffd0400028004000780500200800c000440000000000000000834020280240002800900020073797a31000000000900020073797a320000000008000180fffffffc280002800900020073797a310000000008000180fffffffe08000180fffffffc08000180fffffffd4400028008000180fffffffb0900020073797a31000000000900020073797a30000000000900020073797a310000000008000180fffffffb0900020073797a3000000000240002800900020073797a320000000008000180fffffffc0900020073797a3200000000ba00010040c318c1404fc70466d75492e269a391ffce41a49c34ef49952b88f3d957ec87a623e121db5a27271dd00aae2cae1d9495f7a0f0845660119953eb347c99f13a72338f47632ae095701fa70bedc7cc5c491d684d001d9bc48cc9b5d3aefa33b454e7ec5e3048ee184040397dfd9d3989e92925a24a1d937a68bcb3c1bf3391b516d3426ebe4a7d0265dd96764722d51b84624a9559ca7eedf27e3bcb8739b1c61be0b1401371acdc3096901eb89862eedcfb611f8e2a00002c00028008000180fffffffd0900020073797a300000000008000180fffffffc0900020073797a30000000009100010092e888c25575e52434de52b18c424397428a1e88d173f978f09c6260ac98395106d8d8a6a7899b6c5d763a4db222807b880a3cfc482e322c109ba58f4a0b389cd1cfbeb5d56fdec74bbc400be18cbff0355f183185e44abcd9b175517104d9c768937faff4039486ea8c5f9155ecbc9422b0b4b710639a08eac50c295ec08108c381fb5235ceff17a743bd07c40000000c00044000000000000000001803008020020a80a400010029b6f920e22b1b8c8c46bd51ac2dacc4af44fe413b3724534c6eb86fa562f1e41018dc7f36a5a8d0a83976227ff77741b3572d89dadd6ef3b5245f7a6e83630e5e271a17c6de8dd31fa71e60d478402e0b983966a186adba0278a50bb896521a5bae606589ee7bd25c35929f3e3795bbac6bef2c8cdce2c8cc2d2f144bce0a56a515d5dfc43a7a7d5aca001093b79877edb308a2a881d899171940d448e90997100002800900020073797a300000000020000280080001800000000008000180ffffffff0900020073797a30000000000c00028008000180ffffffff1800028008000180000000000900020073797a30000000001c0002800900020073797a32000000000900020073797a3100000000180002800900020073797a30000000000800018000000000ef00010078782bea70866c90362056eaa5388b2c26df31f1ce461fe736e2d345a56518b9c46b15c45c6c2f4e2e2d80297f54416d5d71ef49d07a2b2b959a438bba22cc8634f55ddd770cbcedf7884dbc61e472073cdc5bdf200709f644dfdaa724ec03b020df0e1b53da6c6e9fbef9f5bf546d69c5db715e2778e95cd78d1c2f3ffe89bef963bd4dcde430f833a076f46deee26f90f3b28f8d6e6660d47e4d0b5e70106b284bf5d6c8d24e0608410d601701cd2b84eacf9b3860b920cb9dd7271aab37080d91808aa47c5faefa094209994756f8873c2d20f0da25b67a80e9235c8fc3ad2621728821ddd30c992b0000ea000640e3a9e2fafc30cb5c60f4e713935ce072becfbbb111777775ad68aa06ef523f947def366093caa7407705cae119e27354a282fe2f4ad0eabe0bb18e77794673d94558bf641c2e45286c3d5c0521c94e23897501c3e670b141f97d7d73a86f39352c73ace5a3f1a92fe87c70fe4df92e080dcccbb83a432015df48404f1ed94eb47e44bf7c867b3d2f9a682515a23bfdf0559eba9cb30417f70cadf23ee358dd2cd131f28f204db73dd3fbc20217af548707ce9c71f80de5ef910c2a12e3cd57ae6d1bedaab468ab974e93d42a6017890ed2ce1c668bbac96404fd7404363ca6cb58aed304c3cf000008000340000000001401008008000340000000010800034000000001fe0006405752b6793017f41b2518aaddaeff99aeef6d25e2dcbe35fcda763e499a56cc7b2a745d6bf957ade3096a40148ce01bdd59b0fcb772086bd719f9142b66edf603c52c32f999c31dae8f5a5e066ae611692dd2f9039f44f9f55e2805aeb5a22e7e816ca49a8d69f6ebd45aa9bc9804e306f9dc4f6873a997de7febfc4e2cb4029b0e88c57af80104ba349dab21ad93eea907a5bd84dbd583879285ce6b80ca4f37f790d119d8342634413555388d1eea186d0a19214503fede728e748e10c4e150d3b509db94bd4bf2f2e9aa88da898c68ae5e6aebbbfc9a05d275b086bc2af3f3a8ea09628dbc6d67f38a73b089a707a539c457f5268455a575180000f00000800c000440000000000000004090000a802000028008000180fffffffe08000180fffffffe0900020073797a3100000000690001001bbba94850d5bd340ea5c1f2dfe9102a5b1b39435a9bc67c0d8b7b202f8c4aa11bf2fe72872104512320c371dfe581753e08e865e342348932edeab3d755d6d0e6d46a67b4a5f6f71a0c459458492b68d899f2f897adad3a53543254c27952d48e7e4d5cff0000004f0006402e0de203e112b01def2f12fbe0e1f64cd5b50f436c43b0c0e939894f974cdd966e7761c9e573c1dbc19cf295924450f80d7b9c415ac9ff2471e895521be4db2441a667ef48561008a6ddf9000900010073797a3000000000000000000000000000005737c498289c90fca96f00e2cad7251d9c49b5a03dbb4f315128aec1291b294f234cd6c212355d18a75e47b2b1f08b87c028c9553f3503309dd2d39577b90639913fd3f89e75b6d1eee2cd6cd7c96a0656793d948dff3ee74f79feecc49c707882b3e26ce0fe541065329c0ecc226d4149693257f65317d43865fa18e0cbab3c2175762a3096389e10e50686ddf5e01b8d23783f6b53a32a44a879"], 0x5c58}, 0x1, 0x0, 0x0, 0x20004}, 0x90) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r2, 0x0, 0xfffffdef) 06:57:57 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7d11, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a5af9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b100"/153], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x20a200, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x230000, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x700, 0x120) openat(r3, &(0x7f00000001c0)='./file1\x00', 0x20000, 0x1) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, @perf_config_ext={0xb, 0x6}, 0x0, 0x7, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:57:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 95) 06:57:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000000), 0x2, 0x0) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r0, 0x0, 0xfffffdef) fcntl$notify(r1, 0x402, 0x80000021) [ 3127.693524] loop2: detected capacity change from 0 to 40 [ 3127.702736] loop7: detected capacity change from 0 to 16383 [ 3127.706999] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3127.707642] EXT4-fs (loop7): group descriptors corrupted! [ 3127.710296] FAT-fs (loop4): bogus number of reserved sectors [ 3127.711277] FAT-fs (loop4): Can't find a valid FAT filesystem [ 3127.717709] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3127.719524] loop7: detected capacity change from 0 to 16383 [ 3127.720803] EXT4-fs (loop6): get root inode failed [ 3127.721540] EXT4-fs (loop6): mount failed [ 3127.725126] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3127.725838] EXT4-fs (loop7): group descriptors corrupted! [ 3127.755443] loop6: detected capacity change from 0 to 16383 [ 3127.788403] bio_check_eod: 1 callbacks suppressed [ 3127.788414] syz-executor.2: attempt to access beyond end of device [ 3127.788414] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3127.789748] buffer_io_error: 1 callbacks suppressed [ 3127.790128] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:57:57 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8400, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3127.804929] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3127.810320] EXT4-fs (loop6): get root inode failed [ 3127.811182] EXT4-fs (loop6): mount failed [ 3127.812444] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value 06:57:57 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2400, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3127.903152] syz-executor.5: attempt to access beyond end of device [ 3127.903152] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3127.904142] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3127.930003] loop7: detected capacity change from 0 to 16383 [ 3127.948058] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3127.948943] EXT4-fs (loop7): group descriptors corrupted! 06:57:57 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 96) 06:57:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r0 = accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3127.998364] loop6: detected capacity change from 0 to 16383 [ 3128.030422] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3128.036243] EXT4-fs (loop6): get root inode failed [ 3128.036855] EXT4-fs (loop6): mount failed [ 3128.061405] loop6: detected capacity change from 0 to 16383 [ 3128.064522] loop4: detected capacity change from 0 to 16383 06:57:57 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8600, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3128.092144] loop0: detected capacity change from 0 to 40 [ 3128.095884] loop2: detected capacity change from 0 to 40 [ 3128.096984] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3128.099149] EXT4-fs (loop6): get root inode failed [ 3128.099732] EXT4-fs (loop6): mount failed [ 3128.104386] EXT4-fs error (device loop4): __ext4_fill_super:5380: inode #2: comm syz-executor.4: iget: root inode unallocated [ 3128.109166] EXT4-fs (loop4): get root inode failed [ 3128.110214] EXT4-fs (loop4): mount failed 06:57:57 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3f00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:57:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x89, 0x7f, 0x7f, 0x0, 0x0, 0x1, 0x80000, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x20, 0x7}, 0x9202, 0x7, 0x0, 0x3, 0xffff, 0x1, 0x800, 0x0, 0x7, 0x0, 0x2e8}, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0x9) [ 3128.188466] loop7: detected capacity change from 0 to 16383 [ 3128.195201] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3128.195878] EXT4-fs (loop7): group descriptors corrupted! [ 3128.207020] loop7: detected capacity change from 0 to 16383 [ 3128.213608] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3128.214455] EXT4-fs (loop7): group descriptors corrupted! [ 3128.219060] syz-executor.2: attempt to access beyond end of device [ 3128.219060] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3128.220167] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3128.221561] loop5: detected capacity change from 0 to 40 [ 3128.269391] loop6: detected capacity change from 0 to 16383 [ 3128.275008] syz-executor.0: attempt to access beyond end of device [ 3128.275008] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3128.276020] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3128.316523] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3128.317687] EXT4-fs (loop6): get root inode failed [ 3128.318185] EXT4-fs (loop6): mount failed [ 3128.348657] loop6: detected capacity change from 0 to 16383 [ 3128.368362] syz-executor.5: attempt to access beyond end of device [ 3128.368362] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3128.369423] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3128.374370] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3128.375689] EXT4-fs (loop6): get root inode failed [ 3128.376075] EXT4-fs (loop6): mount failed 06:58:14 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 97) 06:58:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0, 0xc0) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r0, 0xc0189376, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {0x3b}}, './file2\x00'}) openat(r2, &(0x7f0000000240)='./file0\x00', 0x1, 0x12) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x101040, 0x0) openat(r5, &(0x7f0000000340)='./file0\x00', 0x8000, 0x58) write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r3, 0x0, 0xfffffdef) 06:58:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) connect$inet6(r0, &(0x7f0000000380)={0xa, 0x4e23, 0x99, @local, 0xac}, 0x1c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) syz_io_uring_setup(0x205916, &(0x7f0000000300)={0x0, 0x3d5, 0x4, 0x3, 0x43e6, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff1000/0xd000)=nil, &(0x7f00000003c0), &(0x7f0000000240)) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:58:14 executing program 1: syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000040)='./file1\x00', 0x4, 0x0, &(0x7f0000000200), 0x1000b, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x8, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x1000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:14 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:14 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8c16, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:14 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x200100, 0x175) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7, 0x2, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0xa, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:14 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3ff7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3144.345306] loop5: detected capacity change from 0 to 40 [ 3144.355534] loop2: detected capacity change from 0 to 40 [ 3144.387027] loop4: detected capacity change from 0 to 16383 [ 3144.417990] loop7: detected capacity change from 0 to 16383 [ 3144.422570] loop0: detected capacity change from 0 to 40 [ 3144.426360] loop6: detected capacity change from 0 to 16383 [ 3144.429391] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3144.430719] EXT4-fs (loop7): group descriptors corrupted! [ 3144.455387] loop7: detected capacity change from 0 to 16383 [ 3144.467177] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3144.468471] EXT4-fs (loop7): group descriptors corrupted! [ 3144.478390] EXT4-fs error (device loop4): __ext4_fill_super:5380: inode #2: comm syz-executor.4: iget: root inode unallocated [ 3144.485730] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3144.488326] EXT4-fs (loop4): get root inode failed [ 3144.489042] EXT4-fs (loop4): mount failed [ 3144.496418] EXT4-fs (loop6): get root inode failed [ 3144.497343] EXT4-fs (loop6): mount failed [ 3144.532125] syz-executor.5: attempt to access beyond end of device [ 3144.532125] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3144.533715] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3144.545159] loop6: detected capacity change from 0 to 16383 [ 3144.559439] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3144.576166] EXT4-fs (loop6): get root inode failed [ 3144.577051] EXT4-fs (loop6): mount failed [ 3144.612016] syz-executor.2: attempt to access beyond end of device [ 3144.612016] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3144.613703] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3144.625578] syz-executor.5: attempt to access beyond end of device [ 3144.625578] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3144.627254] Buffer I/O error on dev loop5, logical block 10, lost async page write 06:58:14 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xbd11, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r0, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a5af9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b100"/153], 0x13) fcntl$getownex(r0, 0x10, 0x0) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r1 = openat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x20a200, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x230000, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x700, 0x120) openat(r3, &(0x7f00000001c0)='./file1\x00', 0x20000, 0x1) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, @perf_config_ext={0xb, 0x6}, 0x0, 0x7, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) 06:58:14 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="2106000000880a1f778d2a3d05020000fdffff0000c2b43d24d66fd8ab856f4b960ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000fd1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3144.706044] loop4: detected capacity change from 0 to 40 06:58:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:14 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3fff, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:14 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 98) [ 3144.876962] loop7: detected capacity change from 0 to 16383 [ 3144.908892] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3144.910156] EXT4-fs (loop7): group descriptors corrupted! 06:58:14 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open_tree(r0, &(0x7f0000000000)='./file1\x00', 0x95495fca46bee35a) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmmsg$inet(r4, &(0x7f0000008f00)=[{{&(0x7f00000014c0)={0x2, 0x0, @multicast2=0xe0000003}, 0x10, &(0x7f00000047c0)=[{&(0x7f0000001500)="a2df", 0x2}], 0x1, &(0x7f0000004840)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev}}}], 0x20}}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000040)={@empty, 0x67, r6}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3144.965403] loop7: detected capacity change from 0 to 16383 [ 3144.991571] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3144.992737] EXT4-fs (loop7): group descriptors corrupted! [ 3145.045291] loop0: detected capacity change from 0 to 40 [ 3145.051923] loop6: detected capacity change from 0 to 16383 [ 3145.069314] loop5: detected capacity change from 0 to 40 [ 3145.100289] loop2: detected capacity change from 0 to 40 [ 3145.113372] loop4: detected capacity change from 0 to 40 [ 3145.115360] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3145.127387] EXT4-fs (loop6): get root inode failed [ 3145.128224] EXT4-fs (loop6): mount failed 06:58:14 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3145.218532] loop6: detected capacity change from 0 to 16383 [ 3145.225414] syz-executor.0: attempt to access beyond end of device [ 3145.225414] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3145.227023] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3145.244560] syz-executor.5: attempt to access beyond end of device [ 3145.244560] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3145.246343] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3145.257144] loop7: detected capacity change from 0 to 16383 [ 3145.260473] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3145.277371] EXT4-fs (loop6): get root inode failed [ 3145.279956] EXT4-fs (loop6): mount failed [ 3145.283306] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3145.284679] EXT4-fs (loop7): group descriptors corrupted! [ 3145.305699] loop7: detected capacity change from 0 to 16383 [ 3145.319097] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3145.320364] EXT4-fs (loop7): group descriptors corrupted! [ 3145.330603] syz-executor.0: attempt to access beyond end of device [ 3145.330603] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3145.331831] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3145.356502] syz-executor.4: attempt to access beyond end of device [ 3145.356502] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3145.357656] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3145.362046] syz-executor.2: attempt to access beyond end of device [ 3145.362046] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3145.363169] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3160.673833] loop4: detected capacity change from 0 to 40 06:58:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') pread64(r1, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(r1, 0x10, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc7e9, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, r1, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000280), 0x2}, 0x0, 0x0, 0x1, 0x1, 0x1, 0x81, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x101040, 0x100) 06:58:30 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 99) 06:58:30 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() pidfd_open(r3, 0x0) syz_open_procfs(r3, &(0x7f00000000c0)='fd/4\x00') perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x3f, 0x5a, 0xea, 0x7f, 0x0, 0xfffffffffffeffff, 0x800, 0x11, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5c7, 0x2, @perf_bp={&(0x7f0000000240), 0x4}, 0x4401, 0x3ff, 0x1, 0x0, 0x3, 0x0, 0x905, 0x0, 0x4, 0x0, 0x4}, r3, 0xd, r2, 0x2) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000180)=']&[\x00', 0x0, r2) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) write$P9_RSETATTR(r1, &(0x7f0000000000)={0x7, 0x1b, 0x1}, 0x7) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x9000, 0x84) 06:58:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2a"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:30 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) 06:58:30 executing program 1: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x200, 0x10) chdir(&(0x7f0000000140)='./file0\x00') setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f00000001c0)=0x3, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000000)=0x0) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000580)={{}, r3, 0x8, @unused=[0x5, 0x400, 0x9, 0x100], @name="8378ac8884047d4de776045848c8ca6b7c21de064f7228e896c88795e88f6cb8cb9e7446c1648ab80f2ce26d4765a7edcd331c6d470b9296ecf55bb7c00094a1e11620e7444dd8b34bb8e30422d48c59983a6570468aa72f932d48ce2eaa1c684f456fb7223c93e4f2fb34f3bcb263bdd00759d0e761c046f4992f8189cea4ec1bae7425d4da80a9c28133f6f6cdbcb19d0742555fb1cf04635378919777279a4cacb88bb140711229ae9e6720ad6ee0e1e570d10434eefb75c5e2304d07ad5234ca06320e9f3f132c8c07b3dc1b4b636cbd609fa058ca344646f9d125c6df37e21e9089d71e21382f59e3b19bf9c0b5a4b44c78f1cc529b7134ea41ae9fca2a359bd2dad9d07666178f32fc1edbcedb3f04db96febdb5ad7d3f493e1a4d13ebe7b7deab6b9df650b455f51748e9de5625802d7165f26193353c8bde4aa06e931716d71cd6b48f133e2683a6047eca0c4f39db02f2cdfc06e1cc0e1316eebfe1d17de08b9e7e6d026839bc94fd6dd96918ed85b4eef21f5e4686273fae982214d50ac8c8c2aa25de8b481258220870103b07bbe6eaa1ed5551daf409ba16d476cb546a9d3673ff62e55f0b7d7fcfcba4691a1fbad1187246d2a81dec06d2592b4cc035fd85f4789f294143e2b5b9d5aa574e5967ecc5ac325638ed3772df56b7e8456c1239909494b58c2b7a52ce00be6a102e5d893d3fd83062d82b73ec2b5151101d9b1f711b7c1157818fb4bd95b6e422c964c90cfe03b6df86351d6564b095e903c3e78fac7d5cca3a082946daa4b0711f2ecd860279a1679f5bf59b7a75e32a0745ceb66826e1c5dbc1af667d25812a761eaff895d63d26c45fdf48594d84fbc15f07701be47de62557dbe15a3b03af8430fec76704cbf0cea5246a26a5078c33471979aa2f8b29f46fa45685f047f2780fd3554112d3e7ffd358b6aa52275beeff34c355380e35de17de476f6db030c5b027dda3938f2e2e39279b371bead8d242f664fd6541079bd99f698f2932a5911c5e463b6d3859c2cdb05aa6f158cb742e426d6f6fb4892ee4042e90f4be2a9acbc30894f8e72e1ec2f17a694d6a239ce09dfb506987cec9f9d8e2cc0c37c2e122cf0d6c9141f387ce976210c980eb55d704091f2b8fbe93625169c9d16df688a31cb1c3f3c4569b60cf097ebdc240fbf64ceebf32d385183a54b6501e2a30a3f8112052d95bcc0789617990b2c0530550ef255ead656f22e33aae2499526092c01dbd1d9923c6253fa4eecc41f2e15aefcef4171b59c007178e02c14b2635fe98397a0de06c16083e0f13e99c061f0e4ec363687f38578e035123c2f98c025de1cd30c937051c48f5069d2841ea91bc632f95e00ccc4cc22ca601054f08708dc13416c344ec69474a71c17e6534fa6e54c78424c6b54ab1e4d5216ae1f813b25ecf2fc2c049a893e9fad9a45b4929c8d13fc26a7957f3ab9d91bd1fd2678add6df810412311a4bbd0cb320e19cd6cbf671748ad96d284d53c886d0c6818da52419cb13b76637df60541a720b116d908c133b046787ff0d0ed2ecfc7e9cef19e85348cc6ef94abb08c277f07a22f47ccc26a2d9d6430dd5cbc46f63075d58ab8ce5dee28158ceba540489f5eb98255237a4fc93b79635dcf4e867f937db212102776d16db983f91bfdb20978a5762d7acc4fa2a0eea647d7b7a48c396ac67d3ebd465939a5a5fdb66d4cab7047f54e626551e814471d2a7424d660d92bf06ec1ba2a9699abfc9bf1e796cca70cdc3bb8a63adf454e6ee0d8eca1f7b2c657ac0a42aa0896f7aeb41d0a9b8074923de613e6212468d0f628c072306a46558c0ed9efafe256faa7852dd339c9d809ab3accd4d2f675832aad7e5a3a5a5c40be5e891ead52b5e5ef955286962f5e65338c0995ae0b20efff9262fb34d19bdfdcb1a5cbcac8a92ea79eb2c268981c320c6ad13b8084f54dbe5ea4896ff48c3f6411699bd0d6bedf58b8abf31e57c0b1602a62bdd77d19b8d4204ef6a91270cbaf0bf93f2b13bd00d0febd9e58053c56bdae085d163603403e9b3470b30327a2d519258ceda27bfcbbadd13831353ff9becccd2ee2a5079f15c8e0f11b7044c3a7870f7f236e82380d42691813a3a1cc0d4b5e8fae41b2f36c04b280ea5818cd42dbd4f22147c0b264761ee7ff8a93b8e566fbcea51287cf4e3cb76f2d5e7a00959ac7e116eb5b6ded3f1dc60f59ab30e7487108858fef22466ab1d3d53e19e17a39fb01ea953a61ec72f8f01cb8c0903b2cb350a2d2196a30a17928a701115679e6ead9c571cc6a98937c5cd4d92de408a482e48e34410021523b447f876b84bcead7ca4cc2a807f2792f70bc7d0d5aac247881e47d6c91632ef434602bbfd88cb36bfe6e13f37d36cb26909ec9c386a5b7cc2df0728c3df0a0ecec6d20ee0b475c333ceadd2598ecee275bf0bba557eaa2db8fb98b06abd91769172e61ab1484769a2a1c0bbb938bba0929907929c619ca025f485ee8e595dd91f098a62054de1e73d4601bfb35ed8801658962fe8efabca82494c13666f93c2ec37439f55a3523244228dfb82dcc05a9041a9ea66f4ef70018ca2b3279976163f326e8859b9fa8039c9f1e3becbe375148a07c4bf51d32e036e030e3a842c45e99e7ce7e183d466e5d5838cac71e4eac15a81b934e3d8ccd0cfe2d42c2925805acc61a2fb9f3e19431c7e42ee9864e25740e589116be89bea9c0c245d3b570d369cb18becbb9354326d399635c26b6b48b64be90f26495491a0a8f03f21098c65a623aa99f384a8396f599a033dba36355848a52fb751998b3c1e02ae3f7917896507dfa0a68543dac66786a5f63850a886fef130b3fe63472a736c390b4dab1b23b0145d9d2120a2e72065eb8e4537beaf5d5fdde02e67c890a645c39d121f8b468b005d4a7204895c60fbef113ca7460f8b432b426035106e72f7ecef6adf7c5745f614df75d7623874c6340bc017a7796c8b493e6fd38b1de5212a7f071b73ba1b8498dd0f225017ea0e2481f60ac5e247a86647e38141370e0081904d6bed974221b28e9046ee3f85a9b2f01af1f1505714b160264ea19c1b60774543822fbb2273a0b50ba8aa93ffb243245ad60ef228ba9f9f76c86e5f8ec0494fea0de5b8d751509d94f6e0e8bd7fa9b868cf49a348f1fb144ba2f11cb379ac18616e7e2dcef0e0fe54de3e4766ae81d5d270134145dd7a72fe0d52229d309ce8d58ba6bb42ec79fbfabe4a3869ab4f95bda6a4f7cff88ea909e40faa0ff434e59d040e90ae3e0443a3523666630fd4828f87de9700e08ef7683b00121cdbb97097de2a3c2a3c8b62bc12d6e11a3c30a88ffd6873e9d257b18f9bcbf816f32f91e4ef1121eb71c93b15ad299cdd987ff30f1d6409e9f4743497816b9c3b407dc844e2420971ad5bc88a27a3cf2280dd41eaedad8781a926a20e91d380f2bd3339165a345fe8b0deabf05008a38fca2c5aca681c277fe1c573e30f16ada23a466f6a34747bea1a3e64066cadf1ec2b422e3aab5867621c45296a65b6c3cce9a8cf48b38bbb563491292d8ebf6f5fa212010ac8bf63b6e06cd98a4f7a4a6bc3d9d8d3190cc4dd22890dd7207a8bb8c30308441e41e2a44212c3408c5ef33898dc4912134cd89259ec0351335369340331ef1bc26c4745ddf555dd2e9e5479114f5daa08fcd666a187043b42f167a8b2c1f1d14055192d5af079d5f34d5a4d53477e439b112898477f78e23272fc5e028164d9a38e6e71b951f7a2de3dcfe2a12592029a63ff1a374ee64910eddc981a61aa7f9ae1cd4c9cefbbfdaa9626c71f7048215734f37da6889c8960da585726b90340bdc3a0eb31ef4e7f8b7dedc4aa4923664e2227bc08bed4963326f0bbd6bc3c7a2016bc24505221f547a3abf26dbb9f9a18429a9924aad57058a54c6d7fd9b3c13a13e2c00794c767df2adadfc6f755932a73e1d757a5788234e369fcaee824aee21b357f6cc20fd6358ff95bf212ed0629c71943f4efa7ca31751c72d25145086bc685ca8d6e27a6425016d2e02b935d99f03b4836dc4a341b760502fae711cdbd5a32b3d12485019d659e98459ba77d77fb97f5a746eb28103ba6f58cf8f514e892e11116e0796ce1dc72f082f81e78d8442cac75fd0549e944a0dfc733a529e12164df993ea7214932fab8419af97899c70bf9d80f9bded48bb062f7b7f03589db2ec5d55818385558f15b76c89de261efbf12a46cf4eb99185b86349d4840ca580c2c204d566601df5241299f011ebc3988597018dc599916d63cdfbfa68d479fc433bfd6a97743d997f9a0a8f01df599fc93aea385177072aa94fc21b1bdaf51e3c3acdb887798d29594330e4269135df54fbdd0c87c74377c24ae204d985e913925891e5a1d810531f61ba1aa0894171cca6ba69bb665b1afb8e4e1365c1cfdb71bb5105699ae55d1c8dcc3ca2ada7227554ceefba57c292e519b4defb5bf6aafea187a87778713644fd1d61b1861c1253b0d1a41bcc04b1086227213e0d52f89fa91dbda23e83dbdb22f14ddbe16c7881666ad69ea12a0ebbd8a337c49ddb2f456fa51d59f2c2ed913aa65fb9b56b26366355e3a4aab51a6f3dceb924160d0616874ac0fd329690afcabc6afd2a4b972336b16966743de677ca2d41e9c00797625493c1676ffcfdde5ad17d10db23b1d6acc5c600a41ac30cea2a3f9bde1a6853e82fd2300956e3754ee2f87ffefd71dfc827171cb9e999e6c507f88727fdf8245a1dfc610101029d9e04dca55daf93a6dc05e9ea2b2cd72a1cfdf62e41c86e7245f230e6ad1308176a04a8460d00ed50ec12d929b8d085280b10172ac460ff194174cb53125757520748844198cc8aea4d9b034c8ec9386369116ee76eef78ba2a934c0940cd72df0b1c5dfadd10077b0d6ec0fe5a9ed30b89930e28b08597b693aebaf075fa149215921b0f44565b8ab9de589f5cac324560c9f8ae42e37d38a56becb2c172e4239fbfb647a859d8ce76579e5e917ca48d23050e0810419990b621237dfaa4e96b907ac5cb8630c735e34d51afb02a022d5adad5d6ad8e100e2c2d484b55332f7a79740965b9d90c9299b77d8cc28e0e47be226705247ebf34e49d8e7739af0dab80b519e34ac0829026e8e396f36e64d099986cb01e5af3cfa3469c5d28c5ab7134acfed687e192a95d7d44a8edd8bd57da8520823c2b3c271ea59a53b7e12ac959ef36a85fa3b5fbf64efc93968919a2340b210a2bab5fe27c323cdb5ce1e8991e83b1f829e0bb1f74934eb2645bc9012e1e821fcab882c2cc13d85ae4b7bb61d7c536bbd0d3fbeb85826812b207e02e47f38d7705ee55fc116256d01192f13062c17b7fca55372d094987b8b7727b474bc0fdc499a0f982eb34fadde26d57c67e70e0f07589c2fffb8dc0c5a70960c10fc83e62a6b67637da01a643729dbc3cd3ba938a42d4c5746410d1f30070a26c4933991f73c0f093dd5ab5af23533ed80329209251bba2f6e54d0403b52026d7d9c19fd9ebe123d723e8505292f14dbfa217a848d3d0309f9469464177ebd2969c7347ddf1ef347ad82fae4dfed14e0b3ad2051e80ad0b054f35c1533c50c7f0d051775da657c80f18f3affd949827b7a610b07fbabf513be8651d6807330c059615b1f3c097520111a57afcc66c733305d6648f1fb7096ed4a63c902b69e0c671eeeffa1cd0ec3d6051d67b6a0a59e776cb35"}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r1, 0x0, 0xfffffdef) [ 3160.725628] loop5: detected capacity change from 0 to 40 [ 3160.726242] loop2: detected capacity change from 0 to 40 [ 3160.760560] loop0: detected capacity change from 0 to 40 [ 3160.763164] loop7: detected capacity change from 0 to 16383 [ 3160.766543] loop6: detected capacity change from 0 to 16383 [ 3160.793105] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3160.794352] EXT4-fs (loop7): group descriptors corrupted! [ 3160.810239] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated 06:58:30 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(r0, 0x10, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_mount_image$msdos(&(0x7f0000000240), &(0x7f0000000600)='./file1\x00', 0x80, 0x1, &(0x7f00000006c0)=[{&(0x7f0000000640)="16985d4313cbb8fe80afc248488c49ed96bfb8bbca4aa504c4b738c8bdd5faf0db495be5c8b1c37b9bc5c751dc90cd5b404931896f462935cc170aac646495c2ed24127661964dd51f3151ea168594c35e86d32fbf264664d6819bdf348373f05058f6f1979dd28e", 0x68, 0x5}], 0x800000, &(0x7f0000000700)=ANY=[@ANYBLOB="646f74732c74736b0000f40000000000000005002c00"/41]) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000980)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x800}}, './file0\x00'}) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000300)="6a1b8362c15fba960f04e45a4e546d0f2ad4e9e2cf51164d699c652a4318e9b1bedb31f13259e59c976f55da88702ee2ffc06b4daab152931d8b9b134379dc61e42fc385dc32ca959c433e9d1e1104230372e2664f74fdd0839e1291f68833cd85", 0x61}, {&(0x7f0000000380)="63b406fdc2ed928de8d1f2f5cf21f1d9bd791b6c5854bda513677e780e0618d50c688ac50ee8e4f586da62ff5f376de393141449a106d62a326566bbf956c8cc9fba8b1542d31d105d5212433850bb19c6285168a9eac1fcd38f28bbf590e2cc8ca63b4f0c0c4c82b65e6e284669d3a02510b92a29d8e48a87d932483a85bee28504bd02bd8567cc2ef350827ba71186a4c7174ad2fe35905303b3ad75443794d7d3e05de243a0347fa33ebbb0ee54eae06441d2e62d3b705f44ccf696619e1b4f950bba59aad720", 0xc8}, {&(0x7f00000001c0)="c937722e66871bd5c7df9e70c004c7fd4dfc8217c79caf277474985e03548a680e9def7f25a1acc8c7cc8d31611f43a1ec104b7cab7af7f481f3", 0x3a}, {&(0x7f0000000480)="e2266c0c7d1c79ba9f64d0a74382baa29cd5fec043749d973ab5cf0a24a477516d441f94f3b3eb8b0a6554970abec6b6ac9f7728e260016893fdd7a237a092e7125cb030f24148b05e97ff0092848d90a45706fd3f782d9d69286a0ac82d1b57a7ce55cf69c6d3cbf9ade16773016abc3ad32fbce65f3a5a08cdc93b", 0x7c}, {&(0x7f0000000500)="10a6e3f7b4d2a9439a56388f5b4130828185b1a800fd96f2547d43135225b1f65a008d32a9c88096474d229879b14255fce67f4974b6d38ce4f70112969a3717b0d4308b3ffa4da8413bf433ecd91cb5886df0634f5dbf2ac8a83665b7ca", 0x5e}], 0x5, 0x8, 0x800) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) execve(&(0x7f0000000740)='./file1\x00', &(0x7f0000000840)=[&(0x7f0000000780)='dots', &(0x7f00000007c0)='nodots', &(0x7f0000000800)='nodots'], &(0x7f00000008c0)=[&(0x7f0000000880)='msdos\x00']) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000900)) [ 3160.818675] EXT4-fs (loop6): get root inode failed [ 3160.819455] EXT4-fs (loop6): mount failed [ 3160.823162] syz-executor.2: attempt to access beyond end of device [ 3160.823162] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3160.824109] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3160.830840] loop7: detected capacity change from 0 to 16383 [ 3160.837318] syz-executor.5: attempt to access beyond end of device [ 3160.837318] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3160.838349] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3160.855915] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3160.857119] EXT4-fs (loop7): group descriptors corrupted! [ 3160.866518] loop6: detected capacity change from 0 to 16383 [ 3160.886200] loop4: detected capacity change from 0 to 40 06:58:30 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 100) [ 3160.914524] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3160.919610] syz-executor.0: attempt to access beyond end of device [ 3160.919610] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3160.920953] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3160.938314] EXT4-fs (loop6): get root inode failed [ 3160.939048] EXT4-fs (loop6): mount failed [ 3160.958377] syz-executor.0: attempt to access beyond end of device [ 3160.958377] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3160.959570] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3160.971133] syz-executor.0: attempt to access beyond end of device [ 3160.971133] loop0: rw=2049, sector=44, nr_sectors = 4 limit=40 06:58:30 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd500, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3161.029575] syz-executor.4: attempt to access beyond end of device [ 3161.029575] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3161.030552] Buffer I/O error on dev loop4, logical block 10, lost async page write 06:58:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) 06:58:30 executing program 4: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x13) fcntl$getownex(r0, 0x10, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_mount_image$msdos(&(0x7f0000000240), &(0x7f0000000600)='./file1\x00', 0x80, 0x1, &(0x7f00000006c0)=[{&(0x7f0000000640)="16985d4313cbb8fe80afc248488c49ed96bfb8bbca4aa504c4b738c8bdd5faf0db495be5c8b1c37b9bc5c751dc90cd5b404931896f462935cc170aac646495c2ed24127661964dd51f3151ea168594c35e86d32fbf264664d6819bdf348373f05058f6f1979dd28e", 0x68, 0x5}], 0x800000, &(0x7f0000000700)=ANY=[@ANYBLOB="646f74732c74736b0000f40000000000000005002c00"/41]) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) fallocate(0xffffffffffffffff, 0xd, 0x3f, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000980)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x800}}, './file0\x00'}) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000300)="6a1b8362c15fba960f04e45a4e546d0f2ad4e9e2cf51164d699c652a4318e9b1bedb31f13259e59c976f55da88702ee2ffc06b4daab152931d8b9b134379dc61e42fc385dc32ca959c433e9d1e1104230372e2664f74fdd0839e1291f68833cd85", 0x61}, {&(0x7f0000000380)="63b406fdc2ed928de8d1f2f5cf21f1d9bd791b6c5854bda513677e780e0618d50c688ac50ee8e4f586da62ff5f376de393141449a106d62a326566bbf956c8cc9fba8b1542d31d105d5212433850bb19c6285168a9eac1fcd38f28bbf590e2cc8ca63b4f0c0c4c82b65e6e284669d3a02510b92a29d8e48a87d932483a85bee28504bd02bd8567cc2ef350827ba71186a4c7174ad2fe35905303b3ad75443794d7d3e05de243a0347fa33ebbb0ee54eae06441d2e62d3b705f44ccf696619e1b4f950bba59aad720", 0xc8}, {&(0x7f00000001c0)="c937722e66871bd5c7df9e70c004c7fd4dfc8217c79caf277474985e03548a680e9def7f25a1acc8c7cc8d31611f43a1ec104b7cab7af7f481f3", 0x3a}, {&(0x7f0000000480)="e2266c0c7d1c79ba9f64d0a74382baa29cd5fec043749d973ab5cf0a24a477516d441f94f3b3eb8b0a6554970abec6b6ac9f7728e260016893fdd7a237a092e7125cb030f24148b05e97ff0092848d90a45706fd3f782d9d69286a0ac82d1b57a7ce55cf69c6d3cbf9ade16773016abc3ad32fbce65f3a5a08cdc93b", 0x7c}, {&(0x7f0000000500)="10a6e3f7b4d2a9439a56388f5b4130828185b1a800fd96f2547d43135225b1f65a008d32a9c88096474d229879b14255fce67f4974b6d38ce4f70112969a3717b0d4308b3ffa4da8413bf433ecd91cb5886df0634f5dbf2ac8a83665b7ca", 0x5e}], 0x5, 0x8, 0x800) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r3, r2, 0x0, 0xfffffdef) execve(&(0x7f0000000740)='./file1\x00', &(0x7f0000000840)=[&(0x7f0000000780)='dots', &(0x7f00000007c0)='nodots', &(0x7f0000000800)='nodots'], &(0x7f00000008c0)=[&(0x7f0000000880)='msdos\x00']) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000900)) [ 3161.069713] loop2: detected capacity change from 0 to 40 06:58:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, 0x0, 0x13) accept$inet6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000580)={0x81, 0x3, 0x1, 0x0, 0x81, 0x9}) 06:58:30 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3161.124016] syz-executor.2: attempt to access beyond end of device [ 3161.124016] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3161.124979] Buffer I/O error on dev loop2, logical block 10, lost async page write 06:58:30 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) write$bt_hci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="210600000005020000fdffff0000c2b43d24c94cc58c27a899a50ff3e3a0cfda8c77358361059faf9ca735702669d87b236c8204ed6dd40e144998620000ed1d691bf1a2dd6998a1a190ddbaa96c077ec487870b834aa229c9141955adc3e0b7f001a30009bb7b98c644cd694939612ade470b50333f3a52b14bc26c08d7806e26eeec6d53578508d05cfe1032abac2aa1f70113a09d7801b1"], 0x13) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000040)=0x1c) openat(0xffffffffffffffff, &(0x7f0000000180)='./file2\x00', 0x800, 0x10) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220) pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0xfffffdef) [ 3161.168563] loop7: detected capacity change from 0 to 16383 [ 3161.176943] loop6: detected capacity change from 0 to 16383 [ 3161.190025] loop5: detected capacity change from 0 to 40 [ 3161.200221] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3161.201623] EXT4-fs (loop7): group descriptors corrupted! [ 3161.206613] loop0: detected capacity change from 0 to 40 [ 3161.215676] loop4: detected capacity change from 0 to 40 [ 3161.216175] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3161.217884] EXT4-fs (loop6): get root inode failed [ 3161.218237] EXT4-fs (loop6): mount failed [ 3161.230351] loop7: detected capacity change from 0 to 16383 [ 3161.233226] loop6: detected capacity change from 0 to 16383 [ 3161.262503] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3161.263859] EXT4-fs (loop6): get root inode failed [ 3161.264027] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3161.264201] EXT4-fs (loop6): mount failed [ 3161.265871] EXT4-fs (loop7): group descriptors corrupted! [ 3161.304720] loop2: detected capacity change from 0 to 40 06:58:31 executing program 6: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="020000001200000022", 0x9, 0x1000}], 0x0, &(0x7f0000014900)) [ 3161.453215] syz-executor.5: attempt to access beyond end of device [ 3161.453215] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3161.455078] Buffer I/O error on dev loop5, logical block 10, lost async page write [ 3161.494292] syz-executor.0: attempt to access beyond end of device [ 3161.494292] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3161.495986] Buffer I/O error on dev loop0, logical block 10, lost async page write [ 3161.500286] loop6: detected capacity change from 0 to 16383 [ 3161.515363] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3161.516400] EXT4-fs (loop6): get root inode failed [ 3161.516864] EXT4-fs (loop6): mount failed 06:58:31 executing program 7: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd600, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000290000000f000000000000000200000002000000008000000080000020000000d3f4655fd3f4655f0100ffff53ef", 0x3a, 0x400}, {0x0, 0x0, 0xfffffffffffffffa}, {&(0x7f0000010400)="0200000012", 0x5, 0x1000}], 0x0, &(0x7f0000014900)) [ 3161.531489] loop6: detected capacity change from 0 to 16383 [ 3161.544116] syz-executor.4: attempt to access beyond end of device [ 3161.544116] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40 [ 3161.546135] Buffer I/O error on dev loop4, logical block 10, lost async page write [ 3161.558170] Buffer I/O error on dev loop2, logical block 10, lost async page write [ 3161.578155] EXT4-fs error (device loop6): __ext4_fill_super:5380: inode #2: comm syz-executor.6: iget: root inode unallocated [ 3161.583251] EXT4-fs (loop6): get root inode failed [ 3161.583619] EXT4-fs (loop6): mount failed [ 3161.648059] loop7: detected capacity change from 0 to 16383 [ 3161.650325] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3161.651008] EXT4-fs (loop7): group descriptors corrupted! [ 3161.666251] loop7: detected capacity change from 0 to 16383 [ 3161.675006] EXT4-fs (loop7): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 3161.675614] EXT4-fs (loop7): group descriptors corrupted! [ 3162.161541] ================================================================== [ 3162.162089] BUG: KASAN: use-after-free in __lock_acquire+0x42c9/0x5e70 [ 3162.162532] Read of size 8 at addr ffff88800e1c0998 by task syz-executor/13174 [ 3162.163035] [ 3162.163172] CPU: 0 PID: 13174 Comm: syz-executor Not tainted 6.1.0-rc3-next-20221107 #1 [ 3162.163719] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 3162.164284] Call Trace: [ 3162.164467] [ 3162.164630] dump_stack_lvl+0x8f/0xb7 [ 3162.164915] print_report+0x175/0x478 [ 3162.165190] ? __lock_acquire+0x42c9/0x5e70 [ 3162.165496] kasan_report+0xbf/0x1c0 [ 3162.165771] ? __lock_acquire+0x42c9/0x5e70 [ 3162.166081] __lock_acquire+0x42c9/0x5e70 [ 3162.166374] ? __pfx_mark_lock.part.0+0x10/0x10 [ 3162.166705] ? finish_task_switch.isra.0+0x22d/0x8a0 [ 3162.167064] ? __pfx___lock_acquire+0x10/0x10 [ 3162.167393] ? __switch_to+0x5c3/0xf30 [ 3162.167682] lock_acquire+0x1a6/0x530 [ 3162.167959] ? kmemleak_scan+0x1a0/0x1600 [ 3162.168264] ? __pfx_lock_acquire+0x10/0x10 [ 3162.168572] ? __call_rcu_common.constprop.0+0x589/0xa40 [ 3162.168952] ? __call_rcu_common.constprop.0+0x589/0xa40 [ 3162.169334] ? lockdep_hardirqs_on+0x7d/0x100 [ 3162.169657] ? _raw_spin_lock_irq+0x45/0x50 [ 3162.169960] _raw_spin_lock_irq+0x36/0x50 [ 3162.170827] ? kmemleak_scan+0x1a0/0x1600 [ 3162.172084] kmemleak_scan+0x1a0/0x1600 [ 3162.173601] ? __pfx_kmemleak_scan+0x10/0x10 [ 3162.174829] ? strncpy_from_user+0x208/0x3e0 [ 3162.175160] kmemleak_write+0x574/0x680 [ 3162.175451] ? __pfx_kmemleak_write+0x10/0x10 [ 3162.175782] ? debugfs_file_get+0x1d2/0x450 [ 3162.176093] ? __pfx_debugfs_file_get+0x10/0x10 [ 3162.176427] full_proxy_write+0x121/0x190 [ 3162.176733] vfs_write+0x2cf/0xd90 [ 3162.176988] ? __pfx_full_proxy_write+0x10/0x10 [ 3162.177323] ? __pfx_vfs_write+0x10/0x10 [ 3162.177611] ? lock_release+0x3b6/0x750 [ 3162.177892] ? __up_read+0x192/0x730 [ 3162.178164] ? handle_mm_fault+0x69a/0x970 [ 3162.178468] ? __pfx___up_read+0x10/0x10 [ 3162.178760] ? __fget_light+0x212/0x280 [ 3162.179059] ksys_write+0x12b/0x260 [ 3162.179352] ? __pfx_ksys_write+0x10/0x10 [ 3162.179653] ? syscall_enter_from_user_mode+0x21/0x50 [ 3162.180020] ? syscall_enter_from_user_mode+0x21/0x50 [ 3162.180393] do_syscall_64+0x3f/0x90 [ 3162.180669] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 3162.181031] RIP: 0033:0x7fc535b465c3 [ 3162.181282] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 3162.182498] RSP: 002b:00007fff3858bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3162.183015] RAX: ffffffffffffffda RBX: 00007fff3858c2b8 RCX: 00007fc535b465c3 [ 3162.183514] RDX: 0000000000000004 RSI: 00007fc535bfced9 RDI: 0000000000000003 [ 3162.184141] RBP: 0000000000000003 R08: 0000000000000c59 R09: 00007fff385de080 [ 3162.184791] R10: 00007fff385de090 R11: 0000000000000246 R12: 00007fc535b48b10 [ 3162.185438] R13: 00007fff3858cee4 R14: 0000000000000000 R15: 0000000000303e23 [ 3162.186106] [ 3162.186329] [ 3162.186493] Allocated by task 13175: [ 3162.186838] kasan_save_stack+0x22/0x50 [ 3162.187225] kasan_set_track+0x25/0x30 [ 3162.187599] __kasan_slab_alloc+0x5c/0x70 [ 3162.188000] kmem_cache_alloc+0x1b1/0x3e0 [ 3162.188390] __create_object+0x3d/0xc00 [ 3162.188776] kmem_cache_alloc_lru+0x2dc/0x740 [ 3162.189200] __d_alloc+0x31/0x9c0 [ 3162.189524] d_alloc_parallel+0x10e/0x1530 [ 3162.189923] lookup_open.isra.0+0x914/0x1250 [ 3162.190344] path_openat+0x946/0x29b0 [ 3162.190714] do_filp_open+0x1ba/0x410 [ 3162.191068] do_sys_openat2+0x171/0x4c0 [ 3162.191466] __x64_sys_openat+0x143/0x200 [ 3162.191809] do_syscall_64+0x3f/0x90 [ 3162.192064] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 3162.192407] [ 3162.192523] Freed by task 13: [ 3162.192738] kasan_save_stack+0x22/0x50 [ 3162.193010] kasan_set_track+0x25/0x30 [ 3162.193279] kasan_save_free_info+0x2e/0x50 [ 3162.193563] __kasan_slab_free+0x10a/0x190 [ 3162.193860] kmem_cache_free+0xfb/0x610 [ 3162.194127] rcu_core+0x7e2/0x2090 [ 3162.194372] __do_softirq+0x1c7/0x8f9 [ 3162.194627] [ 3162.194743] Last potentially related work creation: [ 3162.195083] kasan_save_stack+0x22/0x50 [ 3162.195369] __kasan_record_aux_stack+0x95/0xb0 [ 3162.195703] __call_rcu_common.constprop.0+0x6a/0xa40 [ 3162.196058] kmem_cache_free+0xc1/0x610 [ 3162.196346] rcu_core+0x7e2/0x2090 [ 3162.196613] __do_softirq+0x1c7/0x8f9 [ 3162.196880] [ 3162.197005] Second to last potentially related work creation: [ 3162.197396] kasan_save_stack+0x22/0x50 [ 3162.197682] __kasan_record_aux_stack+0x95/0xb0 [ 3162.198012] __call_rcu_common.constprop.0+0x6a/0xa40 [ 3162.198378] kmem_cache_free+0xc1/0x610 [ 3162.198661] kfree_skbmem+0xef/0x1b0 [ 3162.198927] kfree_skb_reason+0x147/0x3e0 [ 3162.199229] ieee80211_iface_work+0x353/0xc90 [ 3162.199538] process_one_work+0xa17/0x16a0 [ 3162.199830] worker_thread+0x63b/0x1260 [ 3162.200104] kthread+0x2f1/0x3a0 [ 3162.200365] ret_from_fork+0x2c/0x50 [ 3162.200641] [ 3162.200761] The buggy address belongs to the object at ffff88800e1c0980 [ 3162.200761] which belongs to the cache kmemleak_object of size 240 [ 3162.201616] The buggy address is located 24 bytes inside of [ 3162.201616] 240-byte region [ffff88800e1c0980, ffff88800e1c0a70) [ 3162.202408] [ 3162.202534] The buggy address belongs to the physical page: [ 3162.202914] page:00000000d6b59d1a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe1c0 [ 3162.203568] anon flags: 0x100000000000200(slab|node=0|zone=1) [ 3162.203972] raw: 0100000000000200 ffff88800804f780 ffffea000055e400 dead000000000005 [ 3162.204499] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000 [ 3162.205030] page dumped because: kasan: bad access detected [ 3162.205414] [ 3162.205536] Memory state around the buggy address: [ 3162.205880] ffff88800e1c0880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3162.206374] ffff88800e1c0900: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 3162.206861] >ffff88800e1c0980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3162.207361] ^ [ 3162.207653] ffff88800e1c0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 3162.208151] ffff88800e1c0a80: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00 [ 3162.208647] ================================================================== [ 3162.209140] Disabling lock debugging due to kernel taint VM DIAGNOSIS: 06:58:32 Registers: info registers vcpu 0 RAX=0000000000000034 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82466bc5 RDI=ffffffff87bb39a0 RBP=ffffffff87bb3960 RSP=ffff8880201e7248 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000034 R11=0000000000000001 R12=0000000000000034 R13=ffffffff87bb3960 R14=0000000000000010 R15=ffffffff82466bb0 RIP=ffffffff82466c1d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555559b2400 00000000 00000000 GS =0000 ffff88806d000000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe6c96494000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe6c96492000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f708f90d650 CR3=000000000d9fe000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=7465677261742e79636e656772656d65 XMM02=ffffffffffffffffffffffffff0f0e0d XMM03=35706f6f6c2f6b636f6c622f6c617574 XMM04=40404040404040404040404040404040 XMM05=5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a XMM06=20202020202020202020202020202020 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000ff00ff000000 XMM10=00000000000000000000200020000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=dffffc0000000000 RBX=ffffffff81180449 RCX=0000000000000000 RDX=1ffff1100da2131f RSI=ffff88806d109fe0 RDI=ffffffff81180449 RBP=ffffffff81180449 RSP=ffff88806d109850 R8 =ffffffff85e5c73e R9 =ffffffff85e5c742 R10=ffffed100da21321 R11=ffff88806d1098e0 R12=0000000000000001 R13=0000000000000000 R14=ffff888043b95040 R15=ffff888009147130 RIP=ffffffff811e9152 RFL=00000283 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f708f38b8c0 00000000 00000000 GS =0000 ffff88806d100000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe4a786fd000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe4a786fb000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f708f7a3ae0 CR3=000000000e094000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff4ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=732f736761742f766564752f6e75722f XMM01=646d65747379732f736761742f766564 XMM02=ffff0000ff0000000000000000000000 XMM03=000000000000000000ff000000000000 XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=ffffffffffff00000000000000000000 XMM06=00000000000065616124242f6867632f XMM07=00000000000000000000000000000000 XMM08=20202020203a657a697320656c696600 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000