TOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:16 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x0, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1854.783116] loop4: detected capacity change from 0 to 40
23:23:16 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1854.924649] loop1: detected capacity change from 0 to 40
[ 1854.942048] syz-executor.4: attempt to access beyond end of device
[ 1854.942048] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1854.943060] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1854.959517] loop5: detected capacity change from 0 to 40
[ 1854.974139] FAT-fs (loop5): bogus number of reserved sectors
[ 1854.974674] FAT-fs (loop5): Can't find a valid FAT filesystem
23:23:16 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1855.085172] loop4: detected capacity change from 0 to 40
23:23:17 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x0, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:17 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:17 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x0, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:17 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:17 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1855.220442] syz-executor.4: attempt to access beyond end of device
[ 1855.220442] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1855.221585] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1855.238813] loop6: detected capacity change from 0 to 40
[ 1855.267939] FAT-fs (loop6): bogus number of reserved sectors
[ 1855.268572] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 1855.270626] loop2: detected capacity change from 0 to 40
[ 1855.275243] loop0: detected capacity change from 0 to 40
[ 1855.297413] FAT-fs (loop2): bogus number of reserved sectors
[ 1855.298019] FAT-fs (loop2): Can't find a valid FAT filesystem
23:23:17 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x0, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:17 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1855.365719] loop4: detected capacity change from 0 to 40
23:23:17 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1855.474103] syz-executor.0: attempt to access beyond end of device
[ 1855.474103] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1855.475346] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 1855.629113] loop4: detected capacity change from 0 to 40
[ 1872.789143] loop2: detected capacity change from 0 to 40
[ 1872.795398] loop1: detected capacity change from 0 to 40
[ 1872.802184] loop5: detected capacity change from 0 to 40
[ 1872.803400] loop6: detected capacity change from 0 to 40
[ 1872.804598] loop4: detected capacity change from 0 to 40
[ 1872.815435] FAT-fs (loop5): bogus number of reserved sectors
[ 1872.815902] FAT-fs (loop5): Can't find a valid FAT filesystem
23:23:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:23:34 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(0xffffffffffffffff, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:34 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1872.847413] FAT-fs (loop2): bogus number of reserved sectors
[ 1872.848461] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 1872.852783] FAT-fs (loop6): bogus number of reserved sectors
[ 1872.853910] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 1872.860414] loop0: detected capacity change from 0 to 40
[ 1872.875838] FAT-fs (loop0): bogus number of reserved sectors
[ 1872.876458] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 1872.879555] loop3: detected capacity change from 0 to 40
23:23:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, 0x0, 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:34 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1873.006921] loop4: detected capacity change from 0 to 40
23:23:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:50 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:50 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(0xffffffffffffffff, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:50 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:50 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:50 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:50 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:23:50 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, 0x0, 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1888.165640] loop4: detected capacity change from 0 to 40
[ 1888.168301] loop1: detected capacity change from 0 to 40
[ 1888.171332] loop3: detected capacity change from 0 to 40
[ 1888.173784] loop5: detected capacity change from 0 to 40
[ 1888.176245] loop0: detected capacity change from 0 to 40
[ 1888.198650] FAT-fs (loop0): bogus number of reserved sectors
[ 1888.199163] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 1888.199388] loop6: detected capacity change from 0 to 40
[ 1888.199733] FAT-fs (loop5): bogus number of reserved sectors
[ 1888.200844] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 1888.203963] FAT-fs (loop3): bogus number of reserved sectors
[ 1888.204895] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 1888.220138] FAT-fs (loop6): bogus number of reserved sectors
[ 1888.221017] FAT-fs (loop6): Can't find a valid FAT filesystem
23:23:50 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:23:50 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1888.438560] loop2: detected capacity change from 0 to 40
[ 1888.622087] syz-executor.2: attempt to access beyond end of device
[ 1888.622087] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1888.623881] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:24:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:24:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, 0x0, 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:24:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 1904.070999] loop0: detected capacity change from 0 to 40
[ 1904.072145] loop2: detected capacity change from 0 to 40
[ 1904.073618] loop3: detected capacity change from 0 to 40
[ 1904.082555] loop1: detected capacity change from 0 to 40
[ 1904.091014] loop4: detected capacity change from 0 to 40
[ 1904.100376] FAT-fs (loop2): bogus number of reserved sectors
[ 1904.101160] FAT-fs (loop2): Can't find a valid FAT filesystem
23:24:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:24:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:06 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:06 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1904.108202] loop6: detected capacity change from 0 to 40
[ 1904.112782] FAT-fs (loop6): bogus number of reserved sectors
[ 1904.113202] FAT-fs (loop3): bogus number of reserved sectors
[ 1904.113233] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 1904.114108] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 1904.140147] loop5: detected capacity change from 0 to 40
[ 1904.179233] FAT-fs (loop5): bogus number of reserved sectors
[ 1904.180149] FAT-fs (loop5): Can't find a valid FAT filesystem
23:24:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
r3 = dup(0xffffffffffffffff)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:24:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)

23:24:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1904.268959] loop0: detected capacity change from 0 to 40
23:24:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1904.281755] FAT-fs (loop0): bogus number of reserved sectors
[ 1904.282200] FAT-fs (loop0): Can't find a valid FAT filesystem
23:24:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
write$bt_hci(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)

[ 1904.379565] loop0: detected capacity change from 0 to 40
[ 1904.383910] FAT-fs (loop0): bogus number of reserved sectors
[ 1904.384424] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 1904.389000] loop6: detected capacity change from 0 to 40
[ 1904.396049] loop3: detected capacity change from 0 to 40
[ 1904.406106] loop2: detected capacity change from 0 to 40
[ 1904.411733] FAT-fs (loop3): bogus number of reserved sectors
[ 1904.412191] FAT-fs (loop3): Can't find a valid FAT filesystem
23:24:06 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1904.420812] FAT-fs (loop2): bogus number of reserved sectors
[ 1904.421410] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 1904.482638] loop4: detected capacity change from 0 to 40
[ 1904.498982] syz-executor.6: attempt to access beyond end of device
[ 1904.498982] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1904.500003] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1904.654019] syz-executor.4: attempt to access beyond end of device
[ 1904.654019] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1904.656113] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1920.515302] loop4: detected capacity change from 0 to 40
23:24:22 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x208100, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
write$bt_hci(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
openat(r0, &(0x7f00000003c0)='\x00', 0x688102, 0x8)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:24:22 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, 0x0, 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:22 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
openat(r0, &(0x7f00000003c0)='\x00', 0x688102, 0x8)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1920.531611] loop1: detected capacity change from 0 to 40
[ 1920.538341] loop5: detected capacity change from 0 to 40
[ 1920.548323] loop0: detected capacity change from 0 to 40
[ 1920.558961] FAT-fs (loop5): bogus number of reserved sectors
[ 1920.560079] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 1920.582464] loop2: detected capacity change from 0 to 40
[ 1920.590626] FAT-fs (loop0): bogus number of reserved sectors
[ 1920.591755] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 1920.608451] loop6: detected capacity change from 0 to 40
[ 1920.609587] syz-executor.4: attempt to access beyond end of device
[ 1920.609587] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1920.611705] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1920.615906] loop3: detected capacity change from 0 to 40
23:24:22 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
openat(r0, &(0x7f00000003c0)='\x00', 0x688102, 0x8)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1920.854973] syz-executor.3: attempt to access beyond end of device
[ 1920.854973] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1920.856926] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:24:22 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1920.891619] syz-executor.6: attempt to access beyond end of device
[ 1920.891619] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1920.893607] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:24:22 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1921.037489] loop2: detected capacity change from 0 to 40
[ 1921.047812] loop4: detected capacity change from 0 to 40
[ 1921.169153] syz-executor.4: attempt to access beyond end of device
[ 1921.169153] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1921.171019] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:24:23 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:23 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x208100, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1921.250776] syz-executor.2: attempt to access beyond end of device
[ 1921.250776] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1921.252787] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 1921.271661] loop3: detected capacity change from 0 to 40
[ 1921.362042] loop6: detected capacity change from 0 to 40
[ 1921.382192] FAT-fs (loop6): bogus number of reserved sectors
[ 1921.383209] FAT-fs (loop6): Can't find a valid FAT filesystem
23:24:23 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:23 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:24:23 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x208100, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1921.458120] syz-executor.3: attempt to access beyond end of device
[ 1921.458120] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1921.460597] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:24:23 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1921.659791] loop4: detected capacity change from 0 to 40
[ 1921.696581] loop2: detected capacity change from 0 to 40
[ 1921.808205] loop1: detected capacity change from 0 to 40
[ 1921.848904] syz-executor.4: attempt to access beyond end of device
[ 1921.848904] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1921.851463] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1921.918875] syz-executor.2: attempt to access beyond end of device
[ 1921.918875] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1921.920717] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:24:41 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:24:41 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)

23:24:41 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:41 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:41 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
openat(r0, &(0x7f00000003c0)='\x00', 0x688102, 0x8)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$nl_netfilter(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, 0xe, 0xa, 0x801, 0x70bd28, 0x25dfdbfd, {0xa, 0x0, 0x5}, [@generic="dd8703", @nested={0xc, 0x4f, 0x0, 0x1, [@typed={0x8, 0x2a, 0x0, 0x0, @uid=0xffffffffffffffff}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x811)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:41 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = dup(r1)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
bind$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0xfff, @none, 0x1fa2}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x9}, 0xe)

23:24:41 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:41 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
openat(r0, &(0x7f00000003c0)='\x00', 0x688102, 0x8)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$nl_netfilter(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, 0xe, 0xa, 0x801, 0x70bd28, 0x25dfdbfd, {0xa, 0x0, 0x5}, [@generic="dd8703", @nested={0xc, 0x4f, 0x0, 0x1, [@typed={0x8, 0x2a, 0x0, 0x0, @uid=0xffffffffffffffff}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x811)
r3 = io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
ioctl$F2FS_IOC_ABORT_VOLATILE_WRITE(r3, 0xf505, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1939.152927] loop3: detected capacity change from 0 to 40
[ 1939.202606] loop6: detected capacity change from 0 to 40
[ 1939.238483] loop4: detected capacity change from 0 to 40
[ 1939.241528] loop2: detected capacity change from 0 to 40
[ 1939.271661] loop5: detected capacity change from 0 to 40
[ 1939.273396] loop1: detected capacity change from 0 to 40
[ 1939.303405] FAT-fs (loop6): bogus number of reserved sectors
[ 1939.304409] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 1939.318537] syz-executor.3: attempt to access beyond end of device
[ 1939.318537] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1939.320466] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 1939.340365] FAT-fs (loop5): bogus number of reserved sectors
[ 1939.341379] FAT-fs (loop5): Can't find a valid FAT filesystem
23:24:41 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
r3 = dup(0xffffffffffffffff)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, r3, 0x2)

[ 1939.460452] syz-executor.4: attempt to access beyond end of device
[ 1939.460452] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1939.462595] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:24:41 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1939.558573] syz-executor.2: attempt to access beyond end of device
[ 1939.558573] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1939.560668] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:24:41 executing program 6:
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = dup(r0)
bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)

[ 1939.712808] loop3: detected capacity change from 0 to 40
[ 1939.720992] FAT-fs (loop3): bogus number of reserved sectors
[ 1939.721986] FAT-fs (loop3): Can't find a valid FAT filesystem
23:24:41 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:41 executing program 3:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = dup(r1)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
bind$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0xfff, @none, 0x1fa2}, 0xe)
fcntl$setstatus(r0, 0x4, 0x800)

23:24:41 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

[ 1939.975860] loop4: detected capacity change from 0 to 40
23:24:42 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:24:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

[ 1940.157071] syz-executor.4: attempt to access beyond end of device
[ 1940.157071] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1940.158916] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1940.182136] loop2: detected capacity change from 0 to 40
23:24:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:42 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

[ 1940.285108] loop6: detected capacity change from 0 to 40
23:24:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:42 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:24:42 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 1)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:24:42 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 1940.348156] loop5: detected capacity change from 0 to 40
[ 1940.351633] loop0: detected capacity change from 0 to 40
[ 1940.357426] loop4: detected capacity change from 0 to 40
[ 1940.369495] FAT-fs (loop5): bogus number of reserved sectors
[ 1940.370361] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 1940.402445] loop1: detected capacity change from 0 to 40
[ 1940.450780] loop3: detected capacity change from 0 to 40
[ 1940.507104] syz-executor.4: attempt to access beyond end of device
[ 1940.507104] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1940.510626] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:25:08 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:08 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:25:08 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x0, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1966.876248] loop1: detected capacity change from 0 to 40
[ 1966.878012] loop5: detected capacity change from 0 to 40
23:25:08 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

23:25:08 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

23:25:08 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

[ 1966.887233] loop4: detected capacity change from 0 to 40
[ 1966.889635] loop6: detected capacity change from 0 to 40
[ 1966.892120] loop2: detected capacity change from 0 to 40
[ 1966.895996] FAT-fs (loop5): bogus number of reserved sectors
[ 1966.896722] FAT-fs (loop5): Can't find a valid FAT filesystem
23:25:08 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 2)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:25:08 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1966.919681] loop3: detected capacity change from 0 to 40
[ 1966.925503] loop0: detected capacity change from 0 to 40
[ 1966.983560] syz-executor.4: attempt to access beyond end of device
[ 1966.983560] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1966.984894] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1967.152237] syz-executor.2: attempt to access beyond end of device
[ 1967.152237] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1967.153610] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 1967.196751] syz-executor.6: attempt to access beyond end of device
[ 1967.196751] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1967.198818] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1967.214114] syz-executor.0: attempt to access beyond end of device
[ 1967.214114] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1967.216503] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:25:24 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:24 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:24 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:24 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:25:24 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 3)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 1982.586817] loop4: detected capacity change from 0 to 40
[ 1982.588603] loop2: detected capacity change from 0 to 40
[ 1982.589177] loop0: detected capacity change from 0 to 40
23:25:24 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

23:25:24 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

23:25:24 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

[ 1982.609857] loop6: detected capacity change from 0 to 40
[ 1982.622195] loop5: detected capacity change from 0 to 40
[ 1982.659369] loop1: detected capacity change from 0 to 40
[ 1982.668196] FAT-fs (loop5): bogus number of reserved sectors
[ 1982.669104] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 1982.678383] loop3: detected capacity change from 0 to 40
23:25:24 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

23:25:24 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

[ 1982.752471] FAULT_INJECTION: forcing a failure.
[ 1982.752471] name fail_usercopy, interval 1, probability 0, space 0, times 1
[ 1982.755774] CPU: 0 PID: 9094 Comm: syz-executor.3 Not tainted 5.19.0-next-20220805 #1
[ 1982.757280] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1982.759266] Call Trace:
[ 1982.759742]  <TASK>
[ 1982.760165]  dump_stack_lvl+0x8b/0xb3
[ 1982.760684]  should_fail.cold+0x5/0xa
[ 1982.761201]  copyout+0x19/0x120
[ 1982.761602]  _copy_to_iter+0x576/0x1430
[ 1982.762075]  ? find_held_lock+0x2c/0x110
[ 1982.762643]  ? csum_and_copy_to_iter+0x17b0/0x17b0
[ 1982.763351]  ? lock_release+0x3b2/0x750
[ 1982.763831]  ? dev_seq_stop+0x1a/0xa0
[ 1982.764283]  ? lock_downgrade+0x6d0/0x6d0
[ 1982.764765]  ? dev_mc_seq_show+0x1d1/0x2b0
[ 1982.765257]  ? __local_bh_enable_ip+0xa0/0x130
[ 1982.765816]  ? __virt_addr_valid+0xfe/0x340
[ 1982.766324]  ? __check_object_size+0x380/0x800
[ 1982.766919]  seq_read_iter+0xdcb/0x12b0
[ 1982.767524]  seq_read+0x16d/0x210
[ 1982.767928]  ? seq_read_iter+0x12b0/0x12b0
[ 1982.768431]  ? lock_is_held_type+0xd7/0x130
[ 1982.768951]  ? fsnotify_perm.part.0+0x221/0x610
[ 1982.769501]  ? seq_read_iter+0x12b0/0x12b0
[ 1982.770026]  proc_reg_read+0x22a/0x300
[ 1982.770459]  vfs_read+0x253/0x930
[ 1982.770813]  ? proc_reg_unlocked_ioctl+0x2f0/0x2f0
[ 1982.771522]  ? kernel_read+0x1c0/0x1c0
[ 1982.771971]  ? perf_trace_run_bpf_submit+0xf5/0x1d0
[ 1982.772561]  ? __fget_files+0x270/0x450
[ 1982.773046]  __x64_sys_pread64+0x1fb/0x260
[ 1982.773530]  ? vfs_read+0x930/0x930
[ 1982.773941]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1982.774498]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1982.775071]  do_syscall_64+0x3b/0x90
[ 1982.775527]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 1982.776105] RIP: 0033:0x7fe81b412b19
[ 1982.776517] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1982.778557] RSP: 002b:00007fe818988188 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
[ 1982.779295] RAX: ffffffffffffffda RBX: 00007fe81b525f60 RCX: 00007fe81b412b19
[ 1982.780120] RDX: 00000000000000ea RSI: 0000000020000180 RDI: 0000000000000008
[ 1982.780810] RBP: 00007fe8189881d0 R08: 0000000000000000 R09: 0000000000000000
[ 1982.781617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1982.782433] R13: 00007ffec58e617f R14: 00007fe818988300 R15: 0000000000022000
[ 1982.783236]  </TASK>
[ 1982.824609] syz-executor.4: attempt to access beyond end of device
[ 1982.824609] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1982.826442] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1982.866732] loop2: detected capacity change from 0 to 40
23:25:24 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

[ 1982.911651] loop0: detected capacity change from 0 to 40
23:25:24 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 4)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:25:24 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0x0)

23:25:24 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1983.015575] loop3: detected capacity change from 0 to 40
[ 1983.043932] syz-executor.0: attempt to access beyond end of device
[ 1983.043932] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1983.045614] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 1983.059192] loop6: detected capacity change from 0 to 40
[ 1983.073769] FAULT_INJECTION: forcing a failure.
[ 1983.073769] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1983.075685] CPU: 1 PID: 9104 Comm: syz-executor.3 Not tainted 5.19.0-next-20220805 #1
[ 1983.076477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1983.077578] Call Trace:
[ 1983.077847]  <TASK>
[ 1983.078089]  dump_stack_lvl+0x8b/0xb3
[ 1983.078496]  should_fail.cold+0x5/0xa
[ 1983.078896]  _copy_to_user+0x2a/0x140
[ 1983.079296]  simple_read_from_buffer+0xcc/0x160
[ 1983.079787]  proc_fail_nth_read+0x198/0x230
[ 1983.080230]  ? proc_exe_link+0x1e0/0x1e0
[ 1983.080650]  ? security_file_permission+0xb1/0xe0
[ 1983.081159]  vfs_read+0x253/0x930
[ 1983.081525]  ? proc_exe_link+0x1e0/0x1e0
[ 1983.081940]  ? kernel_read+0x1c0/0x1c0
[ 1983.082348]  ? __fget_files+0x270/0x450
[ 1983.082774]  ksys_read+0x127/0x250
[ 1983.083145]  ? __ia32_sys_pwrite64+0x220/0x220
[ 1983.083636]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1983.084166]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1983.084698]  do_syscall_64+0x3b/0x90
[ 1983.085092]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 1983.085622] RIP: 0033:0x7fe81b3c569c
[ 1983.086007] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
[ 1983.087824] RSP: 002b:00007fe818988170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 1983.088587] RAX: ffffffffffffffda RBX: 00000000000000ea RCX: 00007fe81b3c569c
[ 1983.089296] RDX: 000000000000000f RSI: 00007fe8189881e0 RDI: 0000000000000009
[ 1983.090009] RBP: 00007fe8189881d0 R08: 0000000000000000 R09: 0000000000000000
[ 1983.090714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1983.091442] R13: 00007ffec58e617f R14: 00007fe818988300 R15: 0000000000022000
[ 1983.092186]  </TASK>
[ 1983.104630] syz-executor.2: attempt to access beyond end of device
[ 1983.104630] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1983.106092] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:25:25 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 5)

[ 1983.150515] loop4: detected capacity change from 0 to 40
[ 1983.174578] loop0: detected capacity change from 0 to 40
23:25:25 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0x0)

[ 1983.356200] syz-executor.4: attempt to access beyond end of device
[ 1983.356200] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1983.357702] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:25:39 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 6)

23:25:39 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0x0)

23:25:39 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 5)

[ 1997.977893] loop0: detected capacity change from 0 to 40
23:25:39 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:25:39 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:39 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:39 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:39 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1998.003335] loop1: detected capacity change from 0 to 40
[ 1998.006638] loop6: detected capacity change from 0 to 40
[ 1998.007144] loop4: detected capacity change from 0 to 40
[ 1998.009349] loop5: detected capacity change from 0 to 40
[ 1998.020528] FAT-fs (loop5): bogus number of reserved sectors
[ 1998.020992] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 1998.024712] loop2: detected capacity change from 0 to 40
[ 1998.028676] loop3: detected capacity change from 0 to 40
[ 1998.102593] syz-executor.0: attempt to access beyond end of device
[ 1998.102593] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.103831] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:25:40 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 7)

[ 1998.179237] loop0: detected capacity change from 0 to 40
[ 1998.216006] syz-executor.0: attempt to access beyond end of device
[ 1998.216006] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.217046] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 1998.237189] syz-executor.4: attempt to access beyond end of device
[ 1998.237189] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.239140] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:25:40 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 8)

23:25:40 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 1)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:25:40 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xb8, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:25:40 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 6)

[ 1998.319945] syz-executor.6: attempt to access beyond end of device
[ 1998.319945] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.322436] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:25:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1998.401105] loop0: detected capacity change from 0 to 40
[ 1998.412610] loop4: detected capacity change from 0 to 40
23:25:40 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 2)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 1998.481694] loop3: detected capacity change from 0 to 40
[ 1998.523260] syz-executor.4: attempt to access beyond end of device
[ 1998.523260] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.523556] loop2: detected capacity change from 0 to 40
[ 1998.524878] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:25:40 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7, 0x0, 0x0, 0x2, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1998.587193] syz-executor.0: attempt to access beyond end of device
[ 1998.587193] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.588818] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 1998.615646] loop3: detected capacity change from 0 to 40
23:25:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:40 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 9)

[ 1998.704422] loop4: detected capacity change from 0 to 40
[ 1998.740726] loop6: detected capacity change from 0 to 40
[ 1998.760104] syz-executor.2: attempt to access beyond end of device
[ 1998.760104] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.761962] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 1998.778964] loop0: detected capacity change from 0 to 40
23:25:40 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 3)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:25:40 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 7)

[ 1998.856636] syz-executor.4: attempt to access beyond end of device
[ 1998.856636] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.858885] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:25:40 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0x142, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 1998.925138] syz-executor.0: attempt to access beyond end of device
[ 1998.925138] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.926660] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:25:40 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1998.969955] syz-executor.6: attempt to access beyond end of device
[ 1998.969955] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1998.971089] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1998.983533] loop2: detected capacity change from 0 to 40
[ 1998.986624] loop3: detected capacity change from 0 to 40
[ 1998.990170] FAULT_INJECTION: forcing a failure.
[ 1998.990170] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1998.991916] CPU: 0 PID: 9164 Comm: syz-executor.7 Not tainted 5.19.0-next-20220805 #1
[ 1998.993036] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1998.994611] Call Trace:
[ 1998.994995]  <TASK>
[ 1998.995338]  dump_stack_lvl+0x8b/0xb3
[ 1998.995910]  should_fail.cold+0x5/0xa
[ 1998.996465]  copyout+0x19/0x120
[ 1998.996967]  _copy_to_iter+0x576/0x1430
[ 1998.997563]  ? find_held_lock+0x2c/0x110
[ 1998.998145]  ? csum_and_copy_to_iter+0x17b0/0x17b0
[ 1998.998854]  ? lock_release+0x3b2/0x750
[ 1998.999434]  ? dev_seq_stop+0x1a/0xa0
[ 1999.000008]  ? lock_downgrade+0x6d0/0x6d0
[ 1999.000614]  ? dev_mc_seq_show+0x1d1/0x2b0
[ 1999.001226]  ? __local_bh_enable_ip+0xa0/0x130
[ 1999.001893]  ? __virt_addr_valid+0xfe/0x340
[ 1999.002530]  ? __check_object_size+0x380/0x800
[ 1999.003196]  seq_read_iter+0xdcb/0x12b0
[ 1999.003822]  seq_read+0x16d/0x210
[ 1999.004335]  ? seq_read_iter+0x12b0/0x12b0
[ 1999.004953]  ? lock_is_held_type+0xd7/0x130
[ 1999.005605]  ? fsnotify_perm.part.0+0x221/0x610
[ 1999.006286]  ? seq_read_iter+0x12b0/0x12b0
[ 1999.006865]  proc_reg_read+0x22a/0x300
[ 1999.007447]  vfs_read+0x253/0x930
[ 1999.007969]  ? proc_reg_unlocked_ioctl+0x2f0/0x2f0
[ 1999.008677]  ? kernel_read+0x1c0/0x1c0
[ 1999.009248]  ? perf_trace_run_bpf_submit+0xf5/0x1d0
[ 1999.009973]  ? __fget_files+0x270/0x450
[ 1999.010558]  __x64_sys_pread64+0x1fb/0x260
[ 1999.011170]  ? vfs_read+0x930/0x930
[ 1999.011705]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1999.012446]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 1999.013184]  do_syscall_64+0x3b/0x90
[ 1999.013727]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 1999.014463] RIP: 0033:0x7fc7de67fb19
[ 1999.014996] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1999.017494] RSP: 002b:00007fc7dbbf5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
[ 1999.018547] RAX: ffffffffffffffda RBX: 00007fc7de792f60 RCX: 00007fc7de67fb19
[ 1999.019527] RDX: 00000000000000ea RSI: 0000000020000180 RDI: 0000000000000007
[ 1999.020521] RBP: 00007fc7dbbf51d0 R08: 0000000000000000 R09: 0000000000000000
[ 1999.021501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1999.022499] R13: 00007ffd071977ff R14: 00007fc7dbbf5300 R15: 0000000000022000
[ 1999.023505]  </TASK>
[ 1999.036438] loop3: detected capacity change from 0 to 40
[ 1999.065504] loop1: detected capacity change from 0 to 40
23:25:55 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:55 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 8)

23:25:55 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000440)=[{&(0x7f0000002640)="601c6d6b646f7366d8a02b00080101000440002000f8012de0478accedfd18aeb9692a15b8802c8b06fb6906202a936446ee68a90b015472aff7c47385d30787968b9411028051038a67b6bc4c0b0407bebda097ad8506e8edb9c993677b2e7fd9d04e60eb61f3334e0d1aa626d604eab0ed568fc9a3929af0942d7eb5019d", 0x7f}, {0x0, 0x0, 0x2800}], 0x120009, &(0x7f0000000200)=ANY=[@ANYRESDEC=0x0])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80))
mknodat$loop(r3, &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x1)
openat(r3, &(0x7f00000001c0)='./file1\x00', 0x2, 0x10)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r4, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
readv(r4, &(0x7f00000025c0)=[{&(0x7f0000000000)=""/31, 0x1f}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000040)=""/24, 0x18}, {&(0x7f0000000300)=""/145, 0x91}, {&(0x7f0000000180)=""/36, 0x24}, {&(0x7f00000003c0)=""/123, 0x7b}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/159, 0x9f}], 0x8)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0xe6fc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:55 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0) (fail_nth: 4)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:25:55 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:55 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x0)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:55 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 10)

23:25:55 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0x7ffffffff000, 0x0)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2014.016219] loop5: detected capacity change from 0 to 40
[ 2014.016733] loop4: detected capacity change from 0 to 40
[ 2014.020227] loop6: detected capacity change from 0 to 40
[ 2014.022686] loop2: detected capacity change from 0 to 40
[ 2014.023055] loop0: detected capacity change from 0 to 40
[ 2014.024931] loop1: detected capacity change from 0 to 40
[ 2014.029044] loop3: detected capacity change from 0 to 40
[ 2014.051019] FAT-fs (loop5): bogus number of reserved sectors
[ 2014.052100] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2014.064825] FAULT_INJECTION: forcing a failure.
[ 2014.064825] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 2014.066839] CPU: 1 PID: 9193 Comm: syz-executor.7 Not tainted 5.19.0-next-20220805 #1
[ 2014.067885] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 2014.069390] Call Trace:
[ 2014.069746]  <TASK>
[ 2014.070062]  dump_stack_lvl+0x8b/0xb3
[ 2014.070606]  should_fail.cold+0x5/0xa
[ 2014.071146]  _copy_to_user+0x2a/0x140
[ 2014.071678]  simple_read_from_buffer+0xcc/0x160
[ 2014.072333]  proc_fail_nth_read+0x198/0x230
[ 2014.072929]  ? proc_exe_link+0x1e0/0x1e0
[ 2014.073487]  ? security_file_permission+0xb1/0xe0
[ 2014.074337]  vfs_read+0x253/0x930
[ 2014.074854]  ? proc_exe_link+0x1e0/0x1e0
[ 2014.075440]  ? kernel_read+0x1c0/0x1c0
[ 2014.076024]  ? __fget_files+0x270/0x450
[ 2014.076621]  ksys_read+0x127/0x250
[ 2014.077146]  ? __ia32_sys_pwrite64+0x220/0x220
[ 2014.077814]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2014.078540]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2014.079277]  do_syscall_64+0x3b/0x90
[ 2014.079826]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 2014.080581] RIP: 0033:0x7fc7de63269c
[ 2014.081108] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
[ 2014.083835] RSP: 002b:00007fc7dbbf5170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 2014.084842] RAX: ffffffffffffffda RBX: 00000000000000ea RCX: 00007fc7de63269c
[ 2014.085781] RDX: 000000000000000f RSI: 00007fc7dbbf51e0 RDI: 0000000000000008
[ 2014.086713] RBP: 00007fc7dbbf51d0 R08: 0000000000000000 R09: 0000000000000000
[ 2014.087656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2014.088595] R13: 00007ffd071977ff R14: 00007fc7dbbf5300 R15: 0000000000022000
[ 2014.089572]  </TASK>
[ 2014.114996] loop3: detected capacity change from 0 to 40
[ 2014.153267] bio_check_eod: 1 callbacks suppressed
[ 2014.154472] syz-executor.2: attempt to access beyond end of device
[ 2014.154472] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.156497] buffer_io_error: 1 callbacks suppressed
[ 2014.156513] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:25:56 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 9)

[ 2014.271092] syz-executor.4: attempt to access beyond end of device
[ 2014.271092] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.272938] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2014.274603] syz-executor.0: attempt to access beyond end of device
[ 2014.274603] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.276489] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:25:56 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x2)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2014.405621] loop2: detected capacity change from 0 to 40
[ 2014.487311] loop3: detected capacity change from 0 to 40
23:25:56 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:25:56 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:25:56 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 11)

[ 2014.572252] loop3: detected capacity change from 0 to 40
[ 2014.611704] loop0: detected capacity change from 0 to 40
[ 2014.656719] syz-executor.2: attempt to access beyond end of device
[ 2014.656719] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.658220] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2014.665098] loop4: detected capacity change from 0 to 40
[ 2014.811829] syz-executor.4: attempt to access beyond end of device
[ 2014.811829] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.813167] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2014.820685] syz-executor.0: attempt to access beyond end of device
[ 2014.820685] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.822510] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2014.894494] loop6: detected capacity change from 0 to 40
23:26:11 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 12)

23:26:11 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x3)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:11 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 10)

23:26:11 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:11 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xb8, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:26:11 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2029.674161] loop3: detected capacity change from 0 to 40
[ 2029.674181] loop1: detected capacity change from 0 to 40
[ 2029.689010] loop2: detected capacity change from 0 to 40
[ 2029.694076] loop5: detected capacity change from 0 to 40
23:26:11 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80))
mknodat$loop(r1, &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x1)
openat(r1, &(0x7f0000000000)='./file0\x00', 0xa8302, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
accept$unix(r2, &(0x7f0000000180), &(0x7f0000000300)=0x6e)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r0, 0x0, 0xfffffdef)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x0, 0x80, 0x0, 0xf8, 0x0, 0x7, 0x420, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0xfcbb, 0x0, @perf_config_ext={0x9, 0x7fffffff}, 0x202, 0x3334, 0x33, 0x3, 0x20dace77, 0x10, 0x6, 0x0, 0x3f, 0x0, 0xffffffffffffffe0}, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x8)
r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r6 = dup(r5)
bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r6, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r6, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4, {r3}}, './file0\x00'})

23:26:11 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2029.716527] loop0: detected capacity change from 0 to 40
[ 2029.726168] FAT-fs (loop5): bogus number of reserved sectors
[ 2029.726923] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2029.730651] loop4: detected capacity change from 0 to 40
[ 2029.734006] loop6: detected capacity change from 0 to 40
[ 2029.743589] loop3: detected capacity change from 0 to 40
[ 2029.793698] syz-executor.2: attempt to access beyond end of device
[ 2029.793698] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2029.794904] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2029.809739] syz-executor.0: attempt to access beyond end of device
[ 2029.809739] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2029.811060] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:26:11 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 13)

23:26:11 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 11)

[ 2029.917298] loop2: detected capacity change from 0 to 40
[ 2029.927925] loop0: detected capacity change from 0 to 40
23:26:11 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0x142, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2029.979050] syz-executor.4: attempt to access beyond end of device
[ 2029.979050] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2029.980918] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:26:11 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2030.021597] syz-executor.2: attempt to access beyond end of device
[ 2030.021597] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.022866] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2030.029155] loop3: detected capacity change from 0 to 40
[ 2030.030257] syz-executor.6: attempt to access beyond end of device
[ 2030.030257] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
23:26:12 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 14)

23:26:12 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 12)

[ 2030.105021] loop0: detected capacity change from 0 to 40
[ 2030.136247] loop2: detected capacity change from 0 to 40
[ 2030.141726] loop3: detected capacity change from 0 to 40
23:26:12 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0x7ffffffff000, 0x0)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2030.162246] syz-executor.0: attempt to access beyond end of device
[ 2030.162246] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.163601] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2030.224137] syz-executor.2: attempt to access beyond end of device
[ 2030.224137] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.225216] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:26:28 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 15)

23:26:28 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:28 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:28 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2046.123373] loop2: detected capacity change from 0 to 40
23:26:28 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 13)

23:26:28 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:28 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x5)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:28 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x2)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2046.144154] loop5: detected capacity change from 0 to 40
[ 2046.150562] loop3: detected capacity change from 0 to 40
[ 2046.171526] loop1: detected capacity change from 0 to 40
[ 2046.174640] FAT-fs (loop5): bogus number of reserved sectors
[ 2046.175476] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2046.177203] loop3: detected capacity change from 0 to 40
[ 2046.179796] loop6: detected capacity change from 0 to 40
[ 2046.213703] loop4: detected capacity change from 0 to 40
[ 2046.216715] loop0: detected capacity change from 0 to 40
23:26:28 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 14)

[ 2046.386846] loop2: detected capacity change from 0 to 40
[ 2046.412691] syz-executor.0: attempt to access beyond end of device
[ 2046.412691] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.414937] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:26:28 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2046.453455] syz-executor.6: attempt to access beyond end of device
[ 2046.453455] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.455403] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2046.466772] syz-executor.4: attempt to access beyond end of device
[ 2046.466772] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.468958] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2046.535029] syz-executor.2: attempt to access beyond end of device
[ 2046.535029] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.537177] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:26:28 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x3)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:26:28 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 16)

23:26:28 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:28 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
ioctl$VFAT_IOCTL_READDIR_BOTH(r2, 0x82307201, &(0x7f0000000500)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2046.733196] loop4: detected capacity change from 0 to 40
[ 2046.740626] loop3: detected capacity change from 0 to 40
23:26:28 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 15)

[ 2046.790210] loop0: detected capacity change from 0 to 40
[ 2046.814806] loop6: detected capacity change from 0 to 40
[ 2046.867682] loop2: detected capacity change from 0 to 40
23:26:28 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2046.962145] syz-executor.4: attempt to access beyond end of device
[ 2046.962145] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.964006] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2046.996222] syz-executor.0: attempt to access beyond end of device
[ 2046.996222] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.998600] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2047.041975] loop3: detected capacity change from 0 to 40
23:26:29 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 17)

[ 2047.102710] loop3: detected capacity change from 0 to 40
[ 2047.142765] syz-executor.2: attempt to access beyond end of device
[ 2047.142765] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.145176] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:26:29 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2047.220680] loop0: detected capacity change from 0 to 40
23:26:29 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:29 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2047.254147] loop4: detected capacity change from 0 to 40
23:26:29 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:29 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x8)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:29 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 16)

[ 2047.359731] syz-executor.4: attempt to access beyond end of device
[ 2047.359731] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.362029] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2047.366519] loop5: detected capacity change from 0 to 40
[ 2047.388644] FAT-fs (loop5): bogus number of reserved sectors
[ 2047.390105] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2047.417667] loop1: detected capacity change from 0 to 40
[ 2047.449774] syz-executor.0: attempt to access beyond end of device
[ 2047.449774] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.451868] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:26:29 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2047.540711] loop3: detected capacity change from 0 to 40
[ 2047.555580] loop2: detected capacity change from 0 to 40
[ 2047.643845] loop3: detected capacity change from 0 to 40
23:26:29 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 18)

23:26:29 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x5)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2047.708990] loop4: detected capacity change from 0 to 40
[ 2047.743651] syz-executor.2: attempt to access beyond end of device
[ 2047.743651] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.745247] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2047.767388] loop0: detected capacity change from 0 to 40
23:26:44 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 19)

23:26:44 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2062.772592] loop5: detected capacity change from 0 to 40
[ 2062.775152] loop0: detected capacity change from 0 to 40
23:26:44 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:44 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:44 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:44 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:44 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:26:44 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 17)

[ 2062.791191] loop4: detected capacity change from 0 to 40
[ 2062.798395] loop1: detected capacity change from 0 to 40
[ 2062.805757] FAT-fs (loop5): bogus number of reserved sectors
[ 2062.806213] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2062.813353] loop6: detected capacity change from 0 to 40
[ 2062.824670] loop2: detected capacity change from 0 to 40
[ 2062.826787] loop3: detected capacity change from 0 to 40
[ 2062.885579] loop3: detected capacity change from 0 to 40
[ 2062.914194] bio_check_eod: 2 callbacks suppressed
[ 2062.914205] syz-executor.6: attempt to access beyond end of device
[ 2062.914205] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.915592] buffer_io_error: 2 callbacks suppressed
[ 2062.915600] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2062.943530] syz-executor.0: attempt to access beyond end of device
[ 2062.943530] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.945505] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2062.972361] syz-executor.6: attempt to access beyond end of device
[ 2062.972361] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.973491] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2062.987192] syz-executor.2: attempt to access beyond end of device
[ 2062.987192] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.988405] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:26:44 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2062.998699] syz-executor.4: attempt to access beyond end of device
[ 2062.998699] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.999988] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:26:44 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x10)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:45 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 20)

23:26:45 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 18)

23:26:45 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2063.128123] loop3: detected capacity change from 0 to 40
[ 2063.133430] loop0: detected capacity change from 0 to 40
23:26:45 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80))
mknodat$loop(r2, &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x1)
openat(r2, &(0x7f0000000000)='./file0\x00', 0x40001, 0x2)
r3 = io_uring_setup(0x390d, &(0x7f0000000240)={0x0, 0x707e, 0x10, 0x0, 0x1cc})
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
open$dir(&(0x7f0000000040)='./file0/file0\x00', 0x248300, 0x28)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x151e0, 0x4007}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2063.198137] loop3: detected capacity change from 0 to 40
[ 2063.203011] loop2: detected capacity change from 0 to 40
23:26:45 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x48)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2063.256462] loop4: detected capacity change from 0 to 40
[ 2063.266674] loop6: detected capacity change from 0 to 40
23:26:45 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x8)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2063.307113] syz-executor.0: attempt to access beyond end of device
[ 2063.307113] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2063.308179] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2063.336780] loop3: detected capacity change from 0 to 40
[ 2063.357862] syz-executor.2: attempt to access beyond end of device
[ 2063.357862] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2063.358943] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:26:45 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 21)

[ 2063.385167] loop3: detected capacity change from 0 to 40
[ 2063.409932] syz-executor.6: attempt to access beyond end of device
[ 2063.409932] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2063.448103] syz-executor.4: attempt to access beyond end of device
[ 2063.448103] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2063.449165] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:26:45 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2063.526681] loop0: detected capacity change from 0 to 40
[ 2063.576872] loop3: detected capacity change from 0 to 40
[ 2063.663173] loop3: detected capacity change from 0 to 40
23:26:45 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2063.704538] loop4: detected capacity change from 0 to 40
[ 2063.738081] syz-executor.4: attempt to access beyond end of device
[ 2063.738081] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2063.739134] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:26:59 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:59 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x68)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:26:59 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:26:59 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 22)

23:26:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
open(&(0x7f0000000000)='./file1\x00', 0x2000, 0x60)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:26:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 19)

23:26:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2077.721237] loop0: detected capacity change from 0 to 40
[ 2077.728577] loop1: detected capacity change from 0 to 40
[ 2077.736227] loop4: detected capacity change from 0 to 40
[ 2077.785879] loop2: detected capacity change from 0 to 40
[ 2077.787635] loop6: detected capacity change from 0 to 40
[ 2077.788195] loop5: detected capacity change from 0 to 40
[ 2077.789147] loop3: detected capacity change from 0 to 40
[ 2077.808573] FAT-fs (loop5): bogus number of reserved sectors
[ 2077.809141] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2077.851791] loop3: detected capacity change from 0 to 40
[ 2077.905609] syz-executor.4: attempt to access beyond end of device
[ 2077.905609] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2077.907795] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2077.955115] syz-executor.0: attempt to access beyond end of device
[ 2077.955115] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2077.957719] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2077.960238] syz-executor.6: attempt to access beyond end of device
[ 2077.960238] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2077.962682] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2077.966707] syz-executor.2: attempt to access beyond end of device
[ 2077.966707] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2077.969072] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:27:00 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 20)

[ 2078.069316] syz-executor.6: attempt to access beyond end of device
[ 2078.069316] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2078.071111] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:27:00 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x10)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:27:00 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:27:00 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2078.193316] loop2: detected capacity change from 0 to 40
23:27:00 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 23)

[ 2078.269495] syz-executor.2: attempt to access beyond end of device
[ 2078.269495] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2078.271398] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:27:00 executing program 6:
chdir(&(0x7f0000000140)='./file0\x00')
r0 = fsmount(0xffffffffffffffff, 0x1, 0x0)
openat(r0, &(0x7f0000000040)='./file0\x00', 0x408c0, 0x10)
perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x81, 0x6, 0x81, 0x2, 0x0, 0x4, 0x20, 0x3, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x2, 0x1, @perf_bp={&(0x7f0000000180), 0x8}, 0x14c41, 0x2, 0xfff, 0x7, 0x8, 0x0, 0x8, 0x0, 0x20, 0x0, 0x7fffffff}, 0x0, 0x6, r0, 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(r1, &(0x7f0000000000)='\x00', 0x208000, 0x64)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x3, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:27:00 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 21)

[ 2078.355653] loop3: detected capacity change from 0 to 40
[ 2078.398429] loop2: detected capacity change from 0 to 40
[ 2078.408526] loop0: detected capacity change from 0 to 40
[ 2078.416756] loop4: detected capacity change from 0 to 40
[ 2078.490397] loop3: detected capacity change from 0 to 40
23:27:00 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 22)

[ 2078.519174] loop2: detected capacity change from 0 to 40
[ 2078.599728] syz-executor.4: attempt to access beyond end of device
[ 2078.599728] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2078.601566] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2078.621144] syz-executor.0: attempt to access beyond end of device
[ 2078.621144] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2078.622213] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2078.641080] syz-executor.2: attempt to access beyond end of device
[ 2078.641080] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2078.642366] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2093.129745] loop1: detected capacity change from 0 to 40
23:27:15 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240)={0x0, 0x0, 0x70, 0x1})
setxattr$trusted_overlay_nlink(&(0x7f0000000400)='\x00', &(0x7f0000000440), &(0x7f0000000500)={'L-', 0xc7}, 0x16, 0x1)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000001, 0x4010, r1, 0x0)
syz_io_uring_setup(0x3492, &(0x7f0000000180)={0x0, 0xdbe2, 0x0, 0x2, 0x22a, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000040), &(0x7f0000000300)=<r5=>0x0)
r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0)
syz_io_uring_submit(r4, r5, &(0x7f00000003c0)=@IORING_OP_OPENAT2={0x1c, 0x1, 0x0, r0, &(0x7f0000000340)={0x40000, 0x110, 0x11}, &(0x7f0000000380)='./file2\x00', 0x18, 0x0, 0x12345, {0x0, r6}}, 0xfffff9df)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x104000, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x10001}, 0x5d182, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, r7, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:27:15 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 24)

23:27:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, 0x0, 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:15 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 23)

23:27:15 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x48)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:27:15 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x74)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:27:15 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2093.149684] loop6: detected capacity change from 0 to 40
[ 2093.196244] loop2: detected capacity change from 0 to 40
[ 2093.203340] loop3: detected capacity change from 0 to 40
[ 2093.205733] loop5: detected capacity change from 0 to 40
[ 2093.208048] loop0: detected capacity change from 0 to 40
[ 2093.215495] loop4: detected capacity change from 0 to 40
[ 2093.240116] FAT-fs (loop5): bogus number of reserved sectors
[ 2093.240955] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2093.255199] loop3: detected capacity change from 0 to 40
[ 2093.307053] syz-executor.6: attempt to access beyond end of device
[ 2093.307053] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2093.308622] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:27:15 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2093.423745] syz-executor.4: attempt to access beyond end of device
[ 2093.423745] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2093.425926] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2093.455742] loop3: detected capacity change from 0 to 40
[ 2093.491920] syz-executor.2: attempt to access beyond end of device
[ 2093.491920] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2093.496045] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2093.517795] syz-executor.0: attempt to access beyond end of device
[ 2093.517795] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2093.519885] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:27:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:15 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2093.570109] loop3: detected capacity change from 0 to 40
23:27:15 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 24)

[ 2093.761447] loop4: detected capacity change from 0 to 40
[ 2093.892302] loop2: detected capacity change from 0 to 40
[ 2093.936817] syz-executor.4: attempt to access beyond end of device
[ 2093.936817] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2093.939049] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2094.077786] syz-executor.2: attempt to access beyond end of device
[ 2094.077786] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2094.080080] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2107.464797] loop3: detected capacity change from 0 to 40
[ 2107.473511] loop1: detected capacity change from 0 to 40
[ 2107.489752] loop6: detected capacity change from 0 to 40
23:27:29 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 25)

23:27:29 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:29 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:29 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 25)

23:27:29 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x300)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:27:29 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:29 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x68)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:27:29 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(r0, &(0x7f0000000000)='./file0\x00', 0x88000, 0x86)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x5016}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2107.494047] loop4: detected capacity change from 0 to 40
[ 2107.497599] loop5: detected capacity change from 0 to 40
[ 2107.511603] loop2: detected capacity change from 0 to 40
[ 2107.561090] loop3: detected capacity change from 0 to 40
[ 2107.564166] FAT-fs (loop5): bogus number of reserved sectors
[ 2107.564693] loop0: detected capacity change from 0 to 40
[ 2107.565198] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2107.640439] syz-executor.2: attempt to access beyond end of device
[ 2107.640439] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2107.641598] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:27:29 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2107.778746] syz-executor.0: attempt to access beyond end of device
[ 2107.778746] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2107.779824] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2108.058775] syz-executor.4: attempt to access beyond end of device
[ 2108.058775] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2108.060528] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:27:46 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x500)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2124.302662] loop4: detected capacity change from 0 to 40
23:27:46 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:46 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x74)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:27:46 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 26)

23:27:46 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 26)

23:27:46 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:27:46 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2124.313313] loop6: detected capacity change from 0 to 40
23:27:46 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x0, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2124.323995] loop3: detected capacity change from 0 to 40
[ 2124.387759] loop3: detected capacity change from 0 to 40
[ 2124.406964] syz-executor.6: attempt to access beyond end of device
[ 2124.406964] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2124.408058] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2124.411082] loop5: detected capacity change from 0 to 40
[ 2124.412136] loop0: detected capacity change from 0 to 40
[ 2124.414017] loop1: detected capacity change from 0 to 40
[ 2124.415731] loop2: detected capacity change from 0 to 40
23:27:46 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x600)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2124.452056] FAT-fs (loop5): bogus number of reserved sectors
[ 2124.453096] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2124.460654] syz-executor.4: attempt to access beyond end of device
[ 2124.460654] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2124.462760] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:27:46 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
syz_io_uring_setup(0x5662, &(0x7f0000000000)={0x0, 0x2a31, 0x2, 0x3, 0x2db}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000180)=<r4=>0x0, &(0x7f00000001c0))
r5 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x4010, r3, 0x10000000)
r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
syz_io_uring_submit(r4, r5, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000300)='./file0\x00', 0x115, 0x10000, 0x23456, {0x0, r6}}, 0xfc18)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2124.563722] loop3: detected capacity change from 0 to 40
[ 2124.588644] syz-executor.0: attempt to access beyond end of device
[ 2124.588644] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2124.590697] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2124.617965] syz-executor.2: attempt to access beyond end of device
[ 2124.617965] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2124.620806] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:27:46 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:27:46 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2124.673722] loop3: detected capacity change from 0 to 40
[ 2124.719865] loop6: detected capacity change from 0 to 40
23:27:46 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 27)

[ 2124.776462] loop4: detected capacity change from 0 to 40
23:27:46 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 27)

23:27:46 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x700)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2124.946974] loop2: detected capacity change from 0 to 40
23:27:47 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = fsmount(r0, 0x1, 0x88)
name_to_handle_at(r2, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040)=@FILEID_INO32_GEN_PARENT={0x10, 0x2, {{0x1}, 0x9, 0x7f}}, &(0x7f0000000180), 0x400)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
io_uring_setup(0x679b, &(0x7f0000000300)={0x0, 0xfb6, 0x0, 0x1, 0x124, 0x0, r2})
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0xef57, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2125.067755] loop0: detected capacity change from 0 to 40
23:27:47 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x300)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2125.182906] loop6: detected capacity change from 0 to 40
[ 2125.214080] syz-executor.4: attempt to access beyond end of device
[ 2125.214080] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2125.215656] syz-executor.2: attempt to access beyond end of device
[ 2125.215656] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2125.215719] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2125.219955] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2125.299851] syz-executor.0: attempt to access beyond end of device
[ 2125.299851] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2125.301742] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:28:02 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 28)

23:28:02 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x500)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2140.580061] loop3: detected capacity change from 0 to 40
23:28:02 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa00)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:02 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 28)

23:28:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x0, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2140.592920] loop4: detected capacity change from 0 to 40
23:28:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20001, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x8, 0x4, 0x3, 0x9, 0x0, 0x3, 0x80001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x81, 0x4, @perf_bp={&(0x7f0000000000), 0x4}, 0x22c2, 0x4, 0x1f, 0x1, 0x7, 0x10000, 0x7f, 0x0, 0xff, 0x0, 0x80000000}, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0x1)

23:28:02 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2140.609010] loop0: detected capacity change from 0 to 40
[ 2140.616524] loop1: detected capacity change from 0 to 40
[ 2140.619460] loop6: detected capacity change from 0 to 40
[ 2140.626219] loop3: detected capacity change from 0 to 40
[ 2140.644776] loop5: detected capacity change from 0 to 40
[ 2140.649518] loop2: detected capacity change from 0 to 40
[ 2140.657855] FAT-fs (loop5): bogus number of reserved sectors
[ 2140.658308] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2140.712903] syz-executor.4: attempt to access beyond end of device
[ 2140.712903] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2140.714994] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:28:02 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x600)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2140.755465] syz-executor.6: attempt to access beyond end of device
[ 2140.755465] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2140.756503] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:28:02 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4800)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2140.764002] syz-executor.0: attempt to access beyond end of device
[ 2140.764002] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2140.765355] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2140.795826] syz-executor.2: attempt to access beyond end of device
[ 2140.795826] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2140.796774] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:28:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2140.854880] loop3: detected capacity change from 0 to 40
23:28:02 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 29)

23:28:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
r3 = getpgrp(0x0)
perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x20, 0x3, 0x4, 0x0, 0x0, 0x101, 0xe0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040), 0x2}, 0x1020, 0xfff, 0x3, 0x9, 0x4, 0xff, 0xfc00, 0x0, 0x7, 0x0, 0xac}, r3, 0x0, 0xffffffffffffffff, 0x9)
r4 = getpgid(r3)
syz_open_procfs(r4, &(0x7f0000000140)='net/ip6_tables_names\x00')
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x2, 0xc0b03, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0x0, 0x0, 0x9}, r4, 0x1, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:02 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 29)

[ 2140.960741] loop3: detected capacity change from 0 to 40
[ 2140.966697] loop6: detected capacity change from 0 to 40
[ 2140.994884] loop0: detected capacity change from 0 to 40
23:28:02 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x700)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2141.001171] loop4: detected capacity change from 0 to 40
[ 2141.051680] loop2: detected capacity change from 0 to 40
[ 2141.066101] syz-executor.6: attempt to access beyond end of device
[ 2141.066101] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.067097] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2141.097919] syz-executor.4: attempt to access beyond end of device
[ 2141.097919] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.100126] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2141.133244] syz-executor.2: attempt to access beyond end of device
[ 2141.133244] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.134444] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:28:03 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c00)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:03 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 30)

[ 2141.333692] syz-executor.0: attempt to access beyond end of device
[ 2141.333692] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.335891] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2141.338950] loop2: detected capacity change from 0 to 40
[ 2141.342828] loop3: detected capacity change from 0 to 40
[ 2141.426077] loop3: detected capacity change from 0 to 40
[ 2141.551741] syz-executor.2: attempt to access beyond end of device
[ 2141.551741] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.553759] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:28:19 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31)

23:28:19 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:19 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 30)

[ 2157.159143] loop1: detected capacity change from 0 to 40
23:28:19 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:19 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240)={0x0, 0xab6f, 0x8, 0x1})
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0xd}, 0x15182, 0x7, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x3}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x8, 0x2010, r3, 0x1ff)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x301100, 0x0)
signalfd4(r4, &(0x7f0000000040)={[0x3]}, 0x8, 0x800)

[ 2157.164078] loop4: detected capacity change from 0 to 40
23:28:19 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6800)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2157.169168] loop6: detected capacity change from 0 to 40
23:28:19 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2157.187658] loop5: detected capacity change from 0 to 40
23:28:19 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa00)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2157.200421] FAT-fs (loop5): bogus number of reserved sectors
[ 2157.200868] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2157.206957] loop2: detected capacity change from 0 to 40
[ 2157.214918] loop0: detected capacity change from 0 to 40
[ 2157.245781] loop3: detected capacity change from 0 to 40
[ 2157.308769] syz-executor.4: attempt to access beyond end of device
[ 2157.308769] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.309712] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2157.323465] loop3: detected capacity change from 0 to 40
[ 2157.370242] syz-executor.6: attempt to access beyond end of device
[ 2157.370242] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.371870] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2157.380132] syz-executor.0: attempt to access beyond end of device
[ 2157.380132] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.381716] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:28:19 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c00)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2157.433232] syz-executor.2: attempt to access beyond end of device
[ 2157.433232] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
23:28:19 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4800)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2157.434939] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2157.462793] syz-executor.6: attempt to access beyond end of device
[ 2157.462793] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.464183] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2157.538477] loop3: detected capacity change from 0 to 40
23:28:19 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:19 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31)

[ 2157.581547] loop4: detected capacity change from 0 to 40
[ 2157.582792] loop3: detected capacity change from 0 to 40
23:28:19 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32)

[ 2157.672591] loop2: detected capacity change from 0 to 40
23:28:19 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
fstat(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x0, r5}}, '.\x00'})

[ 2157.721075] loop0: detected capacity change from 0 to 40
23:28:19 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7400)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2157.796758] syz-executor.4: attempt to access beyond end of device
[ 2157.796758] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.798147] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2157.834543] syz-executor.0: attempt to access beyond end of device
[ 2157.834543] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.835872] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2157.863065] loop6: detected capacity change from 0 to 40
[ 2157.898346] loop3: detected capacity change from 0 to 40
[ 2157.929595] syz-executor.2: attempt to access beyond end of device
[ 2157.929595] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.931402] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2157.987853] loop3: detected capacity change from 0 to 40
[ 2158.049527] syz-executor.6: attempt to access beyond end of device
[ 2158.049527] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2158.050895] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:28:33 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32)

23:28:33 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c00)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:28:33 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:33 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a00)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:33 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33)

23:28:33 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2171.808946] loop0: detected capacity change from 0 to 40
[ 2171.821024] loop1: detected capacity change from 0 to 40
[ 2171.826761] loop2: detected capacity change from 0 to 40
23:28:33 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:33 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
r3 = openat$sr(0xffffffffffffff9c, &(0x7f00000000c0), 0x440000, 0x0)
write$P9_RREADLINK(r3, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10)
recvmsg$unix(r3, &(0x7f00000008c0)={&(0x7f0000000300), 0x6e, &(0x7f0000000740)=[{&(0x7f0000000380)=""/155, 0x9b}, {&(0x7f0000000440)}, {&(0x7f0000000500)=""/67, 0x43}, {&(0x7f0000000580)=""/11, 0xb}, {&(0x7f00000005c0)=""/111, 0x6f}, {&(0x7f0000000640)=""/1, 0x1}, {&(0x7f0000000680)=""/172, 0xac}], 0x7, &(0x7f00000007c0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, <r4=>0x0}}}, @cred={{0x1c}}], 0xd0}, 0x40002022)
stat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
r6 = getgid()
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001200)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32, @ANYRES32=0xee00, @ANYRES32=r6, @ANYBLOB='n/file0\x00'])
fsetxattr$system_posix_acl(r0, &(0x7f00000001c0)='system.posix_acl_access\x00', &(0x7f00000009c0)={{}, {0x1, 0x4}, [{0x2, 0x8, r4}], {0x4, 0x1}, [{0x8, 0x4, 0xee00}, {0x8, 0x3, r5}, {0x8, 0x4, r6}, {0x8, 0x6, 0xee01}, {0x8, 0x6, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x4}, {0x20, 0x2}}, 0x5c, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x1d9a6, 0x7, 0xfffffffc, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2171.832929] loop3: detected capacity change from 0 to 40
[ 2171.851669] loop4: detected capacity change from 0 to 40
[ 2171.860219] loop3: detected capacity change from 0 to 40
[ 2171.864496] loop5: detected capacity change from 0 to 40
[ 2171.879820] FAT-fs (loop5): bogus number of reserved sectors
[ 2171.880347] FAT-fs (loop5): Can't find a valid FAT filesystem
23:28:33 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x80000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2171.903017] loop6: detected capacity change from 0 to 40
[ 2171.911964] syz-executor.0: attempt to access beyond end of device
[ 2171.911964] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2171.912999] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2171.977808] loop3: detected capacity change from 0 to 40
23:28:33 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33)

[ 2172.015713] loop3: detected capacity change from 0 to 40
[ 2172.042045] syz-executor.6: attempt to access beyond end of device
[ 2172.042045] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.043111] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2172.084702] syz-executor.2: attempt to access beyond end of device
[ 2172.084702] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.086660] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2172.112006] syz-executor.6: attempt to access beyond end of device
[ 2172.112006] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.114055] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2172.128734] syz-executor.4: attempt to access beyond end of device
[ 2172.128734] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.130941] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:28:34 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6800)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:28:34 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x100000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:34 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34)

[ 2172.248909] loop0: detected capacity change from 0 to 40
23:28:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwrite64(r1, &(0x7f0000000300)="c0b089c574cb79c745c5acbe5925e3ce68c86f9786a5b92e9f8bf513faaf6e635cb7422bf1451a2e13efc74b01a491bab1e901f21898b307adcca37deea6bb3fe3bf1dce30b151df6edbfee7d86f63e4a8e2564f6a512be89669882b6850c371bb9c1ff7d4e5ce1b26bcc1ec0d99bab3c08792f43d303cc5253a5f390bb15ec25fdf5681b0dc8ea2e80b8248c027c6ea254f93a43e0d20bee777497e4fe4db02137f34a49136bfd21a89bce25a9e0155e9a357324fb3024c005b536058c01d1c3a92a205aaa33189087fdcf11e679faa7a67b8e4a1fe9ef20ffa37ad6d6e356c6dfe2572b2b23645fe9d9a677a30a552c25e9122", 0xf4, 0x9)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2172.294620] loop3: detected capacity change from 0 to 40
[ 2172.318838] loop6: detected capacity change from 0 to 40
[ 2172.406665] loop3: detected capacity change from 0 to 40
[ 2172.430155] syz-executor.6: attempt to access beyond end of device
[ 2172.430155] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.431418] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2172.469823] loop2: detected capacity change from 0 to 40
23:28:34 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x1000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2172.494519] syz-executor.0: attempt to access beyond end of device
[ 2172.494519] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.496587] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2172.508691] syz-executor.6: attempt to access beyond end of device
[ 2172.508691] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.510381] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2172.545761] loop3: detected capacity change from 0 to 40
[ 2172.555644] loop4: detected capacity change from 0 to 40
[ 2172.626420] loop3: detected capacity change from 0 to 40
[ 2172.635629] syz-executor.2: attempt to access beyond end of device
[ 2172.635629] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.637687] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2172.779070] syz-executor.4: attempt to access beyond end of device
[ 2172.779070] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2172.781025] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:28:51 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x20, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:51 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x2000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:51 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35)

23:28:51 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x0)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:51 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34)

23:28:51 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c00)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2190.014045] loop5: detected capacity change from 0 to 40
[ 2190.021408] loop4: detected capacity change from 0 to 40
[ 2190.024696] loop1: detected capacity change from 0 to 40
[ 2190.024777] loop0: detected capacity change from 0 to 40
[ 2190.026170] loop6: detected capacity change from 0 to 40
[ 2190.028131] loop3: detected capacity change from 0 to 40
[ 2190.028466] loop2: detected capacity change from 0 to 40
[ 2190.041588] FAT-fs (loop5): bogus number of reserved sectors
[ 2190.042387] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2190.120339] loop3: detected capacity change from 0 to 40
[ 2190.217485] syz-executor.4: attempt to access beyond end of device
[ 2190.217485] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.219157] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:28:52 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7400)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2190.234239] syz-executor.0: attempt to access beyond end of device
[ 2190.234239] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.236062] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2190.248615] syz-executor.6: attempt to access beyond end of device
[ 2190.248615] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.250547] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2190.255547] syz-executor.2: attempt to access beyond end of device
[ 2190.255547] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.257237] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:28:52 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x3000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:28:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:28:52 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35)

23:28:52 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36)

[ 2190.492902] loop3: detected capacity change from 0 to 40
23:28:52 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d28, &(0x7f0000000480)={0x0, 0x800c, 0x0, 0x0, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0xff, 0x1, 0x0, 0x2, 0x0, 0x7, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x9, 0x4, @perf_bp={&(0x7f0000000040), 0xc}, 0x8, 0x3, 0x1, 0x7, 0x10000, 0x2, 0x1f, 0x0, 0x6, 0x0, 0xfffffffffffffff8}, 0x0, 0xffffffffffffffff, r1, 0x2)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r4, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
sendfile(r0, r4, &(0x7f0000000000)=0x9, 0xffff)

[ 2190.523768] loop4: detected capacity change from 0 to 40
[ 2190.550538] loop2: detected capacity change from 0 to 40
[ 2190.583441] loop3: detected capacity change from 0 to 40
[ 2190.596885] loop0: detected capacity change from 0 to 40
23:28:52 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a00)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2190.609087] loop6: detected capacity change from 0 to 40
[ 2190.660874] syz-executor.2: attempt to access beyond end of device
[ 2190.660874] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.662459] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:28:52 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2190.714568] syz-executor.4: attempt to access beyond end of device
[ 2190.714568] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.715841] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2190.725680] syz-executor.0: attempt to access beyond end of device
[ 2190.725680] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.726904] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2190.782214] loop3: detected capacity change from 0 to 40
23:28:52 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x80000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2190.808232] syz-executor.6: attempt to access beyond end of device
[ 2190.808232] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.809494] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:28:52 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36)

23:28:52 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37)

[ 2190.864600] loop3: detected capacity change from 0 to 40
[ 2190.903892] loop0: detected capacity change from 0 to 40
[ 2190.946169] loop2: detected capacity change from 0 to 40
[ 2190.957105] syz-executor.6: attempt to access beyond end of device
[ 2190.957105] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2190.958164] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2191.032203] syz-executor.0: attempt to access beyond end of device
[ 2191.032203] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2191.034781] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:29:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38)

23:29:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37)

23:29:06 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x5000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2204.137987] loop3: detected capacity change from 0 to 40
[ 2204.141304] loop0: detected capacity change from 0 to 40
23:29:06 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x100000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
stat(&(0x7f0000000040)='./file1\x00', &(0x7f0000000180))
r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r5 = dup(r4)
bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
r6 = openat$incfs(r0, &(0x7f0000000300)='.log\x00', 0x480000, 0x113)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r5, 0xc0189374, &(0x7f0000000340)={{0x1, 0x1, 0x18, r6, {0x6}}, './file0\x00'})
sendfile(r1, r0, 0x0, 0xfffffdef)
fremovexattr(r3, &(0x7f0000000000)=@known='user.incfs.metadata\x00')

23:29:06 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2204.152825] loop4: detected capacity change from 0 to 40
[ 2204.164892] loop2: detected capacity change from 0 to 40
[ 2204.190743] loop3: detected capacity change from 0 to 40
[ 2204.197694] loop1: detected capacity change from 0 to 40
[ 2204.202736] loop6: detected capacity change from 0 to 40
[ 2204.225570] bio_check_eod: 1 callbacks suppressed
[ 2204.225581] syz-executor.4: attempt to access beyond end of device
[ 2204.225581] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.227019] buffer_io_error: 1 callbacks suppressed
[ 2204.227027] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2204.238220] syz-executor.0: attempt to access beyond end of device
[ 2204.238220] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.239374] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2204.264123] syz-executor.2: attempt to access beyond end of device
[ 2204.264123] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.265164] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:29:06 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x1000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:06 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38)

[ 2204.305849] loop5: detected capacity change from 0 to 40
[ 2204.310535] FAT-fs (loop5): bogus number of reserved sectors
[ 2204.310998] FAT-fs (loop5): Can't find a valid FAT filesystem
23:29:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39)

[ 2204.368249] loop0: detected capacity change from 0 to 40
[ 2204.411208] loop3: detected capacity change from 0 to 40
[ 2204.442641] syz-executor.0: attempt to access beyond end of device
[ 2204.442641] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.443713] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:29:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:06 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39)

[ 2204.557979] loop4: detected capacity change from 0 to 40
[ 2204.576766] syz-executor.6: attempt to access beyond end of device
[ 2204.576766] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.579227] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2204.661316] loop0: detected capacity change from 0 to 40
[ 2204.677501] loop2: detected capacity change from 0 to 40
23:29:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2204.779245] syz-executor.6: attempt to access beyond end of device
[ 2204.779245] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.781362] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:29:06 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2204.987248] loop3: detected capacity change from 0 to 40
[ 2204.997582] syz-executor.0: attempt to access beyond end of device
[ 2204.997582] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.999407] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2205.062026] loop4: detected capacity change from 0 to 40
[ 2205.089089] loop3: detected capacity change from 0 to 40
[ 2205.095217] syz-executor.2: attempt to access beyond end of device
[ 2205.095217] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.097438] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:29:22 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2220.331777] loop0: detected capacity change from 0 to 40
[ 2220.333415] loop4: detected capacity change from 0 to 40
23:29:22 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:22 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:22 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:22 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 40)

23:29:22 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:22 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x2000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:22 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 40)

[ 2220.340378] loop3: detected capacity change from 0 to 40
[ 2220.347075] loop1: detected capacity change from 0 to 40
[ 2220.364106] loop5: detected capacity change from 0 to 40
[ 2220.368391] loop3: detected capacity change from 0 to 40
[ 2220.391091] loop2: detected capacity change from 0 to 40
[ 2220.393209] loop6: detected capacity change from 0 to 40
[ 2220.410860] syz-executor.0: attempt to access beyond end of device
[ 2220.410860] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2220.411982] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2220.413108] FAT-fs (loop5): bogus number of reserved sectors
[ 2220.414026] FAT-fs (loop5): Can't find a valid FAT filesystem
23:29:22 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:29:22 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x48000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2220.497365] loop4: detected capacity change from 0 to 40
[ 2220.498032] loop3: detected capacity change from 0 to 40
[ 2220.527870] syz-executor.6: attempt to access beyond end of device
[ 2220.527870] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2220.529883] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2220.540608] loop3: detected capacity change from 0 to 40
[ 2220.607640] syz-executor.2: attempt to access beyond end of device
[ 2220.607640] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2220.609591] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:29:41 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 41)

23:29:41 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:29:41 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(0xffffffffffffffff, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:41 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:41 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x7426, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/key-users\x00', 0x0, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r3, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
pwritev(r3, &(0x7f0000000040)=[{&(0x7f0000000000)="b5a488ef419c2835bb47e2", 0xb}], 0x1, 0x7, 0x101)

23:29:41 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:41 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 41)

23:29:41 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x3000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2239.674803] loop0: detected capacity change from 0 to 40
[ 2239.706315] loop2: detected capacity change from 0 to 40
[ 2239.708827] loop6: detected capacity change from 0 to 40
[ 2239.718021] loop5: detected capacity change from 0 to 40
[ 2239.718354] loop1: detected capacity change from 0 to 40
[ 2239.719846] loop4: detected capacity change from 0 to 40
[ 2239.723865] loop3: detected capacity change from 0 to 40
[ 2239.752180] FAT-fs (loop5): bogus number of reserved sectors
[ 2239.753198] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2239.787780] loop3: detected capacity change from 0 to 40
[ 2239.808197] syz-executor.0: attempt to access beyond end of device
[ 2239.808197] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2239.810487] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:29:41 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:41 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x68000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:41 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2239.948592] syz-executor.2: attempt to access beyond end of device
[ 2239.948592] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2239.950322] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2240.013846] syz-executor.6: attempt to access beyond end of device
[ 2240.013846] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.015783] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:29:41 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 42)

[ 2240.090009] loop3: detected capacity change from 0 to 40
[ 2240.176360] loop3: detected capacity change from 0 to 40
[ 2240.188357] loop4: detected capacity change from 0 to 40
23:29:42 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 42)

[ 2240.263108] syz-executor.6: attempt to access beyond end of device
[ 2240.263108] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.264824] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2240.273008] loop0: detected capacity change from 0 to 40
[ 2240.401660] syz-executor.0: attempt to access beyond end of device
[ 2240.401660] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.403663] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2240.419795] loop2: detected capacity change from 0 to 40
23:29:42 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:42 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x5000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:42 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 43)

[ 2240.530120] loop3: detected capacity change from 0 to 40
23:29:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

23:29:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0xfffffffffffffe00, 0x40)
openat(r0, &(0x7f0000000040)='./file0\x00', 0x80, 0x90)
ioctl$HIDIOCGNAME(r0, 0x80404806, &(0x7f0000000180))
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x40, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x12240, 0x7, 0x0, 0x0, 0x0, 0x0, 0x813}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2240.594167] syz-executor.2: attempt to access beyond end of device
[ 2240.594167] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.596179] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2240.613555] loop3: detected capacity change from 0 to 40
[ 2240.658135] loop6: detected capacity change from 0 to 40
[ 2240.677506] loop0: detected capacity change from 0 to 40
[ 2240.685072] loop4: detected capacity change from 0 to 40
23:29:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:42 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:42 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 43)

[ 2240.813635] syz-executor.6: attempt to access beyond end of device
[ 2240.813635] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.815742] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2240.829590] loop5: detected capacity change from 0 to 40
[ 2240.862349] loop1: detected capacity change from 0 to 40
[ 2240.864561] loop2: detected capacity change from 0 to 40
[ 2240.870663] syz-executor.6: attempt to access beyond end of device
[ 2240.870663] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.872349] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2240.873418] syz-executor.0: attempt to access beyond end of device
[ 2240.873418] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2240.875553] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2240.880303] FAT-fs (loop5): bogus number of reserved sectors
[ 2240.881190] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2241.044289] syz-executor.2: attempt to access beyond end of device
[ 2241.044289] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2241.046413] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:29:59 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x74000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:59 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:29:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2257.053165] loop1: detected capacity change from 0 to 40
23:29:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r4 = dup(r3)
bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000300)={0x9, 0x1f, 0x0, 'queue0\x00', 0x3ff})

[ 2257.059659] loop3: detected capacity change from 0 to 40
[ 2257.069518] loop4: detected capacity change from 0 to 40
[ 2257.072194] loop6: detected capacity change from 0 to 40
[ 2257.082299] loop0: detected capacity change from 0 to 40
23:29:59 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

23:29:59 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 44)

23:29:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 44)

[ 2257.094243] loop2: detected capacity change from 0 to 40
[ 2257.108866] loop5: detected capacity change from 0 to 40
[ 2257.122337] loop3: detected capacity change from 0 to 40
[ 2257.144224] FAT-fs (loop5): bogus number of reserved sectors
[ 2257.145294] FAT-fs (loop5): Can't find a valid FAT filesystem
23:29:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x422621, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000540)=ANY=[@ANYBLOB="f66f7a1ce984073fcd43562be4c49a572abaeb99a9af09fc0d6d9fd80a80ca60f831f01bd107deafa389c0955abeda0f9624208e4570bec21139440fd3c281bc242381c1e222ad3d974e02d021f34af1036e1db79cc92293a74fa43e6a8fc954b0088fc1d281da01180a53457780631afd3ac11bd58065675e2b9e9562457f480ba93ab16fb3d7976c73648f06bcc3b0e80d199d37", @ANYRES32, @ANYBLOB="d6cbfe51dffc05607d5726b58f83e517321afa36ebc46d9cc22875e46e6be9a51d0ee9bbe0fc2091e84250dff46b0f3e45cc3827a4914a94139de2db43a9a2214f7fa4ade4b0c79810e0396345929e2cf1b0e30895ff19d53b43f6610208c60318b5009886f82e839c769132a9b30abd5ba303cb82d4ea93a3ae393081ec6dc187624b30a862293e6cca6d94aabc88442c8c25f7e7791c7679bbd365bb6aed1c02787d328727c75ea5497e1e00000000"])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

[ 2257.242989] syz-executor.0: attempt to access beyond end of device
[ 2257.242989] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.244107] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2257.252452] syz-executor.6: attempt to access beyond end of device
[ 2257.252452] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.253507] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2257.255652] syz-executor.2: attempt to access beyond end of device
[ 2257.255652] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.256788] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:29:59 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:29:59 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2257.366990] loop4: detected capacity change from 0 to 40
23:29:59 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 45)

23:29:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 45)

[ 2257.419046] loop0: detected capacity change from 0 to 40
[ 2257.434731] loop2: detected capacity change from 0 to 40
[ 2257.444013] loop3: detected capacity change from 0 to 40
[ 2257.506009] loop3: detected capacity change from 0 to 40
23:29:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 46)

[ 2257.617714] loop2: detected capacity change from 0 to 40
23:29:59 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x8000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:29:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r2=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r2, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r0, 0x0, 0xfffffdef)

[ 2257.671822] loop6: detected capacity change from 0 to 40
23:29:59 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 46)

[ 2257.724190] loop3: detected capacity change from 0 to 40
[ 2257.753235] loop3: detected capacity change from 0 to 40
[ 2257.790047] loop0: detected capacity change from 0 to 40
[ 2257.799473] syz-executor.2: attempt to access beyond end of device
[ 2257.799473] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.800519] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2257.852552] syz-executor.0: attempt to access beyond end of device
[ 2257.852552] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.853679] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2257.965742] syz-executor.6: attempt to access beyond end of device
[ 2257.965742] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2257.967544] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:30:14 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, 0x0, 0x0, 0x0)
sendfile(r2, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:14 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:30:14 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x10000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:30:14 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47)

23:30:14 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47)

[ 2272.958960] loop0: detected capacity change from 0 to 40
[ 2272.961975] loop5: detected capacity change from 0 to 40
23:30:14 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:14 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1f, 0xffffffff}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x20}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
r3 = socket$netlink(0x10, 0x3, 0x2)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000002c0)={<r4=>0x0})
ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000001040)=ANY=[@ANYRES64=r4])
ioctl$BTRFS_IOC_TREE_SEARCH(r3, 0xd0009411, &(0x7f0000000500)={{r4, 0x3, 0x5, 0x5, 0x6, 0x100000001, 0x7, 0x1, 0x95b, 0xffffffff, 0x7fff, 0x2, 0x7ff, 0x0, 0x2af8003d}})

[ 2272.969034] loop1: detected capacity change from 0 to 40
[ 2272.992165] loop6: detected capacity change from 0 to 40
[ 2273.006895] loop3: detected capacity change from 0 to 40
[ 2273.019582] FAT-fs (loop5): bogus number of reserved sectors
[ 2273.020609] FAT-fs (loop5): Can't find a valid FAT filesystem
23:30:14 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x48000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2273.031765] loop2: detected capacity change from 0 to 40
[ 2273.038154] syz-executor.6: attempt to access beyond end of device
[ 2273.038154] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2273.039173] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2273.088575] loop3: detected capacity change from 0 to 40
23:30:15 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file1\x00'})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r0, 0x0, 0xfffffdef)

[ 2273.171855] loop6: detected capacity change from 0 to 40
[ 2273.190580] syz-executor.0: attempt to access beyond end of device
[ 2273.190580] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2273.193435] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2273.199124] syz-executor.2: attempt to access beyond end of device
[ 2273.199124] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2273.200392] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2273.353588] syz-executor.6: attempt to access beyond end of device
[ 2273.353588] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2273.354909] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2273.404997] syz-executor.6: attempt to access beyond end of device
[ 2273.404997] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2273.406869] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2291.940629] loop0: detected capacity change from 0 to 40
[ 2291.949967] loop5: detected capacity change from 0 to 40
23:30:33 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(0xffffffffffffffff, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:33 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:30:33 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:33 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48)

23:30:33 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r2=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r2, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r0, 0x0, 0xfffffdef)

23:30:33 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x100000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:30:33 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48)

23:30:33 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = fcntl$dupfd(r0, 0x406, r0)
openat(r1, &(0x7f0000000300)='./file0/file0\x00', 0x101002, 0x110)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000100e56f32000018", @ANYRES32=<r4=>r3, @ANYBLOB="02000000000000002e2f66696c653100"])
r5 = dup(r3)
mount_setattr(r4, &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000180)={0x74, 0x5, 0x100000, {r5}}, 0x20)
r6 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r7, 0x1, 0x31, &(0x7f0000000000)={0x77359400}, 0x10)
r8 = socket$netlink(0x10, 0x3, 0x2)
getsockopt$sock_linger(r8, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
openat(r0, &(0x7f00000001c0)='./file1\x00', 0x66e800, 0xc2)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r6})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r2, 0x0, 0xfffffdef)

[ 2291.974031] loop6: detected capacity change from 0 to 40
[ 2291.982412] FAT-fs (loop5): bogus number of reserved sectors
[ 2291.983642] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2291.986043] loop1: detected capacity change from 0 to 40
[ 2291.989240] loop4: detected capacity change from 0 to 40
[ 2291.990024] loop2: detected capacity change from 0 to 40
[ 2291.990944] loop3: detected capacity change from 0 to 40
[ 2292.062720] loop3: detected capacity change from 0 to 40
[ 2292.176832] syz-executor.0: attempt to access beyond end of device
[ 2292.176832] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.179125] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2292.197778] syz-executor.6: attempt to access beyond end of device
[ 2292.197778] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.199858] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:30:34 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x200000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2292.266129] syz-executor.2: attempt to access beyond end of device
[ 2292.266129] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.268490] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2292.278712] syz-executor.4: attempt to access beyond end of device
[ 2292.278712] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.281251] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:30:34 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x68000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:30:34 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49)

[ 2292.369493] loop3: detected capacity change from 0 to 40
[ 2292.473512] loop3: detected capacity change from 0 to 40
[ 2292.525572] loop0: detected capacity change from 0 to 40
23:30:34 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49)

23:30:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r2=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r2, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r0, 0x0, 0xfffffdef)

23:30:34 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:30:34 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x300000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:30:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8)
syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0xbc, &(0x7f0000001180)=@l2tp6={0xa, 0x0, 0x0, @mcast1}}, 0x0)
r6 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, 0x12, r1, 0x10000000)
r7 = syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0xbc, &(0x7f0000001180)=@l2tp6={0xa, 0x0, 0x0, @mcast1}}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x2, 0x0, @fd_index=0x1, 0x38fb, 0x0, 0xc8a7, 0x0, 0x1}, 0x2)
r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0x15, 0x0, r8)
syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x1, 0x2007, @fd_index=0x1, 0x6, 0x0, 0x0, 0xa, 0x1, {0x0, r8}}, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2292.710446] syz-executor.0: attempt to access beyond end of device
[ 2292.710446] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.712423] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2292.729174] loop4: detected capacity change from 0 to 40
[ 2292.731866] loop2: detected capacity change from 0 to 40
[ 2292.779818] loop6: detected capacity change from 0 to 40
[ 2292.797455] loop3: detected capacity change from 0 to 40
[ 2292.907621] loop3: detected capacity change from 0 to 40
[ 2292.908966] syz-executor.6: attempt to access beyond end of device
[ 2292.908966] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.910946] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:30:34 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50)

23:30:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(0xffffffffffffffff, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2292.949843] syz-executor.2: attempt to access beyond end of device
[ 2292.949843] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.952088] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2293.020614] syz-executor.4: attempt to access beyond end of device
[ 2293.020614] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2293.022711] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:30:35 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:35 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x74000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2293.087976] loop0: detected capacity change from 0 to 40
[ 2293.097214] loop5: detected capacity change from 0 to 40
[ 2293.117729] FAT-fs (loop5): bogus number of reserved sectors
[ 2293.118639] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2293.167904] loop1: detected capacity change from 0 to 40
[ 2293.240725] syz-executor.0: attempt to access beyond end of device
[ 2293.240725] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2293.242992] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2309.320203] loop4: detected capacity change from 0 to 40
23:30:51 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:51 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x400000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:30:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(0xffffffffffffffff, r0, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r2=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r2, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r0, 0x0, 0xfffffdef)

23:30:51 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50)

23:30:51 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
r4 = openat$cgroup(r3, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0)
r5 = dup3(r2, r0, 0x0)
sendfile(r4, r5, &(0x7f0000000040)=0x4, 0xcd)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:30:51 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51)

23:30:51 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2309.334802] loop1: detected capacity change from 0 to 40
[ 2309.354972] loop3: detected capacity change from 0 to 40
[ 2309.386045] loop3: detected capacity change from 0 to 40
[ 2309.390837] loop2: detected capacity change from 0 to 40
[ 2309.393307] loop6: detected capacity change from 0 to 40
[ 2309.396552] loop0: detected capacity change from 0 to 40
[ 2309.398445] loop5: detected capacity change from 0 to 40
[ 2309.441997] FAT-fs (loop5): bogus number of reserved sectors
[ 2309.443174] FAT-fs (loop5): Can't find a valid FAT filesystem
23:30:51 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x500000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:30:51 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x8000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2309.627671] syz-executor.4: attempt to access beyond end of device
[ 2309.627671] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2309.629845] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2309.641829] syz-executor.6: attempt to access beyond end of device
[ 2309.641829] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2309.643897] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2309.644471] syz-executor.2: attempt to access beyond end of device
[ 2309.644471] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2309.646538] loop3: detected capacity change from 0 to 40
[ 2309.647619] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2309.731967] loop3: detected capacity change from 0 to 40
23:30:51 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52)

23:30:51 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51)

23:30:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2309.911766] loop2: detected capacity change from 0 to 40
23:30:51 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x5}}, './file1\x00'})
r2 = openat(r1, &(0x7f0000000100)='./file0\x00', 0x113200, 0x50)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2309.946369] loop4: detected capacity change from 0 to 40
23:30:51 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x600000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2309.986589] loop0: detected capacity change from 0 to 40
23:30:52 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x10000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2310.103924] loop6: detected capacity change from 0 to 40
[ 2310.149964] loop3: detected capacity change from 0 to 40
[ 2310.224727] loop3: detected capacity change from 0 to 40
[ 2310.229636] syz-executor.0: attempt to access beyond end of device
[ 2310.229636] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2310.231711] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:30:52 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x100000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:30:52 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52)

23:30:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r3})

23:30:52 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:30:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, 0xffffffffffffffff, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2310.375685] loop1: detected capacity change from 0 to 40
[ 2310.380797] loop5: detected capacity change from 0 to 40
[ 2310.386432] loop4: detected capacity change from 0 to 40
[ 2310.393071] loop2: detected capacity change from 0 to 40
[ 2310.398402] FAT-fs (loop5): bogus number of reserved sectors
[ 2310.399099] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2310.536159] syz-executor.2: attempt to access beyond end of device
[ 2310.536159] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2310.538392] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:31:07 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53)

23:31:07 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, 0xffffffffffffffff, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:31:07 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:31:07 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x200000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:07 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x700000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:31:07 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x10800c, 0x10, 0x1, 0x1f0, 0x0, r2})
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x80000, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="3801000010000000007463178de97ade59a6330f6d3bc83b00000000000000fe8000000000000000000000000000bbac1e00010000000000000000000000000000000000000000000000000000000031774da9c6a03fc462accb78e29e280e700ed65e438e6436c48e70f72e032c9789623aa5070000000000000098d331062eaf79400200000000000000d594d64f52f5dd38f6715dc9fbb6b8d40617b368c6dde821c3a29b602f380dfb625b36878f586e03cb9a6434c7c0b5cc361a8a3f14dad825b8e2cfeb7e6a45635808e39f0d78544b19d18f21c142e131676e767dbac480a14af3e6726e533ae96fcf25ff2060fd5da5540afe9ca9715484e1b7263f94852027", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000fc02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000100736d3300"/240], 0x138}}, 0x0)
readv(0xffffffffffffffff, &(0x7f0000007140)=[{&(0x7f000000bb00)=""/4096, 0x1000}, {&(0x7f000000cb00)=""/4096, 0x1000}, {&(0x7f000000b3c0)=""/187, 0xbb}, {&(0x7f0000002840)=""/10, 0xa}, {&(0x7f00000029c0)=""/52, 0x34}, {&(0x7f000000db00)=""/202, 0xca}], 0x6)
clock_gettime(0x0, &(0x7f000000b680)={<r4=>0x0, <r5=>0x0})
perf_event_open(&(0x7f000000b780)={0x506a0c221c2909c7, 0x80, 0x3, 0xd0, 0xba, 0x81, 0x0, 0xd0e, 0x60, 0xa, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86, 0x4, @perf_config_ext={0x6, 0x1}, 0x10008, 0x0, 0x3ff, 0x0, 0x2, 0xc2ce, 0x1, 0x0, 0xffffffff, 0x0, 0xffffffffffff7fff}, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0x9)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000002780)=<r6=>0x0)
ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000002800)={0x2, 0x0, 0x1000, 0xc0, 0x1, 0x7})
fcntl$setown(r3, 0x8, r6)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000027c0)='/sys/class/msr', 0x0, 0x0)
recvmmsg$unix(r1, &(0x7f000000b480)=[{{&(0x7f0000000000)=@abs, 0x6e, &(0x7f0000002600)=[{&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000300)=""/133, 0x85}, {&(0x7f00000003c0)=""/71, 0x47}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/44, 0x2c}, {&(0x7f0000001500)=""/211, 0xd3}, {&(0x7f0000001600)=""/4096, 0x1000}], 0x7, &(0x7f0000002680)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f00000026c0), 0x6e, &(0x7f0000002940)=[{&(0x7f0000002740)=""/4, 0x4}, {&(0x7f0000009f40)=""/238, 0xee}, {&(0x7f0000002880)=""/176, 0xb0}], 0x3}}, {{&(0x7f000000b800), 0x25, &(0x7f0000004ac0)=[{&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)=""/4096, 0x1000}, {&(0x7f0000004a00)=""/142, 0x8e}], 0x3, &(0x7f0000004b00)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf0}}, {{&(0x7f0000004c00)=@abs, 0x6e, &(0x7f00000070c0)=[{&(0x7f0000004c80)=""/154, 0x9a}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/241, 0xf1}, {&(0x7f0000004e80)=""/157, 0x9d}, {&(0x7f0000004f40)=""/4096, 0x1000}, {&(0x7f0000005f40)=""/4096, 0x1000}, {&(0x7f0000006f40)=""/218, 0xda}, {&(0x7f0000007040)=""/116, 0x74}], 0x8, &(0x7f0000007140)}}, {{&(0x7f00000071c0)=@abs, 0x6e, &(0x7f0000002980)=[{&(0x7f0000007240)=""/170, 0xaa}, {&(0x7f0000007300)=""/148, 0x94}, {&(0x7f00000073c0)=""/155, 0x9b}, {&(0x7f000000b880)=""/167, 0xa7}], 0x4}}, {{&(0x7f00000074c0)=@abs, 0x6e, &(0x7f0000007b00)=[{&(0x7f0000007540)=""/48, 0x30}, {&(0x7f0000007580)=""/125, 0x7d}, {&(0x7f0000007600)=""/242, 0xf2}, {&(0x7f0000007700)=""/173, 0xad}, {&(0x7f00000077c0)=""/244, 0xf4}, {&(0x7f00000078c0)=""/244, 0xf4}, {&(0x7f00000079c0)=""/198, 0xc6}, {&(0x7f0000007ac0)=""/28, 0x1c}], 0x8, &(0x7f0000007b80)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x88}}, {{&(0x7f0000007c40)=@abs, 0x6e, &(0x7f0000009ec0)=[{&(0x7f0000007cc0)=""/64, 0x40}, {&(0x7f0000007d00)=""/4096, 0x1000}, {&(0x7f0000008d00)=""/178, 0xb2}, {&(0x7f0000008dc0)=""/4096, 0x1000}, {&(0x7f0000009dc0)=""/201, 0xc9}], 0x5, &(0x7f000000b940)=[@rights={{0x50, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf0}}, {{&(0x7f000000a040), 0x6e, &(0x7f000000b340)=[{&(0x7f000000a0c0)=""/4, 0x4}, {&(0x7f000000a100)=""/120, 0x78}, {&(0x7f000000a180)=""/94, 0x5e}, {&(0x7f000000a200)=""/114, 0x72}, {&(0x7f000000a280)=""/4096, 0x1000}, {&(0x7f000000b280)=""/110, 0x6e}, {&(0x7f000000b300)=""/26, 0x1a}], 0x7, &(0x7f000000ba40)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, <r7=>0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc0}}], 0x8, 0x40000000, &(0x7f000000b6c0)={r4, r5+60000000})
openat2(r7, &(0x7f000000b700)='./file2\x00', &(0x7f000000b740)={0x10000, 0x1, 0x7}, 0x18)

23:31:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

23:31:07 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53)

[ 2325.459361] loop0: detected capacity change from 0 to 40
[ 2325.504543] loop4: detected capacity change from 0 to 40
[ 2325.506094] loop3: detected capacity change from 0 to 40
[ 2325.511991] loop1: detected capacity change from 0 to 40
[ 2325.516613] loop2: detected capacity change from 0 to 40
[ 2325.520943] loop6: detected capacity change from 0 to 40
[ 2325.527868] loop5: detected capacity change from 0 to 40
[ 2325.554757] FAT-fs (loop5): bogus number of reserved sectors
[ 2325.555694] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2325.583595] loop3: detected capacity change from 0 to 40
[ 2325.688602] syz-executor.2: attempt to access beyond end of device
[ 2325.688602] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2325.690545] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2325.705639] syz-executor.0: attempt to access beyond end of device
[ 2325.705639] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2325.707961] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:31:07 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa00000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2325.811546] syz-executor.6: attempt to access beyond end of device
[ 2325.811546] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2325.813398] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:31:07 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54)

23:31:07 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x300000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)

[ 2325.950863] loop3: detected capacity change from 0 to 40
23:31:07 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54)

[ 2325.983130] loop2: detected capacity change from 0 to 40
[ 2326.033182] syz-executor.2: attempt to access beyond end of device
[ 2326.033182] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2326.034989] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2326.067159] loop3: detected capacity change from 0 to 40
[ 2326.113615] loop4: detected capacity change from 0 to 40
[ 2326.186948] loop0: detected capacity change from 0 to 40
[ 2326.330571] syz-executor.0: attempt to access beyond end of device
[ 2326.330571] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2326.332397] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:31:21 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:31:21 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
sendfile(r1, r0, 0x0, 0x2)
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r2, 0x0, 0xfffffdef)

23:31:21 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x400000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:21 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, 0xffffffffffffffff, &(0x7f0000000000)=0xfff, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:31:21 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55)

23:31:21 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4800000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:31:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_setup(0x454c, &(0x7f0000000240))

23:31:21 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55)

[ 2339.526681] loop2: detected capacity change from 0 to 40
[ 2339.536044] loop0: detected capacity change from 0 to 40
[ 2339.538011] loop6: detected capacity change from 0 to 40
[ 2339.539754] loop3: detected capacity change from 0 to 40
[ 2339.541293] loop1: detected capacity change from 0 to 40
[ 2339.556920] loop5: detected capacity change from 0 to 40
[ 2339.573907] loop3: detected capacity change from 0 to 40
[ 2339.583006] FAT-fs (loop5): bogus number of reserved sectors
[ 2339.583612] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2339.585471] loop4: detected capacity change from 0 to 40
[ 2339.643789] syz-executor.2: attempt to access beyond end of device
[ 2339.643789] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.645853] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2339.675810] syz-executor.6: attempt to access beyond end of device
[ 2339.675810] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.677880] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2339.721099] syz-executor.0: attempt to access beyond end of device
[ 2339.721099] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.722952] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:31:21 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56)

23:31:21 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c00000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:31:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)

23:31:21 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x500000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:21 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56)

23:31:21 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x600000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r3=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r3, 0x0, 0x80000009, 0x0)
sendfile(r0, r3, &(0x7f0000000000)=0xfff, 0x7fff)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2339.954681] loop0: detected capacity change from 0 to 40
[ 2339.959067] loop3: detected capacity change from 0 to 40
[ 2340.045616] loop3: detected capacity change from 0 to 40
[ 2340.101859] loop2: detected capacity change from 0 to 40
[ 2340.120898] loop4: detected capacity change from 0 to 40
[ 2340.148345] loop6: detected capacity change from 0 to 40
23:31:22 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x700000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2340.302012] syz-executor.0: attempt to access beyond end of device
[ 2340.302012] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2340.304017] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:31:22 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6800000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2340.460721] syz-executor.2: attempt to access beyond end of device
[ 2340.460721] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2340.462543] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2340.475890] loop3: detected capacity change from 0 to 40
[ 2340.536530] loop3: detected capacity change from 0 to 40
23:31:39 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')

23:31:39 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57)

23:31:39 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r2=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r2, 0x0, 0x80000009, 0x0)
read(r2, &(0x7f0000000300)=""/180, 0xb4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000440)={0x1, 0x80, 0x7, 0xc3, 0x9, 0x1, 0x0, 0x6bdb, 0xb306d5fffb3b7c3f, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0x2, 0x8}, 0x40080, 0x4, 0x7, 0x6, 0x8, 0x3, 0x4, 0x0, 0x7f, 0x0, 0x79d}, r1, 0x6, 0xffffffffffffffff, 0x0)
r4 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0xa}, 0x15182, 0x7, 0x9b1, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = socket$inet_udplite(0x2, 0x2, 0x88)
sendmmsg$inet(r5, &(0x7f00000045c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[@ip_retopts={{0x24, 0x0, 0x7, {[@timestamp_addr={0x44, 0x14, 0x9, 0x1, 0x9, [{@remote}, {@loopback}]}]}}}], 0x28}}], 0x1, 0x0)
r6 = io_uring_setup(0x5d28, &(0x7f0000000000)={0x0, 0x800c, 0x10, 0x2, 0x1f0, 0x0, r4})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x50008, 0x0, 0x10001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r3, r0, 0x0, 0xfffffdef)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x80000, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="3801000010000000007463178de97ade59a6330f6d3bc83b00000000000000fe8000000000000000000000000000bbac1e00010000000000000000000000000000000000000000000000000000000031774da9c6a03fc462accb78e29e280e700ed65e438e6436c48e70f72e032c9789623aa5070000000000000098d331062eaf79400200000000000000d594d64f52f5dd38f6715dc9fbb6b8d40617b368c6dde821c3a29b602f380dfb625b36878f586e03cb9a6434c7c0b5cc361a8a3f14dad825b8e2cfeb7e6a45635808e39f0d78544b19d18f21c142e131676e767dbac480a14af3e6726e533ae96fcf25ff2060fd5da5540afe9ca9715484e1b7263f94852027", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000fc02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000100736d3300"/240], 0x138}}, 0x0)
sendfile(r7, r6, &(0x7f00000003c0)=0xa7, 0xfffffffffffff1f7)

23:31:39 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:31:39 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0xa00000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:39 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x6c00000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:31:39 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57)

23:31:39 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
sendfile(r2, r0, 0x0, 0x1)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2357.617719] loop3: detected capacity change from 0 to 40
[ 2357.654350] loop3: detected capacity change from 0 to 40
[ 2357.669984] loop4: detected capacity change from 0 to 40
[ 2357.677213] loop0: detected capacity change from 0 to 40
[ 2357.697636] loop1: detected capacity change from 0 to 40
[ 2357.699448] loop2: detected capacity change from 0 to 40
[ 2357.701194] loop5: detected capacity change from 0 to 40
23:31:39 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7400000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

23:31:39 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_setup(0x454c, &(0x7f0000000240))
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_uring_setup(0x1d27, &(0x7f0000000480)={0x0, 0x800c, 0x10, 0x1, 0x1f0, 0x0, r2})
r3 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.kill\x00', 0x0, 0x0)
openat(r3, &(0x7f0000000040)='./file0\x00', 0x4000, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2357.728128] FAT-fs (loop5): bogus number of reserved sectors
[ 2357.729223] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2357.779826] loop3: detected capacity change from 0 to 40
23:31:39 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000010000f57ed119005f7748eb843db879ce11e0e37d070b4f6e0ca6091a6ee832e5ee7d9a7a76748aadcb68ce02859198134eb1d90b43524ba61b1e8cc083691bf6df5d10fe6e0ab8b44278a81ab882f6e4d8943317", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00'])
unlink(&(0x7f0000000080)='./file0\x00')

23:31:39 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58)

[ 2357.871757] loop4: detected capacity change from 0 to 40
[ 2357.874792] loop0: detected capacity change from 0 to 40
23:31:39 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x7a00000000000000)
r2 = dup(0xffffffffffffffff)
bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2357.905135] syz-executor.2: attempt to access beyond end of device
[ 2357.905135] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2357.906981] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:31:39 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4800000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:39 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')

[ 2357.956198] loop3: detected capacity change from 0 to 40
[ 2357.993714] loop3: detected capacity change from 0 to 40
23:31:39 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59)

23:31:40 executing program 3:
syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x3, 0x0, 0x0, 0x1, 0x0, 0x6a, 0x8400, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x1, 0x9}, 0x100, 0x7f, 0x3, 0x0, 0x9, 0x2, 0x1000, 0x0, 0x9, 0x0, 0x80000000}, 0x0, 0x7, r1, 0x0)
r3 = dup(0xffffffffffffffff)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x1, 0x3, 0x3f, 0x5, 0x0, 0x3, 0x2801, 0x7, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x3, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext={0xc93, 0x101}, 0x521, 0x8001, 0x0, 0x6, 0x100, 0x4, 0x4, 0x0, 0x4, 0x0, 0x1}, 0x0, 0x9, r3, 0xa)
bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)

[ 2358.096578] loop0: detected capacity change from 0 to 40
23:31:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180)=<r1=>0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
waitid$P_PIDFD(0x2, r1, 0x0, 0x80000009, 0x0)
unlink(&(0x7f0000000080)='./file0\x00')

23:31:40 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, &(0x7f00000001c0))
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58)

[ 2358.139155] loop3: detected capacity change from 0 to 40
[ 2358.179190] loop3: detected capacity change from 0 to 40
[ 2358.184640] syz-executor.0: attempt to access beyond end of device
[ 2358.184640] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2358.186011] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2358.213933] loop4: detected capacity change from 0 to 40
[ 2358.306098] loop2: detected capacity change from 0 to 40
[ 2358.358456] syz-executor.2: attempt to access beyond end of device
[ 2358.358456] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2358.360062] Buffer I/O error on dev loop2, logical block 10, lost async page write
23:31:40 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x11, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x100, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev2(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)="05ff232ef592436bf2d9", 0xa}, {&(0x7f0000000100)="9f", 0x1}], 0x2, 0x0, 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60)

23:31:40 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0xa015000)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
pread64(r1, &(0x7f0000000180)=""/234, 0xea, 0x4c00000000000000)
sendfile(r1, r0, &(0x7f0000000000)=0xfff, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:31:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="15"], 0x6)
clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
unlink(&(0x7f0000000080)='./file0\x00')

23:31:40 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00')
openat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x68c702, 0x22)
openat(r0, &(0x7f0000000040)='./file2\x00', 0x20100, 0x21)
pread64(r2, &(0x7f0000000180)=""/234, 0xea, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
write$bt_hci(0xffffffffffffffff, 0x0, 0x6)
perf_event_open(&(0x7f0000000340)={0x5, 0x80, 0x0, 0x7, 0xd8, 0x7, 0x0, 0x400, 0x20900, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x4, 0x1}, 0x4, 0x0, 0x0, 0x7, 0x101, 0x5, 0x3, 0x0, 0x20, 0x0, 0x3}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2358.603067] loop0: detected capacity change from 0 to 40
[ 2358.660343] loop4: detected capacity change from 0 to 40
[ 2358.664012] syz-executor.0: attempt to access beyond end of device
[ 2358.664012] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2358.665439] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2358.726553] loop1: detected capacity change from 0 to 40
[ 2360.202448] ==================================================================
[ 2360.203499] BUG: KASAN: use-after-free in __lock_acquire+0x42c9/0x5e70
[ 2360.204361] Read of size 8 at addr ffff888017fab0f8 by task syz-executor/10338
[ 2360.205316] 
[ 2360.205548] CPU: 0 PID: 10338 Comm: syz-executor Not tainted 5.19.0-next-20220805 #1
[ 2360.206571] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 2360.208006] Call Trace:
[ 2360.208354]  <TASK>
[ 2360.208674]  dump_stack_lvl+0x8b/0xb3
[ 2360.209195]  print_report.cold+0x5e/0x5e5
[ 2360.209758]  ? __lock_acquire+0x42c9/0x5e70
[ 2360.210344]  kasan_report+0xb1/0x1c0
[ 2360.210872]  ? __lock_acquire+0x42c9/0x5e70
[ 2360.211464]  __lock_acquire+0x42c9/0x5e70
[ 2360.212030]  ? lock_chain_count+0x20/0x20
[ 2360.212612]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 2360.213309]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 2360.214009]  ? finish_task_switch.isra.0+0x22d/0x8a0
[ 2360.214718]  lock_acquire+0x1a2/0x530
[ 2360.215451]  ? kmemleak_scan+0x21d/0x16f0
[ 2360.216580]  ? lock_release+0x750/0x750
[ 2360.217576]  ? rcu_read_lock_sched_held+0x3e/0x80
[ 2360.218284]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2360.218928]  ? ct_nmi_exit+0x119/0x1c0
[ 2360.219504]  _raw_spin_lock_irq+0x32/0x50
[ 2360.220106]  ? kmemleak_scan+0x21d/0x16f0
[ 2360.220735]  kmemleak_scan+0x21d/0x16f0
[ 2360.221321]  ? paint_ptr+0xc0/0xc0
[ 2360.221847]  ? strncpy_from_user+0x204/0x3e0
[ 2360.222495]  kmemleak_write+0x570/0x680
[ 2360.223068]  ? kmemleak_scan+0x16f0/0x16f0
[ 2360.223686]  ? debugfs_file_get+0x1ce/0x450
[ 2360.224310]  ? debugfs_file_put+0xd0/0xd0
[ 2360.224928]  full_proxy_write+0x11d/0x190
[ 2360.225532]  vfs_write+0x2cb/0xd90
[ 2360.226054]  ? full_proxy_poll+0x180/0x180
[ 2360.226669]  ? __ia32_sys_pread64+0x220/0x220
[ 2360.227323]  ? lock_release+0x3b2/0x750
[ 2360.227904]  ? syscall_enter_from_user_mode+0x18/0x50
[ 2360.228657]  ? perf_trace_preemptirq_template+0xa2/0x420
[ 2360.229428]  ? __fget_light+0x212/0x280
[ 2360.230001]  ksys_write+0x127/0x250
[ 2360.230534]  ? __ia32_sys_read+0xb0/0xb0
[ 2360.231123]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2360.231852]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2360.232601]  do_syscall_64+0x3b/0x90
[ 2360.233146]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 2360.233892] RIP: 0033:0x7fe99afa25c3
[ 2360.234424] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
[ 2360.236995] RSP: 002b:00007ffd1df74b98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 2360.238066] RAX: ffffffffffffffda RBX: 00007ffd1df751d8 RCX: 00007fe99afa25c3
[ 2360.239059] RDX: 0000000000000004 RSI: 00007fe99b058ed9 RDI: 0000000000000003
[ 2360.240032] RBP: 0000000000000002 R08: 0000000000000937 R09: 00007ffd1dfcf080
[ 2360.241023] R10: 00007ffd1dfcf090 R11: 0000000000000246 R12: 00000000fffffff6
[ 2360.242006] R13: 00007ffd1df75ef1 R14: 0000000000000000 R15: 000000000024009d
[ 2360.242992]  </TASK>
[ 2360.243325] 
[ 2360.243567] Allocated by task 8073:
[ 2360.244066]  kasan_save_stack+0x1e/0x40
[ 2360.244646]  __kasan_slab_alloc+0x66/0x80
[ 2360.245238]  kmem_cache_alloc+0x1b1/0x4a0
[ 2360.245825]  __create_object.isra.0+0x3d/0xc10
[ 2360.246480]  __kmalloc+0x25f/0x450
[ 2360.246995]  cfg80211_inform_single_bss_frame_data+0x328/0xef0
[ 2360.247837]  cfg80211_inform_bss_frame_data+0xa6/0xba0
[ 2360.248581]  ieee80211_bss_info_update+0x34b/0xae0
[ 2360.249280]  ieee80211_ibss_rx_queued_mgmt+0x1992/0x2f80
[ 2360.250046]  ieee80211_iface_work+0x9c5/0xc80
[ 2360.250696]  process_one_work+0xa0f/0x1690
[ 2360.251292]  worker_thread+0x637/0x1260
[ 2360.251875]  kthread+0x2ed/0x3a0
[ 2360.252370]  ret_from_fork+0x22/0x30
[ 2360.252900] 
[ 2360.253128] Freed by task 19:
[ 2360.253557]  kasan_save_stack+0x1e/0x40
[ 2360.254091]  kasan_set_track+0x21/0x30
[ 2360.254610]  kasan_set_free_info+0x20/0x40
[ 2360.255178]  __kasan_slab_free+0x108/0x190
[ 2360.255760]  kmem_cache_free+0xfb/0x610
[ 2360.256312]  rcu_core+0x7e2/0x2080
[ 2360.256819]  __do_softirq+0x1c8/0x8d0
[ 2360.257335] 
[ 2360.257567] Last potentially related work creation:
[ 2360.258211]  kasan_save_stack+0x1e/0x40
[ 2360.258748]  __kasan_record_aux_stack+0x97/0xb0
[ 2360.259398]  call_rcu+0x6a/0xa30
[ 2360.259857]  kmem_cache_free_bulk.part.0+0x305/0x840
[ 2360.260558]  kfree_rcu_work+0x3fa/0xbd0
[ 2360.261094]  process_one_work+0xa0f/0x1690
[ 2360.261657]  worker_thread+0x637/0x1260
[ 2360.262200]  kthread+0x2ed/0x3a0
[ 2360.262665]  ret_from_fork+0x22/0x30
[ 2360.263161] 
[ 2360.263395] Second to last potentially related work creation:
[ 2360.264161]  kasan_save_stack+0x1e/0x40
[ 2360.264710]  __kasan_record_aux_stack+0x97/0xb0
[ 2360.265354]  call_rcu+0x6a/0xa30
[ 2360.265824]  kmem_cache_free+0xc1/0x610
[ 2360.266369]  kfree_skbmem+0xef/0x1b0
[ 2360.266892]  kfree_skb_reason+0x85/0x110
[ 2360.267437]  ieee80211_iface_work+0x34f/0xc80
[ 2360.268029]  process_one_work+0xa0f/0x1690
[ 2360.268618]  worker_thread+0x637/0x1260
[ 2360.269164]  kthread+0x2ed/0x3a0
[ 2360.269624]  ret_from_fork+0x22/0x30
[ 2360.270128] 
[ 2360.270359] The buggy address belongs to the object at ffff888017fab0e0
[ 2360.270359]  which belongs to the cache kmemleak_object of size 368
[ 2360.272032] The buggy address is located 24 bytes inside of
[ 2360.272032]  368-byte region [ffff888017fab0e0, ffff888017fab250)
[ 2360.273582] 
[ 2360.273824] The buggy address belongs to the physical page:
[ 2360.274584] page:00000000ec0fb64a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17faa
[ 2360.275846] head:00000000ec0fb64a order:1 compound_mapcount:0 compound_pincount:0
[ 2360.276873] flags: 0x100000000010200(slab|head|node=0|zone=1)
[ 2360.277681] raw: 0100000000010200 0000000000000000 dead000000000001 ffff888007c4f780
[ 2360.278730] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000
[ 2360.279776] page dumped because: kasan: bad access detected
[ 2360.280556] 
[ 2360.280792] Memory state around the buggy address:
[ 2360.281456]  ffff888017faaf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2360.282428]  ffff888017fab000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2360.283398] >ffff888017fab080: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb
[ 2360.284367]                                                                 ^
[ 2360.285332]  ffff888017fab100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2360.286304]  ffff888017fab180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2360.287268] ==================================================================
[ 2360.288241] Disabling lock debugging due to kernel taint

VM DIAGNOSIS:
23:31:42  Registers:
info registers vcpu 0
RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff82409281 RDI=ffffffff8762a640 RBP=ffffffff8762a600 RSP=ffff88804542f268
R8 =0000000000000001 R9 =000000000000000a R10=0000000000000032 R11=0000000000000001
R12=0000000000000032 R13=ffffffff8762a600 R14=0000000000000010 R15=ffffffff82409270
RIP=ffffffff824092d9 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000555557294400 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffd1dfcf080 CR3=0000000017cfa000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 2525252525252525 2525252525252525
YMM01=0000000000000000 0000000000000000 00000000000000ff 0000000000ff0000
YMM02=0000000000000000 0000000000000000 00000000000000ff 0000000000ff0000
YMM03=0000000000000000 0000000000000000 696e656420737365 636341002f737973
YMM04=0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f
YMM05=0000000000000000 0000000000000000 ffffffffffff0000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000006561 6124242f6867632f
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 732f636f72702f00 6b63616d7300632e
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=ffffffff84202d90 RBX=ffff888008655100 RCX=ffffffff841e4c02 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=0000000000000001 RSP=ffff888008687e58
R8 =0000000000000001 R9 =ffff88806cf33b53 R10=ffffed100d9e676a R11=0000000000000001
R12=ffffed10010caa20 R13=ffffffff85aee350 R14=0000000000000000 R15=dffffc0000000000
RIP=ffffffff84202d9b RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055eeb75b7060 CR3=0000000045a1e000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 00000013ffffffff 000055eeb75ab980
YMM02=0000000000000000 0000000000000000 ffffff0f0e0d0c0b 0a09080706050403
YMM03=0000000000000000 0000000000000000 696e656420737365 636341002f737973
YMM04=0000000000000000 0000000000000000 323d44455a494c41 4954494e495f4345
YMM05=0000000000000000 0000000000000000 3d5145534b534944 006b7369643d4550
YMM06=0000000000000000 0000000000000000 3d454d414e564544 00303d444955555f
YMM07=0000000000000000 0000000000000000 5953425553003470 6f6f6c2f6b636f6c
YMM08=0000000000000000 0000000000000000 49006d756e203c20 69000a313a56000a
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000