0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:05:35 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300), 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 1968.653497] loop1: detected capacity change from 0 to 40
23:05:35 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 1968.668409] loop6: detected capacity change from 0 to 40
[ 1968.693774] bio_check_eod: 3 callbacks suppressed
[ 1968.693785] syz-executor.3: attempt to access beyond end of device
[ 1968.693785] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.695419] buffer_io_error: 3 callbacks suppressed
[ 1968.695457] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 1968.725900] loop4: detected capacity change from 0 to 40
[ 1968.728161] loop7: detected capacity change from 0 to 40
[ 1968.736351] syz-executor.6: attempt to access beyond end of device
[ 1968.736351] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.737509] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:05:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b438"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:05:35 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:35 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 1968.850349] syz-executor.1: attempt to access beyond end of device
[ 1968.850349] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.852265] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 1968.864910] syz-executor.7: attempt to access beyond end of device
[ 1968.864910] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.866087] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 1968.867190] loop3: detected capacity change from 0 to 40
[ 1968.889837] syz-executor.4: attempt to access beyond end of device
[ 1968.889837] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.891704] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1968.903423] loop6: detected capacity change from 0 to 40
23:05:35 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1968.978179] syz-executor.3: attempt to access beyond end of device
[ 1968.978179] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1968.979306] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:05:35 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x0, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:05:35 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:35 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:35 executing program 0:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 1969.046597] loop5: detected capacity change from 0 to 40
[ 1969.059776] syz-executor.6: attempt to access beyond end of device
[ 1969.059776] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1969.060934] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1969.076306] loop7: detected capacity change from 0 to 40
23:05:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b438"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1969.197428] loop4: detected capacity change from 0 to 40
[ 1969.255503] syz-executor.7: attempt to access beyond end of device
[ 1969.255503] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1969.257396] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 1969.274495] syz-executor.5: attempt to access beyond end of device
[ 1969.274495] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1969.276332] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 1969.317905] loop3: detected capacity change from 0 to 40
[ 1969.417964] syz-executor.4: attempt to access beyond end of device
[ 1969.417964] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1969.420291] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:05:51 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:05:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b438"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:05:51 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:51 executing program 0:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

23:05:51 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b438"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:05:51 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:51 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:51 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:05:51 executing program 0:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 1984.224183] loop5: detected capacity change from 0 to 40
[ 1984.230621] loop3: detected capacity change from 0 to 40
[ 1984.240108] loop1: detected capacity change from 0 to 40
[ 1984.243135] loop7: detected capacity change from 0 to 40
[ 1984.247479] loop4: detected capacity change from 0 to 40
[ 1984.271606] loop6: detected capacity change from 0 to 40
[ 1984.418894] bio_check_eod: 1 callbacks suppressed
[ 1984.418917] syz-executor.6: attempt to access beyond end of device
[ 1984.418917] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.422705] buffer_io_error: 1 callbacks suppressed
[ 1984.422723] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1984.434273] syz-executor.3: attempt to access beyond end of device
[ 1984.434273] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.436222] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 1984.438294] syz-executor.4: attempt to access beyond end of device
[ 1984.438294] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.440119] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 1984.448211] syz-executor.7: attempt to access beyond end of device
[ 1984.448211] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.450215] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 1984.468811] syz-executor.1: attempt to access beyond end of device
[ 1984.468811] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.470629] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 1984.505426] syz-executor.5: attempt to access beyond end of device
[ 1984.505426] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1984.507303] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:06:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

23:06:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:06 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:06 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, 0x0, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 1999.514174] loop1: detected capacity change from 0 to 40
[ 1999.549417] loop7: detected capacity change from 0 to 40
[ 1999.550512] loop4: detected capacity change from 0 to 40
[ 1999.557042] loop3: detected capacity change from 0 to 40
[ 1999.560057] loop6: detected capacity change from 0 to 40
[ 1999.689715] syz-executor.4: attempt to access beyond end of device
[ 1999.689715] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1999.691825] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:06:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 1999.714686] syz-executor.3: attempt to access beyond end of device
[ 1999.714686] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1999.717226] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 1999.734656] syz-executor.6: attempt to access beyond end of device
[ 1999.734656] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1999.736852] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 1999.791451] syz-executor.7: attempt to access beyond end of device
[ 1999.791451] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 1999.793592] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:06:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:06 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 1999.934856] loop5: detected capacity change from 0 to 40
23:06:06 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 2000.013279] loop7: detected capacity change from 0 to 40
[ 2000.016743] loop4: detected capacity change from 0 to 40
[ 2000.055178] loop6: detected capacity change from 0 to 40
[ 2000.063165] loop3: detected capacity change from 0 to 40
[ 2000.123519] syz-executor.5: attempt to access beyond end of device
[ 2000.123519] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.124794] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2000.152652] syz-executor.4: attempt to access beyond end of device
[ 2000.152652] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.153918] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2000.160465] syz-executor.7: attempt to access beyond end of device
[ 2000.160465] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.161847] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:06:07 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x0, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:06:07 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2000.299824] syz-executor.3: attempt to access beyond end of device
[ 2000.299824] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.302209] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2000.334780] loop4: detected capacity change from 0 to 40
[ 2000.340359] syz-executor.6: attempt to access beyond end of device
[ 2000.340359] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.343142] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2000.385249] syz-executor.4: attempt to access beyond end of device
[ 2000.385249] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2000.386840] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:06:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

23:06:21 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x0, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:06:21 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:21 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:21 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:21 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:06:21 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2014.841823] loop4: detected capacity change from 0 to 40
[ 2014.845313] loop6: detected capacity change from 0 to 40
23:06:21 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x0, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2014.875387] loop7: detected capacity change from 0 to 40
[ 2014.879587] loop3: detected capacity change from 0 to 40
23:06:21 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2014.941303] loop1: detected capacity change from 0 to 40
[ 2014.988412] syz-executor.1: attempt to access beyond end of device
[ 2014.988412] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2014.989503] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:06:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 2015.020590] syz-executor.7: attempt to access beyond end of device
[ 2015.020590] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.021683] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2015.062335] syz-executor.6: attempt to access beyond end of device
[ 2015.062335] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.063626] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:06:21 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2015.104741] syz-executor.4: attempt to access beyond end of device
[ 2015.104741] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.105804] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2015.109532] syz-executor.3: attempt to access beyond end of device
[ 2015.109532] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.111373] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:06:21 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:22 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 2015.265290] loop1: detected capacity change from 0 to 40
23:06:22 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:22 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2015.334598] syz-executor.1: attempt to access beyond end of device
[ 2015.334598] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.336516] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2015.346549] loop7: detected capacity change from 0 to 40
23:06:22 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2015.452752] syz-executor.7: attempt to access beyond end of device
[ 2015.452752] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.454633] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2015.466733] loop5: detected capacity change from 0 to 40
23:06:22 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])

[ 2015.482394] loop3: detected capacity change from 0 to 40
23:06:22 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2015.528511] loop6: detected capacity change from 0 to 40
[ 2015.530227] loop4: detected capacity change from 0 to 40
[ 2015.573804] syz-executor.3: attempt to access beyond end of device
[ 2015.573804] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.575701] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:06:22 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2015.666142] loop7: detected capacity change from 0 to 40
23:06:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2015.763284] syz-executor.4: attempt to access beyond end of device
[ 2015.763284] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.765185] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2015.775776] syz-executor.5: attempt to access beyond end of device
[ 2015.775776] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2015.777652] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:06:22 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2015.849836] loop3: detected capacity change from 0 to 40
[ 2015.895394] loop7: detected capacity change from 0 to 40
23:06:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x0, 0x0)

23:06:37 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:37 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:37 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:37 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2030.570863] loop6: detected capacity change from 0 to 40
23:06:37 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2030.581416] loop4: detected capacity change from 0 to 40
[ 2030.591379] loop7: detected capacity change from 0 to 40
23:06:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:37 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2030.610026] loop3: detected capacity change from 0 to 40
[ 2030.636378] loop1: detected capacity change from 0 to 40
[ 2030.640910] loop5: detected capacity change from 0 to 40
[ 2030.662993] bio_check_eod: 2 callbacks suppressed
[ 2030.663004] syz-executor.3: attempt to access beyond end of device
[ 2030.663004] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.664837] buffer_io_error: 2 callbacks suppressed
[ 2030.664846] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2030.674710] syz-executor.4: attempt to access beyond end of device
[ 2030.674710] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.675892] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2030.677195] syz-executor.6: attempt to access beyond end of device
[ 2030.677195] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.678435] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2030.798437] syz-executor.5: attempt to access beyond end of device
[ 2030.798437] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.800140] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2030.808316] syz-executor.1: attempt to access beyond end of device
[ 2030.808316] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2030.809446] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:06:53 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x0, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:06:53 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 0:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x0, 0x0)

23:06:53 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2046.205050] loop6: detected capacity change from 0 to 40
23:06:53 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, 0x0, 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.218133] loop3: detected capacity change from 0 to 40
[ 2046.278658] loop4: detected capacity change from 0 to 40
[ 2046.287411] loop7: detected capacity change from 0 to 40
[ 2046.298828] loop5: detected capacity change from 0 to 40
[ 2046.306185] syz-executor.6: attempt to access beyond end of device
[ 2046.306185] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.308165] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2046.436823] syz-executor.3: attempt to access beyond end of device
[ 2046.436823] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.438837] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:06:53 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.487111] syz-executor.4: attempt to access beyond end of device
[ 2046.487111] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.489299] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:06:53 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, 0x0, 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.536389] syz-executor.5: attempt to access beyond end of device
[ 2046.536389] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.538250] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2046.575373] loop0: detected capacity change from 0 to 40
[ 2046.601185] loop6: detected capacity change from 0 to 40
23:06:53 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2046.654510] loop7: detected capacity change from 0 to 40
23:06:53 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.680380] syz-executor.6: attempt to access beyond end of device
[ 2046.680380] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.682352] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:06:53 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:53 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.775521] loop3: detected capacity change from 0 to 40
[ 2046.785888] syz-executor.0: attempt to access beyond end of device
[ 2046.785888] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2046.787927] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2046.888225] loop1: detected capacity change from 0 to 40
[ 2046.895355] loop4: detected capacity change from 0 to 40
23:06:53 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2046.912778] loop5: detected capacity change from 0 to 40
[ 2047.106582] perf: interrupt took too long (21274 > 21273), lowering kernel.perf_event_max_sample_rate to 9000
[ 2047.131945] syz-executor.4: attempt to access beyond end of device
[ 2047.131945] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.134387] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2047.149416] syz-executor.1: attempt to access beyond end of device
[ 2047.149416] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.151929] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:06:54 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:54 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, 0x0, 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:54 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:54 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:06:54 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x0, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2047.423339] loop0: detected capacity change from 0 to 40
[ 2047.448772] syz-executor.3: attempt to access beyond end of device
[ 2047.448772] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.451442] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2047.491910] loop7: detected capacity change from 0 to 40
[ 2047.570733] loop4: detected capacity change from 0 to 40
23:06:54 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:06:54 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2047.911644] syz-executor.4: attempt to access beyond end of device
[ 2047.911644] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2047.913757] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2047.919753] loop3: detected capacity change from 0 to 40
[ 2048.009593] loop7: detected capacity change from 0 to 40
23:06:54 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2048.085791] loop5: detected capacity change from 0 to 40
[ 2049.025381] syz-executor.5 (9286) used greatest stack depth: 22640 bytes left
23:07:12 executing program 5:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:07:12 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, 0x0, 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:12 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:12 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:12 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:12 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x0, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:07:12 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2065.171900] loop1: detected capacity change from 0 to 40
[ 2065.172602] loop4: detected capacity change from 0 to 40
[ 2065.196512] loop7: detected capacity change from 0 to 40
[ 2065.227483] loop6: detected capacity change from 0 to 40
[ 2065.228944] loop3: detected capacity change from 0 to 40
[ 2065.245526] bio_check_eod: 2 callbacks suppressed
[ 2065.245537] syz-executor.4: attempt to access beyond end of device
[ 2065.245537] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.247128] buffer_io_error: 2 callbacks suppressed
[ 2065.247137] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2065.287383] syz-executor.7: attempt to access beyond end of device
[ 2065.287383] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.288497] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:07:12 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:12 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2065.350541] loop0: detected capacity change from 0 to 40
23:07:12 executing program 7:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2065.383530] syz-executor.3: attempt to access beyond end of device
[ 2065.383530] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.385003] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2065.398691] syz-executor.1: attempt to access beyond end of device
[ 2065.398691] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.399826] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:07:12 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2065.458877] loop4: detected capacity change from 0 to 40
23:07:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2065.491823] syz-executor.6: attempt to access beyond end of device
[ 2065.491823] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.493399] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2065.500164] loop7: detected capacity change from 0 to 40
[ 2065.506719] syz-executor.0: attempt to access beyond end of device
[ 2065.506719] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.507765] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2065.509596] loop5: detected capacity change from 0 to 40
[ 2065.601332] loop3: detected capacity change from 0 to 40
[ 2065.608713] syz-executor.4: attempt to access beyond end of device
[ 2065.608713] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.609881] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2065.654821] syz-executor.7: attempt to access beyond end of device
[ 2065.654821] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.655871] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2065.674348] syz-executor.5: attempt to access beyond end of device
[ 2065.674348] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.675620] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2065.711355] syz-executor.3: attempt to access beyond end of device
[ 2065.711355] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2065.713273] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:07:27 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:07:27 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:27 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:27 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:27 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2080.849245] loop6: detected capacity change from 0 to 40
23:07:27 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:27 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:27 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2080.872153] loop1: detected capacity change from 0 to 40
[ 2080.875221] loop0: detected capacity change from 0 to 40
[ 2080.879276] loop3: detected capacity change from 0 to 40
[ 2080.883201] loop7: detected capacity change from 0 to 40
[ 2080.890289] loop4: detected capacity change from 0 to 40
[ 2080.898172] loop5: detected capacity change from 0 to 40
[ 2080.980550] syz-executor.3: attempt to access beyond end of device
[ 2080.980550] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2080.982427] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2081.021011] syz-executor.6: attempt to access beyond end of device
[ 2081.021011] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.022847] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2081.029679] syz-executor.1: attempt to access beyond end of device
[ 2081.029679] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.031917] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2081.055670] syz-executor.7: attempt to access beyond end of device
[ 2081.055670] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.057490] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2081.080955] syz-executor.4: attempt to access beyond end of device
[ 2081.080955] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.083734] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:07:28 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, 0x0)
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:07:28 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:28 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:28 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2081.253313] syz-executor.0: attempt to access beyond end of device
[ 2081.253313] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.255218] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2081.308623] loop1: detected capacity change from 0 to 40
23:07:28 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2081.324633] FAT-fs (loop1): bogus number of FAT sectors
[ 2081.325428] FAT-fs (loop1): Can't find a valid FAT filesystem
23:07:28 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2081.404542] loop3: detected capacity change from 0 to 40
[ 2081.406124] loop7: detected capacity change from 0 to 40
[ 2081.426817] loop6: detected capacity change from 0 to 40
23:07:28 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2081.533571] loop4: detected capacity change from 0 to 40
[ 2081.559400] syz-executor.7: attempt to access beyond end of device
[ 2081.559400] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.561292] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2081.583697] syz-executor.3: attempt to access beyond end of device
[ 2081.583697] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.585693] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:07:28 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:28 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2081.796582] loop0: detected capacity change from 0 to 40
[ 2081.798523] syz-executor.4: attempt to access beyond end of device
[ 2081.798523] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2081.800620] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2081.850152] loop7: detected capacity change from 0 to 40
[ 2082.102857] syz-executor.7: attempt to access beyond end of device
[ 2082.102857] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2082.105335] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:07:42 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:42 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0))
getresgid(&(0x7f00000055c0)=<r2=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r2, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:07:42 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:42 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2095.837771] loop4: detected capacity change from 0 to 40
23:07:42 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2095.840214] loop7: detected capacity change from 0 to 40
[ 2095.857632] loop0: detected capacity change from 0 to 40
[ 2095.861248] loop6: detected capacity change from 0 to 40
[ 2095.862871] loop5: detected capacity change from 0 to 40
23:07:42 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:42 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2095.887415] loop3: detected capacity change from 0 to 40
[ 2095.926933] bio_check_eod: 2 callbacks suppressed
[ 2095.926946] syz-executor.4: attempt to access beyond end of device
[ 2095.926946] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2095.928617] buffer_io_error: 2 callbacks suppressed
[ 2095.928626] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2095.941680] syz-executor.5: attempt to access beyond end of device
[ 2095.941680] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2095.943068] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:07:42 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, 0x0, 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:42 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2096.031689] syz-executor.6: attempt to access beyond end of device
[ 2096.031689] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.033692] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:07:42 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2096.051401] syz-executor.7: attempt to access beyond end of device
[ 2096.051401] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.053664] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2096.066506] loop1: detected capacity change from 0 to 40
[ 2096.082695] loop4: detected capacity change from 0 to 40
[ 2096.093274] syz-executor.3: attempt to access beyond end of device
[ 2096.093274] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.095305] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2096.097145] syz-executor.0: attempt to access beyond end of device
[ 2096.097145] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.099098] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2096.141385] syz-executor.4: attempt to access beyond end of device
[ 2096.141385] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.142697] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:07:43 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:43 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2096.188719] loop5: detected capacity change from 0 to 40
[ 2096.214252] loop1: detected capacity change from 0 to 40
[ 2096.215754] loop7: detected capacity change from 0 to 40
[ 2096.301437] syz-executor.1: attempt to access beyond end of device
[ 2096.301437] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.302902] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2096.309717] syz-executor.7: attempt to access beyond end of device
[ 2096.309717] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.310851] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2096.330368] syz-executor.5: attempt to access beyond end of device
[ 2096.330368] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2096.331365] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:07:58 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:58 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:58 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:58 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:58 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2111.734674] loop4: detected capacity change from 0 to 40
23:07:58 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2111.740232] loop6: detected capacity change from 0 to 40
23:07:58 executing program 0:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2111.771165] loop7: detected capacity change from 0 to 40
[ 2111.792741] loop5: detected capacity change from 0 to 40
[ 2111.794587] loop1: detected capacity change from 0 to 40
[ 2111.797329] loop3: detected capacity change from 0 to 40
[ 2111.833670] syz-executor.6: attempt to access beyond end of device
[ 2111.833670] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2111.835442] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2111.850845] syz-executor.4: attempt to access beyond end of device
[ 2111.850845] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2111.852562] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2111.975663] syz-executor.3: attempt to access beyond end of device
[ 2111.975663] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2111.977425] syz-executor.7: attempt to access beyond end of device
[ 2111.977425] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2111.977469] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2111.980948] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2112.047667] syz-executor.5: attempt to access beyond end of device
[ 2112.047667] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.049450] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:07:58 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:58 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2112.115711] syz-executor.1: attempt to access beyond end of device
[ 2112.115711] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.117691] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:07:59 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300), 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2112.175405] loop6: detected capacity change from 0 to 40
23:07:59 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2112.208885] loop7: detected capacity change from 0 to 40
[ 2112.220189] loop4: detected capacity change from 0 to 40
[ 2112.239770] syz-executor.6: attempt to access beyond end of device
[ 2112.239770] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.241458] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:07:59 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:07:59 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:07:59 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2112.368719] loop0: detected capacity change from 0 to 40
[ 2112.374204] syz-executor.4: attempt to access beyond end of device
[ 2112.374204] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.376210] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2112.382077] loop6: detected capacity change from 0 to 40
23:07:59 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2112.453091] loop5: detected capacity change from 0 to 40
[ 2112.454478] loop3: detected capacity change from 0 to 40
[ 2112.491504] syz-executor.7: attempt to access beyond end of device
[ 2112.491504] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.493523] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2112.510668] syz-executor.6: attempt to access beyond end of device
[ 2112.510668] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2112.512411] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2112.563226] loop1: detected capacity change from 0 to 40
23:08:12 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:12 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2126.121305] loop4: detected capacity change from 0 to 40
[ 2126.149623] loop5: detected capacity change from 0 to 40
23:08:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:08:12 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:12 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000))
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:08:12 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300), 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:12 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:12 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2126.153351] loop6: detected capacity change from 0 to 40
[ 2126.156073] loop7: detected capacity change from 0 to 40
[ 2126.157817] loop3: detected capacity change from 0 to 40
[ 2126.219677] bio_check_eod: 4 callbacks suppressed
[ 2126.219699] syz-executor.4: attempt to access beyond end of device
[ 2126.219699] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.222585] buffer_io_error: 4 callbacks suppressed
[ 2126.222601] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2126.280206] syz-executor.3: attempt to access beyond end of device
[ 2126.280206] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.281798] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2126.283177] syz-executor.5: attempt to access beyond end of device
[ 2126.283177] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.284728] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2126.368896] syz-executor.7: attempt to access beyond end of device
[ 2126.368896] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.370879] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2126.374369] syz-executor.6: attempt to access beyond end of device
[ 2126.374369] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.376325] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:08:13 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:08:13 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:13 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:13 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2126.479292] loop0: detected capacity change from 0 to 40
[ 2126.491121] FAT-fs (loop0): invalid media value (0x00)
[ 2126.491629] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2126.562208] loop3: detected capacity change from 0 to 40
23:08:13 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300), 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:13 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:13 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2126.655743] loop4: detected capacity change from 0 to 40
[ 2126.680828] loop1: detected capacity change from 0 to 40
[ 2126.787868] loop6: detected capacity change from 0 to 40
[ 2126.812737] syz-executor.3: attempt to access beyond end of device
[ 2126.812737] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.814583] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2126.820056] loop7: detected capacity change from 0 to 40
23:08:13 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2126.969655] syz-executor.1: attempt to access beyond end of device
[ 2126.969655] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.971491] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2126.991785] syz-executor.7: attempt to access beyond end of device
[ 2126.991785] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2126.993686] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2127.054874] syz-executor.6: attempt to access beyond end of device
[ 2127.054874] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2127.056714] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2127.090939] syz-executor.4: attempt to access beyond end of device
[ 2127.090939] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2127.092760] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2127.098164] loop3: detected capacity change from 0 to 40
23:08:27 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:27 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:27 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:27 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2141.082937] loop7: detected capacity change from 0 to 40
[ 2141.089877] loop4: detected capacity change from 0 to 40
23:08:27 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:27 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:27 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:08:27 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2141.117541] loop5: detected capacity change from 0 to 40
[ 2141.150095] FAT-fs (loop5): bogus number of reserved sectors
[ 2141.150937] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2141.160659] loop0: detected capacity change from 0 to 40
[ 2141.164089] loop6: detected capacity change from 0 to 40
[ 2141.166017] loop3: detected capacity change from 0 to 40
[ 2141.170842] loop1: detected capacity change from 0 to 40
[ 2141.249562] bio_check_eod: 1 callbacks suppressed
[ 2141.249583] syz-executor.4: attempt to access beyond end of device
[ 2141.249583] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.252207] buffer_io_error: 1 callbacks suppressed
[ 2141.252222] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2141.355228] syz-executor.3: attempt to access beyond end of device
[ 2141.355228] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.357231] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2141.382872] syz-executor.1: attempt to access beyond end of device
[ 2141.382872] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.385257] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2141.403432] syz-executor.7: attempt to access beyond end of device
[ 2141.403432] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.405283] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:08:28 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2141.421726] syz-executor.6: attempt to access beyond end of device
[ 2141.421726] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.423864] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2141.442500] syz-executor.0: attempt to access beyond end of device
[ 2141.442500] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.444279] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:08:28 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:08:28 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0), &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:08:28 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2141.654757] loop4: detected capacity change from 0 to 40
23:08:28 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:28 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r2, r3, r4, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2141.717214] loop6: detected capacity change from 0 to 40
[ 2141.721819] loop3: detected capacity change from 0 to 40
[ 2141.810652] loop7: detected capacity change from 0 to 40
[ 2141.829520] syz-executor.3: attempt to access beyond end of device
[ 2141.829520] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.831791] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2141.855946] syz-executor.6: attempt to access beyond end of device
[ 2141.855946] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.859220] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2141.919551] syz-executor.7: attempt to access beyond end of device
[ 2141.919551] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2141.921555] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:08:28 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:08:28 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2142.223587] loop3: detected capacity change from 0 to 40
[ 2142.230500] loop6: detected capacity change from 0 to 40
[ 2142.237619] syz-executor.4: attempt to access beyond end of device
[ 2142.237619] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2142.239699] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:08:44 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r2, r3, r4, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2157.290014] loop3: detected capacity change from 0 to 40
23:08:44 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:44 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:44 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

23:08:44 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:08:44 executing program 0:
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2157.296714] loop6: detected capacity change from 0 to 40
23:08:44 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2157.328396] bio_check_eod: 1 callbacks suppressed
[ 2157.328408] syz-executor.6: attempt to access beyond end of device
[ 2157.328408] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.329760] buffer_io_error: 1 callbacks suppressed
[ 2157.329768] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2157.346306] loop5: detected capacity change from 0 to 40
[ 2157.355871] loop1: detected capacity change from 0 to 40
[ 2157.356879] FAT-fs (loop5): bogus number of reserved sectors
[ 2157.357454] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2157.360761] loop7: detected capacity change from 0 to 40
[ 2157.362782] loop4: detected capacity change from 0 to 40
23:08:44 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2157.469018] syz-executor.4: attempt to access beyond end of device
[ 2157.469018] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.470039] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:08:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

[ 2157.530686] loop6: detected capacity change from 0 to 40
[ 2157.560082] syz-executor.7: attempt to access beyond end of device
[ 2157.560082] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.561859] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:08:44 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2157.625708] loop3: detected capacity change from 0 to 40
23:08:44 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:08:44 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2157.719030] syz-executor.6: attempt to access beyond end of device
[ 2157.719030] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.720800] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2157.774551] loop4: detected capacity change from 0 to 40
23:08:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2157.887728] loop7: detected capacity change from 0 to 40
[ 2157.902089] loop3: detected capacity change from 0 to 40
23:08:44 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2157.924890] syz-executor.4: attempt to access beyond end of device
[ 2157.924890] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2157.927128] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2158.058098] loop6: detected capacity change from 0 to 40
23:08:44 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2158.114555] syz-executor.7: attempt to access beyond end of device
[ 2158.114555] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2158.117535] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:08:45 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2158.256284] syz-executor.6: attempt to access beyond end of device
[ 2158.256284] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2158.258145] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2158.276895] loop4: detected capacity change from 0 to 40
[ 2158.323908] loop3: detected capacity change from 0 to 40
[ 2158.443883] syz-executor.4: attempt to access beyond end of device
[ 2158.443883] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2158.445862] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:00 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2173.507737] loop4: detected capacity change from 0 to 40
23:09:00 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:09:00 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 0:
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:09:00 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2173.524679] loop6: detected capacity change from 0 to 40
[ 2173.539486] loop7: detected capacity change from 0 to 40
[ 2173.579206] syz-executor.4: attempt to access beyond end of device
[ 2173.579206] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2173.580390] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2173.592222] loop5: detected capacity change from 0 to 40
[ 2173.593826] loop1: detected capacity change from 0 to 40
[ 2173.602140] loop3: detected capacity change from 0 to 40
23:09:00 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

23:09:00 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2173.668153] loop6: detected capacity change from 0 to 40
[ 2173.692921] loop4: detected capacity change from 0 to 40
[ 2173.742122] syz-executor.7: attempt to access beyond end of device
[ 2173.742122] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2173.744377] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:09:00 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2173.850432] loop6: detected capacity change from 0 to 40
23:09:00 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

[ 2173.918457] syz-executor.4: attempt to access beyond end of device
[ 2173.918457] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2173.920375] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:00 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:00 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2174.112552] loop3: detected capacity change from 0 to 40
23:09:01 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2174.176835] loop7: detected capacity change from 0 to 40
[ 2174.196293] loop4: detected capacity change from 0 to 40
[ 2174.307381] loop6: detected capacity change from 0 to 40
[ 2174.313636] syz-executor.7: attempt to access beyond end of device
[ 2174.313636] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2174.315490] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2174.431411] syz-executor.4: attempt to access beyond end of device
[ 2174.431411] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2174.433434] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:15 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:15 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:15 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:15 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

[ 2188.415525] loop7: detected capacity change from 0 to 40
[ 2188.415594] loop3: detected capacity change from 0 to 40
[ 2188.426999] loop5: detected capacity change from 0 to 40
[ 2188.427480] loop1: detected capacity change from 0 to 40
23:09:15 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:09:15 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
setgroups(0x5, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:09:15 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2188.471852] loop4: detected capacity change from 0 to 40
[ 2188.485751] loop6: detected capacity change from 0 to 40
[ 2188.510157] syz-executor.7: attempt to access beyond end of device
[ 2188.510157] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2188.512132] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:09:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0x0)

23:09:15 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2188.745361] syz-executor.4: attempt to access beyond end of device
[ 2188.745361] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2188.747519] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2188.842858] loop3: detected capacity change from 0 to 40
23:09:15 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2188.916484] loop7: detected capacity change from 0 to 40
[ 2188.920171] loop6: detected capacity change from 0 to 40
23:09:15 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

23:09:15 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:15 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2189.117369] loop4: detected capacity change from 0 to 40
[ 2189.151180] syz-executor.7: attempt to access beyond end of device
[ 2189.151180] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2189.152788] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:09:16 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2189.194082] loop6: detected capacity change from 0 to 40
[ 2189.195167] syz-executor.4: attempt to access beyond end of device
[ 2189.195167] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2189.196315] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2189.204043] FAT-fs (loop0): bogus number of reserved sectors
[ 2189.204787] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2189.253224] loop3: detected capacity change from 0 to 40
23:09:16 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2189.278246] FAT-fs (loop3): bogus number of reserved sectors
[ 2189.279008] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2189.308730] loop7: detected capacity change from 0 to 40
[ 2189.353928] syz-executor.7: attempt to access beyond end of device
[ 2189.353928] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2189.355292] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2204.756645] loop3: detected capacity change from 0 to 40
23:09:31 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0), &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r2, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:09:31 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

23:09:31 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2204.760800] loop7: detected capacity change from 0 to 40
[ 2204.767843] FAT-fs (loop3): bogus number of FAT sectors
[ 2204.768260] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2204.776645] loop4: detected capacity change from 0 to 40
[ 2204.789787] syz-executor.7: attempt to access beyond end of device
[ 2204.789787] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.791060] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2204.793619] FAT-fs (loop0): bogus number of reserved sectors
[ 2204.794173] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2204.809036] loop1: detected capacity change from 0 to 40
[ 2204.811750] loop6: detected capacity change from 0 to 40
[ 2204.818504] FAT-fs (loop1): bogus number of FAT sectors
[ 2204.818924] FAT-fs (loop1): Can't find a valid FAT filesystem
[ 2204.935935] syz-executor.4: attempt to access beyond end of device
[ 2204.935935] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2204.937161] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:31 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:31 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

[ 2205.025029] loop7: detected capacity change from 0 to 40
23:09:31 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2205.162612] loop6: detected capacity change from 0 to 40
23:09:32 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2205.223790] loop4: detected capacity change from 0 to 40
[ 2205.236398] syz-executor.7: attempt to access beyond end of device
[ 2205.236398] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.238684] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2205.333255] loop5: detected capacity change from 0 to 40
[ 2205.366933] syz-executor.4: attempt to access beyond end of device
[ 2205.366933] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.369311] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:32 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:32 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:32 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2205.563355] loop7: detected capacity change from 0 to 40
[ 2205.620529] FAT-fs (loop6): bogus number of reserved sectors
[ 2205.621487] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 2205.663621] loop4: detected capacity change from 0 to 40
[ 2205.793769] syz-executor.7: attempt to access beyond end of device
[ 2205.793769] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.795111] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:09:32 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:32 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2205.929253] syz-executor.4: attempt to access beyond end of device
[ 2205.929253] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.931264] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:32 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:32 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2205.984784] loop0: detected capacity change from 0 to 40
23:09:32 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2206.008467] FAT-fs (loop3): bogus number of reserved sectors
[ 2206.009020] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2206.022738] loop1: detected capacity change from 0 to 40
[ 2206.033102] loop7: detected capacity change from 0 to 40
[ 2206.039123] FAT-fs (loop1): invalid media value (0x00)
[ 2206.039602] FAT-fs (loop1): Can't find a valid FAT filesystem
23:09:33 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2206.281529] syz-executor.7: attempt to access beyond end of device
[ 2206.281529] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2206.282732] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2206.288894] loop4: detected capacity change from 0 to 40
[ 2206.413231] syz-executor.4: attempt to access beyond end of device
[ 2206.413231] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2206.414232] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:09:47 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2220.803720] loop6: detected capacity change from 0 to 40
23:09:47 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:47 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:47 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:47 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

23:09:47 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0), &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
setgroups(0x0, 0x0)
r3 = getpid()
rt_tgsigqueueinfo(r3, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r3, 0x0, 0x2})
r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:09:47 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:09:47 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2220.817036] loop0: detected capacity change from 0 to 40
[ 2220.818374] loop4: detected capacity change from 0 to 40
[ 2220.821164] FAT-fs (loop1): bogus number of reserved sectors
[ 2220.821595] FAT-fs (loop1): Can't find a valid FAT filesystem
[ 2220.825630] FAT-fs (loop6): bogus number of FAT sectors
[ 2220.826107] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 2220.827844] FAT-fs (loop0): invalid media value (0x00)
[ 2220.828310] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2220.851513] loop7: detected capacity change from 0 to 40
[ 2220.893334] loop5: detected capacity change from 0 to 40
23:09:47 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2220.935261] FAT-fs (loop5): invalid media value (0x00)
[ 2220.936176] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2220.975003] loop4: detected capacity change from 0 to 40
23:09:47 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2221.148620] loop4: detected capacity change from 0 to 40
[ 2221.159377] syz-executor.7: attempt to access beyond end of device
[ 2221.159377] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.161153] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:09:48 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2221.350361] loop4: detected capacity change from 0 to 40
23:10:04 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:04 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:10:04 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2237.602313] loop4: detected capacity change from 0 to 40
[ 2237.610405] loop0: detected capacity change from 0 to 40
[ 2237.612526] loop7: detected capacity change from 0 to 40
[ 2237.620389] FAT-fs (loop0): invalid media value (0x00)
[ 2237.620831] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2237.638587] FAT-fs (loop3): bogus number of reserved sectors
[ 2237.639763] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2237.640634] loop5: detected capacity change from 0 to 40
[ 2237.643543] loop1: detected capacity change from 0 to 40
23:10:04 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2237.846500] syz-executor.5: attempt to access beyond end of device
[ 2237.846500] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2237.847673] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2237.866226] syz-executor.1: attempt to access beyond end of device
[ 2237.866226] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2237.867366] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2237.880735] syz-executor.7: attempt to access beyond end of device
[ 2237.880735] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2237.882718] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:04 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:04 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2238.078642] loop4: detected capacity change from 0 to 40
[ 2238.124456] loop5: detected capacity change from 0 to 40
[ 2238.135187] loop7: detected capacity change from 0 to 40
23:10:05 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2238.271480] syz-executor.7: attempt to access beyond end of device
[ 2238.271480] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2238.272863] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2238.300555] loop1: detected capacity change from 0 to 40
23:10:05 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:05 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

[ 2238.458688] loop4: detected capacity change from 0 to 40
[ 2238.472305] syz-executor.5: attempt to access beyond end of device
[ 2238.472305] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2238.474503] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2238.477520] loop7: detected capacity change from 0 to 40
23:10:05 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
setgroups(0x5, &(0x7f00000058c0)=[r1, r2, r3, 0x0, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2238.673639] syz-executor.7: attempt to access beyond end of device
[ 2238.673639] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2238.675503] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:20 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:20 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:20 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

23:10:20 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:20 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:20 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:20 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:20 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2253.740201] loop4: detected capacity change from 0 to 40
[ 2253.743998] FAT-fs (loop3): bogus number of reserved sectors
[ 2253.744468] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2253.754603] loop6: detected capacity change from 0 to 40
[ 2253.767405] loop7: detected capacity change from 0 to 40
[ 2253.788074] loop0: detected capacity change from 0 to 40
[ 2253.797839] FAT-fs (loop0): invalid media value (0x00)
[ 2253.798347] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2253.868452] syz-executor.6: attempt to access beyond end of device
[ 2253.868452] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2253.869713] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:10:20 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

[ 2253.906202] syz-executor.7: attempt to access beyond end of device
[ 2253.906202] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2253.907386] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2253.955078] loop4: detected capacity change from 0 to 40
23:10:20 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x5, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:20 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), 0x0)
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:20 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2254.119280] loop7: detected capacity change from 0 to 40
23:10:21 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2254.246656] syz-executor.7: attempt to access beyond end of device
[ 2254.246656] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2254.247915] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:21 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', 0x0)
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2254.332500] loop5: detected capacity change from 0 to 40
[ 2254.632289] syz-executor.5: attempt to access beyond end of device
[ 2254.632289] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2254.634172] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:10:35 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, 0x0, &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:35 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', 0x0)
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:35 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(0x0, &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2268.734299] loop1: detected capacity change from 0 to 40
[ 2268.736365] loop7: detected capacity change from 0 to 40
[ 2268.749035] loop3: detected capacity change from 0 to 40
[ 2268.762914] loop5: detected capacity change from 0 to 40
[ 2268.773194] FAT-fs (loop5): invalid media value (0x00)
[ 2268.773632] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2268.885644] syz-executor.7: attempt to access beyond end of device
[ 2268.885644] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2268.887504] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2268.889525] syz-executor.3: attempt to access beyond end of device
[ 2268.889525] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2268.890613] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:10:35 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2269.021197] loop7: detected capacity change from 0 to 40
23:10:35 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:35 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, 0x0, &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:35 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2269.093568] loop4: detected capacity change from 0 to 40
[ 2269.133689] loop6: detected capacity change from 0 to 40
[ 2269.176634] loop3: detected capacity change from 0 to 40
[ 2269.182321] syz-executor.7: attempt to access beyond end of device
[ 2269.182321] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2269.183478] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2269.250122] syz-executor.4: attempt to access beyond end of device
[ 2269.250122] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2269.251249] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2269.272663] syz-executor.6: attempt to access beyond end of device
[ 2269.272663] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2269.273725] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:10:36 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:36 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(0x0, &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:36 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', 0x0)
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, 0x0, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2269.468752] loop7: detected capacity change from 0 to 40
[ 2269.582156] syz-executor.7: attempt to access beyond end of device
[ 2269.582156] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2269.583284] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:52 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(0x0, &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:52 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', 0x0)
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, 0x0, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:10:52 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2285.242499] loop5: detected capacity change from 0 to 40
[ 2285.248222] loop7: detected capacity change from 0 to 40
[ 2285.264152] loop1: detected capacity change from 0 to 40
[ 2285.273908] syz-executor.5: attempt to access beyond end of device
[ 2285.273908] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2285.275043] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:10:52 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2285.330498] syz-executor.7: attempt to access beyond end of device
[ 2285.330498] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2285.331593] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2285.342665] loop6: detected capacity change from 0 to 40
[ 2285.364436] loop0: detected capacity change from 0 to 40
[ 2285.390476] loop5: detected capacity change from 0 to 40
[ 2285.400625] FAT-fs (loop0): bogus number of reserved sectors
[ 2285.401685] FAT-fs (loop0): Can't find a valid FAT filesystem
23:10:52 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2285.586471] syz-executor.5: attempt to access beyond end of device
[ 2285.586471] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2285.587740] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2285.599775] loop7: detected capacity change from 0 to 40
23:10:52 executing program 3:
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2285.615644] loop4: detected capacity change from 0 to 40
[ 2285.758101] syz-executor.7: attempt to access beyond end of device
[ 2285.758101] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2285.759126] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:52 executing program 5:
r0 = syz_mount_image$vfat(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2285.856212] loop5: detected capacity change from 0 to 40
[ 2285.889423] syz-executor.4: attempt to access beyond end of device
[ 2285.889423] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2285.891833] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:10:52 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:10:53 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), 0x0)
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2286.175433] loop7: detected capacity change from 0 to 40
23:10:53 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2286.398379] syz-executor.7: attempt to access beyond end of device
[ 2286.398379] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2286.400347] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:10:53 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:10:53 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, 0x0, &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2286.742737] loop1: detected capacity change from 0 to 40
[ 2286.828879] syz-executor.1: attempt to access beyond end of device
[ 2286.828879] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2286.830011] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2303.938884] loop3: detected capacity change from 0 to 40
23:11:10 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:10 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:10 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:10 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:10 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x0, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:10 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:10 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:10 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2303.978760] loop4: detected capacity change from 0 to 40
[ 2303.989236] loop5: detected capacity change from 0 to 40
[ 2303.990550] loop1: detected capacity change from 0 to 40
[ 2304.000602] FAT-fs (loop1): bogus number of reserved sectors
[ 2304.001130] FAT-fs (loop1): Can't find a valid FAT filesystem
[ 2304.030843] syz-executor.3: attempt to access beyond end of device
[ 2304.030843] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2304.032067] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 2304.037700] loop7: detected capacity change from 0 to 40
23:11:11 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2304.210339] syz-executor.7: attempt to access beyond end of device
[ 2304.210339] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2304.212689] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:11 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:11 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:11 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:11 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2304.669876] loop6: detected capacity change from 0 to 40
[ 2304.687267] loop7: detected capacity change from 0 to 40
[ 2304.723379] loop0: detected capacity change from 0 to 40
23:11:11 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2304.963383] syz-executor.7: attempt to access beyond end of device
[ 2304.963383] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2304.965211] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2304.990573] syz-executor.0: attempt to access beyond end of device
[ 2304.990573] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2304.992456] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2305.013378] syz-executor.6: attempt to access beyond end of device
[ 2305.013378] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2305.015190] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:11:11 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:12 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:12 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2305.185687] loop7: detected capacity change from 0 to 40
23:11:12 executing program 4:
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:11:12 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x0, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2305.326585] syz-executor.7: attempt to access beyond end of device
[ 2305.326585] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2305.328461] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2305.341340] FAT-fs (loop5): bogus number of reserved sectors
[ 2305.342333] FAT-fs (loop5): Can't find a valid FAT filesystem
23:11:29 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:29 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[0x0, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:29 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:29 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')

[ 2322.529801] loop7: detected capacity change from 0 to 40
23:11:29 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:29 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2322.541626] FAT-fs (loop0): bogus number of reserved sectors
23:11:29 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, 0x0)
getresgid(&(0x7f00000055c0)=<r2=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, 0x0, r2, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r5, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:29 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2322.542617] FAT-fs (loop0): Can't find a valid FAT filesystem
[ 2322.567779] loop1: detected capacity change from 0 to 40
[ 2322.572577] FAT-fs (loop1): bogus number of reserved sectors
[ 2322.573151] FAT-fs (loop1): Can't find a valid FAT filesystem
[ 2322.577032] syz-executor.7: attempt to access beyond end of device
[ 2322.577032] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2322.577993] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:29 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2322.610860] loop4: detected capacity change from 0 to 40
23:11:29 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2322.740561] loop7: detected capacity change from 0 to 40
[ 2322.798766] syz-executor.4: attempt to access beyond end of device
[ 2322.798766] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2322.799938] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:11:29 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2322.837474] loop5: detected capacity change from 0 to 40
[ 2322.857452] FAT-fs (loop5): bogus number of reserved sectors
[ 2322.858560] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2322.863576] syz-executor.7: attempt to access beyond end of device
[ 2322.863576] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2322.864704] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:45 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:45 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)

23:11:45 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2338.164886] loop7: detected capacity change from 0 to 40
23:11:45 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:45 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[0x0, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:45 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[0x0, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:45 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:45 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2338.181686] loop6: detected capacity change from 0 to 40
[ 2338.192633] loop1: detected capacity change from 0 to 40
[ 2338.263366] FAT-fs (loop5): bogus number of reserved sectors
[ 2338.264392] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2338.281842] syz-executor.6: attempt to access beyond end of device
[ 2338.281842] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2338.283214] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:11:45 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)

[ 2338.341403] syz-executor.7: attempt to access beyond end of device
[ 2338.341403] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2338.342704] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:45 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:45 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x0, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:45 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2338.641395] loop6: detected capacity change from 0 to 40
23:11:45 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2338.748429] syz-executor.6: attempt to access beyond end of device
[ 2338.748429] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2338.750625] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:11:45 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, 0x0, 0x0, r3, 0x0])
r4 = getpid()
rt_tgsigqueueinfo(r4, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r4, 0x0, 0x2})

[ 2338.801321] loop7: detected capacity change from 0 to 40
[ 2338.960517] loop0: detected capacity change from 0 to 40
23:11:45 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[<r2=>0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2339.021330] syz-executor.7: attempt to access beyond end of device
[ 2339.021330] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.022575] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:45 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2339.180514] syz-executor.0: attempt to access beyond end of device
[ 2339.180514] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.182108] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2339.199662] loop7: detected capacity change from 0 to 40
[ 2339.228326] syz-executor.7: attempt to access beyond end of device
[ 2339.228326] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2339.229373] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:11:59 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:59 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x0, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:11:59 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x0, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2352.993870] loop0: detected capacity change from 0 to 40
23:11:59 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r0=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r0, r1, 0x0, 0x0, r2, 0x0])
r3 = getpid()
rt_tgsigqueueinfo(r3, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})

23:11:59 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2353.002600] loop4: detected capacity change from 0 to 40
23:11:59 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:59 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:11:59 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2353.024723] loop6: detected capacity change from 0 to 40
[ 2353.030902] loop7: detected capacity change from 0 to 40
[ 2353.103438] syz-executor.6: attempt to access beyond end of device
[ 2353.103438] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.104557] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2353.117451] syz-executor.7: attempt to access beyond end of device
[ 2353.117451] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.118412] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2353.158841] syz-executor.0: attempt to access beyond end of device
[ 2353.158841] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.159868] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:12:00 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r0=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r0, r1, 0x0, 0x0, r2, 0x0])
getpid()

[ 2353.184781] syz-executor.4: attempt to access beyond end of device
[ 2353.184781] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.186254] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:12:00 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:00 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[<r2=>0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2353.309591] loop7: detected capacity change from 0 to 40
23:12:00 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:00 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:00 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, 0x0, 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:00 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r0=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r0, r1, 0x0, 0x0, r2, 0x0])

23:12:00 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2353.412770] FAT-fs (loop1): bogus number of reserved sectors
[ 2353.413606] FAT-fs (loop1): Can't find a valid FAT filesystem
[ 2353.426026] loop5: detected capacity change from 0 to 40
[ 2353.457461] syz-executor.7: attempt to access beyond end of device
[ 2353.457461] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.459388] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2353.469599] FAT-fs (loop5): bogus number of reserved sectors
[ 2353.470672] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 2353.501676] loop4: detected capacity change from 0 to 40
23:12:00 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:00 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2353.724541] loop7: detected capacity change from 0 to 40
[ 2353.741560] loop6: detected capacity change from 0 to 40
[ 2353.859709] syz-executor.7: attempt to access beyond end of device
[ 2353.859709] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.862031] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2353.924729] syz-executor.6: attempt to access beyond end of device
[ 2353.924729] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2353.926922] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:12:17 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, 0x0, 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:17 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:17 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:17 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2370.638220] loop7: detected capacity change from 0 to 40
[ 2370.647470] loop6: detected capacity change from 0 to 40
23:12:17 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
fdatasync(0xffffffffffffffff)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0))
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))

[ 2370.701327] loop1: detected capacity change from 0 to 40
[ 2370.726897] syz-executor.7: attempt to access beyond end of device
[ 2370.726897] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.728123] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:12:17 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0))
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2370.830473] syz-executor.6: attempt to access beyond end of device
[ 2370.830473] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.832482] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:12:17 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2370.933885] syz-executor.1: attempt to access beyond end of device
[ 2370.933885] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.935810] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:12:17 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:12:17 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:17 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x1, &(0x7f0000005300)=[<r1=>0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:17 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2371.109420] loop6: detected capacity change from 0 to 40
[ 2371.129285] loop7: detected capacity change from 0 to 40
[ 2371.134000] FAT-fs (loop4): bogus number of reserved sectors
[ 2371.134802] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 2371.176426] loop5: detected capacity change from 0 to 40
23:12:18 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2371.287717] loop1: detected capacity change from 0 to 40
[ 2371.331861] syz-executor.7: attempt to access beyond end of device
[ 2371.331861] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.334231] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:12:18 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2371.397255] syz-executor.6: attempt to access beyond end of device
[ 2371.397255] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.399227] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2371.448325] syz-executor.5: attempt to access beyond end of device
[ 2371.448325] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.450213] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:12:18 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2371.512818] syz-executor.1: attempt to access beyond end of device
[ 2371.512818] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.514619] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:12:18 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2371.606085] loop7: detected capacity change from 0 to 40
23:12:18 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2371.739267] syz-executor.7: attempt to access beyond end of device
[ 2371.739267] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.741625] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:12:34 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:34 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:34 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x0, 0x0)
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[0x0, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:34 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:34 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:34 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
fdatasync(0xffffffffffffffff)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:34 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:34 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2387.508248] loop0: detected capacity change from 0 to 40
[ 2387.527777] loop7: detected capacity change from 0 to 40
[ 2387.537719] loop4: detected capacity change from 0 to 40
23:12:34 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2387.609608] syz-executor.7: attempt to access beyond end of device
[ 2387.609608] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2387.610928] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:12:34 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:34 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2387.777528] syz-executor.0: attempt to access beyond end of device
[ 2387.777528] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2387.779680] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2387.803681] syz-executor.4: attempt to access beyond end of device
[ 2387.803681] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2387.805611] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2387.881268] loop5: detected capacity change from 0 to 40
23:12:48 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:48 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:48 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
fdatasync(0xffffffffffffffff)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2402.150407] loop7: detected capacity change from 0 to 40
[ 2402.161456] loop4: detected capacity change from 0 to 40
[ 2402.165712] loop0: detected capacity change from 0 to 40
23:12:49 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2402.271455] syz-executor.4: attempt to access beyond end of device
[ 2402.271455] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.273239] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2402.280649] syz-executor.0: attempt to access beyond end of device
[ 2402.280649] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.282325] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2402.313485] syz-executor.7: attempt to access beyond end of device
[ 2402.313485] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.315167] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:12:49 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:12:49 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:49 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x0)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:12:49 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:12:49 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2402.557831] loop4: detected capacity change from 0 to 40
[ 2402.631906] loop0: detected capacity change from 0 to 40
[ 2402.641976] loop7: detected capacity change from 0 to 40
[ 2402.743744] syz-executor.4: attempt to access beyond end of device
[ 2402.743744] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.746129] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2402.846444] syz-executor.7: attempt to access beyond end of device
[ 2402.846444] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.847879] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2402.882702] syz-executor.0: attempt to access beyond end of device
[ 2402.882702] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2402.884919] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:13:04 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:04 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:04 executing program 6:
r0 = syz_mount_image$vfat(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:04 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2417.440127] loop7: detected capacity change from 0 to 40
23:13:04 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:04 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:13:04 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:04 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2417.455621] loop6: detected capacity change from 0 to 40
[ 2417.479395] loop5: detected capacity change from 0 to 40
[ 2417.501400] syz-executor.7: attempt to access beyond end of device
[ 2417.501400] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.502406] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2417.510241] loop4: detected capacity change from 0 to 40
[ 2417.511741] loop0: detected capacity change from 0 to 40
23:13:04 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:04 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2417.646837] syz-executor.5: attempt to access beyond end of device
[ 2417.646837] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.647884] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:13:04 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2417.674527] syz-executor.4: attempt to access beyond end of device
[ 2417.674527] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.675605] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2417.682552] syz-executor.0: attempt to access beyond end of device
[ 2417.682552] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.683595] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2417.686606] loop7: detected capacity change from 0 to 40
23:13:04 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2417.728055] loop1: detected capacity change from 0 to 40
23:13:04 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:04 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:04 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:04 executing program 3:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:04 executing program 3:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:04 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2417.897156] loop4: detected capacity change from 0 to 40
[ 2417.933620] syz-executor.1: attempt to access beyond end of device
[ 2417.933620] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.934904] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2417.947636] loop0: detected capacity change from 0 to 40
[ 2417.975353] syz-executor.7: attempt to access beyond end of device
[ 2417.975353] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2417.977269] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:13:04 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2418.087545] loop1: detected capacity change from 0 to 40
[ 2418.151336] syz-executor.1: attempt to access beyond end of device
[ 2418.151336] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2418.152391] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2418.276462] syz-executor.4: attempt to access beyond end of device
[ 2418.276462] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2418.278410] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:13:05 executing program 3:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2418.387452] loop1: detected capacity change from 0 to 40
23:13:05 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:05 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:05 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2418.397675] loop7: detected capacity change from 0 to 40
23:13:05 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2418.432101] loop6: detected capacity change from 0 to 40
23:13:05 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2418.464905] syz-executor.7: attempt to access beyond end of device
[ 2418.464905] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2418.465915] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:13:05 executing program 4:
r0 = syz_mount_image$vfat(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:05 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:05 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2418.613320] syz-executor.1: attempt to access beyond end of device
[ 2418.613320] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2418.614492] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2418.661435] loop4: detected capacity change from 0 to 40
[ 2418.706382] loop7: detected capacity change from 0 to 40
23:13:23 executing program 4:
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:23 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:23 executing program 6:
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:23 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:23 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:23 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

23:13:23 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:23 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2436.517236] loop1: detected capacity change from 0 to 40
[ 2436.520849] loop0: detected capacity change from 0 to 40
[ 2436.527547] loop7: detected capacity change from 0 to 40
23:13:23 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

23:13:23 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

[ 2436.768406] syz-executor.1: attempt to access beyond end of device
[ 2436.768406] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2436.770613] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2436.780819] loop7: detected capacity change from 0 to 40
23:13:39 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:39 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:13:39 executing program 0:
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:13:39 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:39 executing program 6:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:13:39 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2452.375836] loop7: detected capacity change from 0 to 40
23:13:39 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)

23:13:39 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, &(0x7f0000005600), &(0x7f0000005640))

[ 2452.388441] loop1: detected capacity change from 0 to 40
[ 2452.396745] loop4: detected capacity change from 0 to 40
[ 2452.451529] loop6: detected capacity change from 0 to 40
23:13:39 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, &(0x7f0000005640))

23:13:39 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2452.604382] syz-executor.6: attempt to access beyond end of device
[ 2452.604382] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2452.606569] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:13:39 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2452.686354] syz-executor.4: attempt to access beyond end of device
[ 2452.686354] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2452.688400] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2452.764182] loop5: detected capacity change from 0 to 40
[ 2452.806766] loop7: detected capacity change from 0 to 40
23:13:54 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, &(0x7f0000005640))

23:13:54 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:13:54 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2467.698509] loop5: detected capacity change from 0 to 40
23:13:54 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:54 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:54 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:13:54 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:54 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2467.707560] loop6: detected capacity change from 0 to 40
[ 2467.761062] loop7: detected capacity change from 0 to 40
[ 2467.763599] syz-executor.6: attempt to access beyond end of device
[ 2467.763599] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2467.764688] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2467.790887] loop0: detected capacity change from 0 to 40
[ 2467.795823] loop4: detected capacity change from 0 to 40
23:13:54 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:54 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:13:54 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

[ 2467.900372] syz-executor.5: attempt to access beyond end of device
[ 2467.900372] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2467.902498] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2467.907487] loop1: detected capacity change from 0 to 40
23:13:54 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, 0x0)

[ 2467.940584] loop6: detected capacity change from 0 to 40
[ 2467.972122] syz-executor.0: attempt to access beyond end of device
[ 2467.972122] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2467.973195] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2468.056693] syz-executor.4: attempt to access beyond end of device
[ 2468.056693] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2468.059161] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2468.083315] loop7: detected capacity change from 0 to 40
23:13:54 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2468.171840] loop5: detected capacity change from 0 to 40
23:13:55 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(0xffffffffffffffff)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2468.280748] syz-executor.6: attempt to access beyond end of device
[ 2468.280748] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2468.283187] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2468.343890] syz-executor.5: attempt to access beyond end of device
[ 2468.343890] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2468.345513] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2468.360375] loop0: detected capacity change from 0 to 40
[ 2468.544325] syz-executor.0: attempt to access beyond end of device
[ 2468.544325] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2468.546363] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2484.400799] loop7: detected capacity change from 0 to 40
23:14:11 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, 0x0)

23:14:11 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:11 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:11 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:11 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

23:14:11 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:11 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:11 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2484.419672] loop6: detected capacity change from 0 to 40
[ 2484.443513] loop5: detected capacity change from 0 to 40
[ 2484.466549] loop4: detected capacity change from 0 to 40
23:14:11 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0x0)

23:14:11 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2484.613210] syz-executor.5: attempt to access beyond end of device
[ 2484.613210] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2484.615579] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2484.624753] loop3: detected capacity change from 0 to 40
[ 2484.641277] syz-executor.6: attempt to access beyond end of device
[ 2484.641277] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2484.643180] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:14:11 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2484.685806] loop7: detected capacity change from 0 to 40
[ 2484.739259] syz-executor.4: attempt to access beyond end of device
[ 2484.739259] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2484.741750] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:14:11 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:11 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2484.804614] syz-executor.3: attempt to access beyond end of device
[ 2484.804614] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2484.806420] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:14:11 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2484.981419] loop6: detected capacity change from 0 to 40
23:14:11 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:11 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2485.104983] loop5: detected capacity change from 0 to 40
[ 2485.235822] loop3: detected capacity change from 0 to 40
[ 2485.253569] syz-executor.6: attempt to access beyond end of device
[ 2485.253569] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2485.255649] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:14:12 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2485.353623] syz-executor.5: attempt to access beyond end of device
[ 2485.353623] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2485.355438] Buffer I/O error on dev loop5, logical block 10, lost async page write
23:14:12 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2485.470594] syz-executor.3: attempt to access beyond end of device
[ 2485.470594] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2485.472609] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:14:12 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:12 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, 0x0, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2485.525283] loop1: detected capacity change from 0 to 40
23:14:12 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:12 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2485.719808] syz-executor.1: attempt to access beyond end of device
[ 2485.719808] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2485.721708] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:14:28 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:28 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:28 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:28 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:28 executing program 3:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, 0x0, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2501.287160] loop0: detected capacity change from 0 to 40
23:14:28 executing program 7:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, 0x0, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r6, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:28 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, 0x0, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2501.291286] loop5: detected capacity change from 0 to 40
23:14:28 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, 0x0, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2501.329491] loop1: detected capacity change from 0 to 40
23:14:28 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2501.469707] loop7: detected capacity change from 0 to 40
[ 2501.475751] syz-executor.5: attempt to access beyond end of device
[ 2501.475751] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2501.476778] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2501.542760] syz-executor.0: attempt to access beyond end of device
[ 2501.542760] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2501.544064] syz-executor.7: attempt to access beyond end of device
[ 2501.544064] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2501.545154] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2501.545647] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2501.562898] syz-executor.1: attempt to access beyond end of device
[ 2501.562898] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2501.565271] Buffer I/O error on dev loop1, logical block 10, lost async page write
23:14:44 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 6:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
fchown(r3, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:14:44 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 7:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
fchown(r3, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:14:44 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, 0x0, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r5, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0), &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780))
r3 = getpid()
rt_tgsigqueueinfo(r3, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r2, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r3, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r4, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2517.247277] loop3: detected capacity change from 0 to 40
23:14:44 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:44 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2517.433619] syz-executor.3: attempt to access beyond end of device
[ 2517.433619] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2517.434704] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:14:44 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:44 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2517.517638] loop6: detected capacity change from 0 to 40
[ 2517.527850] loop0: detected capacity change from 0 to 40
23:14:44 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:44 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:14:44 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2517.764515] syz-executor.0: attempt to access beyond end of device
[ 2517.764515] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2517.766582] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2517.768642] loop4: detected capacity change from 0 to 40
[ 2517.775207] loop7: detected capacity change from 0 to 40
[ 2517.867746] syz-executor.6: attempt to access beyond end of device
[ 2517.867746] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2517.870201] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:14:44 executing program 6:
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x150, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_complete(0x0)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x4)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4)
write(r0, &(0x7f0000000300)="7f2e3fff533833505348ed73dc0a28", 0xf)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)

[ 2518.003737] loop3: detected capacity change from 0 to 40
[ 2518.061605] syz-executor.4: attempt to access beyond end of device
[ 2518.061605] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2518.063730] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:14:44 executing program 0:
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x150, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_complete(0x0)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x4)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4)
write(r0, &(0x7f0000000300)="7f2e3fff533833505348ed73dc0a28", 0xf)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4)

23:14:44 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2518.153902] syz-executor.7: attempt to access beyond end of device
[ 2518.153902] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2518.156071] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2518.229842] loop1: detected capacity change from 0 to 40
[ 2518.275900] syz-executor.3: attempt to access beyond end of device
[ 2518.275900] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2518.277934] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:14:45 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:45 executing program 7:
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x150, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_io_uring_complete(0x0)
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x4)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4)
write(r1, &(0x7f0000000300)="7f2e3fff533833505348ed73dc0a28", 0xf)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000), 0x4)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000040)={r0, 0xb58a, 0x100000001, 0x2})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)

23:14:45 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, 0x0, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:45 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:45 executing program 5:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:14:45 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
fchown(r3, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2518.451727] syz-executor.1: attempt to access beyond end of device
[ 2518.451727] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2518.453546] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2518.513342] loop0: detected capacity change from 0 to 40
[ 2518.704847] syz-executor.0: attempt to access beyond end of device
[ 2518.704847] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2518.706709] Buffer I/O error on dev loop0, logical block 10, lost async page write
23:15:00 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:00 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:00 executing program 2:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

[ 2534.026463] loop0: detected capacity change from 0 to 40
[ 2534.031155] loop7: detected capacity change from 0 to 40
23:15:00 executing program 5:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r2)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r3 = socket$inet6(0xa, 0x1, 0x0)
fchown(r3, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x4)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

23:15:00 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:00 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:00 executing program 4:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r8, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:00 executing program 1:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2534.077671] loop1: detected capacity change from 0 to 40
[ 2534.109057] loop3: detected capacity change from 0 to 40
[ 2534.114323] loop6: detected capacity change from 0 to 40
[ 2534.117237] loop5: detected capacity change from 0 to 40
[ 2534.156147] syz-executor.1: attempt to access beyond end of device
[ 2534.156147] loop1: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.157227] Buffer I/O error on dev loop1, logical block 10, lost async page write
[ 2534.227471] syz-executor.0: attempt to access beyond end of device
[ 2534.227471] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.229277] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2534.232412] syz-executor.7: attempt to access beyond end of device
[ 2534.232412] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.234441] Buffer I/O error on dev loop7, logical block 10, lost async page write
[ 2534.249176] syz-executor.5: attempt to access beyond end of device
[ 2534.249176] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.250207] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2534.254468] syz-executor.6: attempt to access beyond end of device
[ 2534.254468] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.255505] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2534.262667] syz-executor.3: attempt to access beyond end of device
[ 2534.262667] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2534.263643] Buffer I/O error on dev loop3, logical block 10, lost async page write
23:15:16 executing program 5:
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x150, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_io_uring_complete(0x0)
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x4)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4)
write(r1, &(0x7f0000000300)="7f2e3fff533833505348ed73dc0a28", 0xf)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000), 0x4)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000040)={r0, 0xb58a, 0x100000001, 0x2})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)
socket$unix(0x1, 0x5, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
openat(r3, &(0x7f00000001c0)='./file1\x00', 0x400000, 0x102)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x181c00, 0x0)

23:15:16 executing program 3:
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x150, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_io_uring_complete(0x0)
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x4)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4)
write(r1, &(0x7f0000000300)="7f2e3fff533833505348ed73dc0a28", 0xf)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000), 0x4)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000040)={r0, 0xb58a, 0x100000001, 0x2})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)
socket$unix(0x1, 0x5, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
openat(r3, &(0x7f00000001c0)='./file1\x00', 0x400000, 0x102)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x181c00, 0x0)

23:15:16 executing program 4:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:16 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:16 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2549.565606] loop0: detected capacity change from 0 to 40
[ 2549.573582] loop7: detected capacity change from 0 to 40
23:15:16 executing program 3:
shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r0 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r1=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
getresgid(&(0x7f00000055c0)=<r3=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r1, r2, r3, 0x0, r4, 0x0])
r5 = getpid()
rt_tgsigqueueinfo(r5, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x48c00, 0x0)
ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2549.681823] syz-executor.0: attempt to access beyond end of device
[ 2549.681823] loop0: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2549.683094] Buffer I/O error on dev loop0, logical block 10, lost async page write
[ 2549.693210] loop6: detected capacity change from 0 to 40
[ 2549.722314] syz-executor.7: attempt to access beyond end of device
[ 2549.722314] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2549.723456] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:15:16 executing program 0:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})

[ 2549.770571] syz-executor.6: attempt to access beyond end of device
[ 2549.770571] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2549.771748] Buffer I/O error on dev loop6, logical block 10, lost async page write
23:15:16 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2549.916747] loop4: detected capacity change from 0 to 40
23:15:16 executing program 7:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
fchown(r4, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
open_tree(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x81900)
write$binfmt_aout(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0801022d9c02000022020000400000006e020000510000000000000000000000d722124410720590ac8548566a6de9af7118d129433ac1f1f81ac98c6ceb2ba8ab7d8edd2428e93393049c780d87a8e8a326fe475fcdc5adfe2db5f018e4cfba50b06b0eab18d2884eb0094ae4c7f77c32acf6c8c97714692a124ce74e05deda9d575f74b43892c5"], 0x88)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef)

23:15:16 executing program 6:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
preadv(r3, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
fdatasync(r3)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef) (fail_nth: 1)

23:15:16 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, 0x0) (fail_nth: 1)

[ 2550.028586] syz-executor.4: attempt to access beyond end of device
[ 2550.028586] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2550.030393] Buffer I/O error on dev loop4, logical block 10, lost async page write
23:15:16 executing program 0:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f0000000080)=""/121, 0x79}], 0x2, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
socket$inet6(0xa, 0x1, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef) (fail_nth: 1)

23:15:16 executing program 1:
r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
r1 = shmget$private(0x0, 0x1000, 0x100, &(0x7f0000fff000/0x1000)=nil)
shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x2000)
shmctl$IPC_RMID(0x0, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getgroups(0x2, &(0x7f0000005300)=[<r2=>0x0, 0x0])
statx(0xffffffffffffffff, &(0x7f0000005480)='./file0\x00', 0x6000, 0x400, &(0x7f00000054c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getresgid(&(0x7f00000055c0)=<r4=>0x0, &(0x7f0000005600), &(0x7f0000005640))
lstat(&(0x7f0000005740)='./file0\x00', &(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setgroups(0x6, &(0x7f00000058c0)=[r2, r3, r4, 0x0, r5, 0x0])
r6 = getpid()
rt_tgsigqueueinfo(r6, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x6})
shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x2, 0x0, 0x0, 0x0, r3, 0x0, 0x1}, 0x3ff, 0x70, 0x9, 0x8, r6, 0x0, 0x2})
syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
pread64(r7, &(0x7f00000000c0)=""/98, 0x62, 0x7fff)

23:15:16 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f00000001c0)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp\x00')
fdatasync(r3)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x200200, 0x4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000240), 0x4)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480))
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000300)=0x6, 0x80000000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb}, 0x15182, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendfile(r2, r1, 0x0, 0xfffffdef) (fail_nth: 1)

[ 2550.132860] loop7: detected capacity change from 0 to 40
[ 2550.134781] FAULT_INJECTION: forcing a failure.
[ 2550.134781] name fail_usercopy, interval 1, probability 0, space 0, times 1
[ 2550.136663] CPU: 0 PID: 10510 Comm: syz-executor.3 Not tainted 6.0.0-rc1-next-20220822 #1
[ 2550.137888] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521
[ 2550.139053] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 10510, name: syz-executor.3
[ 2550.140267] preempt_count: 0, expected: 0
[ 2550.140816] RCU nest depth: 0, expected: 0
[ 2550.141372] 1 lock held by syz-executor.3/10510:
[ 2550.141995]  #0: ffff8880436e39e8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100
[ 2550.143148] irq event stamp: 330
[ 2550.143601] hardirqs last  enabled at (329): [<ffffffff812be918>] __up_console_sem+0x78/0x80
[ 2550.144729] hardirqs last disabled at (330): [<ffffffff841214f5>] dump_stack_lvl+0x2e/0xb3
[ 2550.145825] softirqs last  enabled at (324): [<ffffffff8116ca6b>] __irq_exit_rcu+0x11b/0x180
[ 2550.146958] softirqs last disabled at (319): [<ffffffff8116ca6b>] __irq_exit_rcu+0x11b/0x180
[ 2550.148086] CPU: 0 PID: 10510 Comm: syz-executor.3 Not tainted 6.0.0-rc1-next-20220822 #1
[ 2550.150316] syz-executor.3[10510] cmdline: /syz-executor.3 exec
[ 2550.151418] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 2550.153052] Call Trace:
[ 2550.153444]  <TASK>
[ 2550.153787]  dump_stack_lvl+0x8b/0xb3
[ 2550.154391]  __might_resched.cold+0x222/0x26b
[ 2550.155110]  down_read_killable+0x75/0x490
[ 2550.155730]  ? down_read_interruptible+0x490/0x490
[ 2550.156657]  __access_remote_vm+0xac/0x6f0
[ 2550.157656]  ? follow_phys+0x2c0/0x2c0
[ 2550.158588]  ? do_raw_spin_lock+0x121/0x260
[ 2550.159442]  ? rwlock_bug.part.0+0x90/0x90
[ 2550.160191]  ? lock_release+0x3b2/0x750
[ 2550.160775]  ? __up_console_sem+0x47/0x80
[ 2550.161420]  get_mm_cmdline.part.0+0x214/0x600
[ 2550.162095]  ? dname_to_vma_addr.isra.0+0x360/0x360
[ 2550.162775]  ? _raw_spin_unlock_irqrestore+0x33/0x60
[ 2550.163538]  get_task_cmdline_kernel+0x1e9/0x230
[ 2550.164229]  dump_stack_print_cmdline.part.0+0x82/0x150
[ 2550.164998]  ? _atomic_dec_and_lock_irqsave+0x150/0x150
[ 2550.165756]  ? __wake_up_klogd.part.0+0xc5/0xf0
[ 2550.166505]  ? dump_stack_print_info+0xc6/0x190
[ 2550.167188]  dump_stack_print_info+0x185/0x190
[ 2550.167820]  dump_stack_lvl+0x7f/0xb3
[ 2550.168387]  should_fail.cold+0x5/0xa
[ 2550.168924]  _copy_to_user+0x2a/0x140
[ 2550.169493]  simple_read_from_buffer+0xcc/0x160
[ 2550.170185]  proc_fail_nth_read+0x198/0x230
[ 2550.170788]  ? proc_tid_comm_permission+0x1c0/0x1c0
[ 2550.171524]  ? security_file_permission+0xb1/0xe0
[ 2550.172224]  vfs_read+0x253/0x930
[ 2550.172713]  ? proc_tid_comm_permission+0x1c0/0x1c0
[ 2550.173420]  ? kernel_read+0x1c0/0x1c0
[ 2550.174007]  ? __fget_files+0x270/0x450
[ 2550.174583]  ksys_read+0x127/0x250
[ 2550.175135]  ? __ia32_sys_pwrite64+0x220/0x220
[ 2550.175782]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2550.176552]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2550.177331]  do_syscall_64+0x3b/0x90
[ 2550.177876]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 2550.178647] RIP: 0033:0x7f531744969c
[ 2550.179229] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
[ 2550.181730] RSP: 002b:00007f5314a0c170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 2550.182819] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f531744969c
[ 2550.183843] RDX: 000000000000000f RSI: 00007f5314a0c1e0 RDI: 0000000000000004
[ 2550.184870] RBP: 00007f5314a0c1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2550.185882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2550.186892] R13: 00007ffe982322af R14: 00007f5314a0c300 R15: 0000000000022000
[ 2550.187963]  </TASK>
[ 2550.190603] loop5: detected capacity change from 0 to 40
[ 2550.193808] loop0: detected capacity change from 0 to 40
[ 2550.200296] syz-executor.3[10510] cmdline: /syz-executor.3 exec
[ 2550.201504] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 2550.203293] Call Trace:
[ 2550.203823]  <TASK>
[ 2550.204289]  dump_stack_lvl+0x8b/0xb3
[ 2550.204859]  should_fail.cold+0x5/0xa
[ 2550.205489]  _copy_to_user+0x2a/0x140
[ 2550.206079]  simple_read_from_buffer+0xcc/0x160
[ 2550.206744]  proc_fail_nth_read+0x198/0x230
[ 2550.207403]  ? proc_tid_comm_permission+0x1c0/0x1c0
[ 2550.208137]  ? security_file_permission+0xb1/0xe0
[ 2550.208814]  vfs_read+0x253/0x930
[ 2550.209337]  ? proc_tid_comm_permission+0x1c0/0x1c0
[ 2550.210059]  ? kernel_read+0x1c0/0x1c0
[ 2550.210616]  ? __fget_files+0x270/0x450
[ 2550.211238]  ksys_read+0x127/0x250
[ 2550.211752]  ? __ia32_sys_pwrite64+0x220/0x220
[ 2550.212436]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2550.213170]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 2550.213894]  do_syscall_64+0x3b/0x90
[ 2550.214456]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 2550.215210] RIP: 0033:0x7f531744969c
[ 2550.215725] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
[ 2550.218122] RSP: 002b:00007f5314a0c170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 2550.219188] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f531744969c
[ 2550.220177] RDX: 000000000000000f RSI: 00007f5314a0c1e0 RDI: 0000000000000004
[ 2550.221201] RBP: 00007f5314a0c1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2550.222219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2550.223225] R13: 00007ffe982322af R14: 00007f5314a0c300 R15: 0000000000022000
[ 2550.224264]  </TASK>
[ 2550.281737] loop4: detected capacity change from 0 to 40
[ 2550.360250] syz-executor.7: attempt to access beyond end of device
[ 2550.360250] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2550.362067] Buffer I/O error on dev loop7, logical block 10, lost async page write
23:15:17 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getresgid(0x0, 0x0, 0x0)


VM DIAGNOSIS:
23:15:17  Registers:
info registers vcpu 0
RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=ffffffff8240d24c RDI=ffffffff8762d960 RBP=ffffffff8762d920 RSP=ffff8880457c71b0
R8 =0000000000000001 R9 =ffff8880457c713b R10=ffffed1008af8e27 R11=0000000000000001
R12=000000000000002e R13=ffffffff8762d920 R14=ffffffff8762dbb0 R15=ffffffff8762d970
RIP=ffffffff8240d2a1 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f5314a0c700 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fb819d92018 CR3=0000000046126000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM03=0000000000000000 0000000000000000 652d7a7973203a6d 6d6f432030313530
YMM04=0000000000000000 0000000000000000 76655f667265703d 7373616c63742030
YMM05=0000000000000000 0000000000000000 7379733a755f6d65 747379733d747865
YMM06=0000000000000000 0000000000000000 6b3a725f6d657473 79733a755f6d6574
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 322d7478656e2d31 63722d302e302e36
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=dffffc0000000000 RBX=ffff88800fe94000 RCX=1ffffffff0e066e0 RDX=1ffff11002e16c91
RSI=0000000000000000 RDI=ffff8880170b6488 RBP=ffff888037487df8 RSP=ffff888037487d40
R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001
R12=1ffff11006e90fad R13=ffff88804a19a080 R14=0000000000000001 R15=ffff88800d0c3ca0
RIP=ffffffff841e3b60 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000555555ad9400 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000000020000081 CR3=0000000017da0000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff4ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 ff000000000000ff
YMM01=0000000000000000 0000000000000000 2525252525252525 2525252525252525
YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM04=0000000000000000 0000000000000000 0000000000000000 00000000000000ff
YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000000000 000000524f525245
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 0000000000000000 00524f5252450040
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000